Privacy Policy
Effective date: [DATE — TO BE CONFIRMED]
1. Who We Are
We Are Lance Limited (“Lance”, “we”, “us”, “our”) is a company registered in England and Wales (company number 17252127), with a registered office at [REGISTERED ADDRESS — TO BE CONFIRMED]. We operate the Lance platform at lance.design, a B2B marketplace connecting brands with vetted freelance creatives.
Lance is the data controller for personal data collected through the platform. We are registered with the Information Commissioner’s Office (ICO) under reference [ICO REGISTRATION NUMBER — TO BE CONFIRMED].
If you have questions about how we handle your data, contact us at privacy@lance.design.
2. Data We Collect
2.1 Data you provide directly
- Account data: name, email address, password (hashed via Clerk), profile photo
- Brand data: company name, industry, billing address, VAT number
- Freelancer data: professional headline, disciplines, portfolio items, availability, day rate
- Financial data: bank account details for payouts (held by Stripe, not Lance directly)
- Communications: messages sent through the platform, meeting notes, project briefs
2.2 Data collected automatically
- Usage data: pages visited, features used, time spent, click patterns
- Device data: browser type, operating system, screen resolution, IP address
- Analytics data: collected via Google Analytics 4 (GA4) — see our Cookie Policy
- Log data: server logs, error reports, performance metrics
2.3 Data from third parties
- Stripe: payment status, payout eligibility, identity verification results
- Clerk: authentication events, sign-in history
3. How We Use Your Data
| Purpose | Legal basis (UK GDPR) |
|---|---|
| Creating and managing your account | Contract performance (Art. 6(1)(b)) |
| Facilitating projects between brands and freelancers | Contract performance (Art. 6(1)(b)) |
| Processing payments and payouts via Stripe | Contract performance (Art. 6(1)(b)) |
| Sending transactional notifications (booking confirmations, payment alerts) | Contract performance (Art. 6(1)(b)) |
| Complying with financial and legal obligations (invoicing, tax records) | Legal obligation (Art. 6(1)(c)) |
| Detecting fraud, abuse, and security threats | Legitimate interests (Art. 6(1)(f)) |
| Improving platform features and user experience via analytics | Legitimate interests (Art. 6(1)(f)) / Consent for cookies |
| Sending marketing communications (with opt-in) | Consent (Art. 6(1)(a)) |
4. Who We Share Data With
We do not sell your personal data. We share it only where necessary:
- Stripe Inc. — payment processing and identity verification. Stripe is a data processor acting on our instructions. See Stripe’s Privacy Policy.
- Clerk Inc. — authentication and user management.
- Google LLC (GA4) — anonymised analytics data, subject to your cookie consent.
- Supabase Inc. — cloud database and file storage infrastructure.
- Vercel Inc. — hosting and deployment infrastructure.
- Legal authorities — where required by law, court order, or to protect our legal rights.
All processors are contractually bound to handle data in accordance with UK GDPR and may not use your data for their own purposes.
5. International Transfers
Some of our third-party processors are based in the United States. Transfers are safeguarded by the UK’s International Data Transfer Agreements (IDTAs) or the UK Extension to the EU–US Data Privacy Framework, as applicable. You can request details of these safeguards by contacting privacy@lance.design.
6. How Long We Keep Your Data
| Data category | Retention period |
|---|---|
| Financial records (invoices, payouts, transactions) | 7 years (HMRC requirement) |
| Project records, messages, contracts | 6 years after project completion (Limitation Act 1980) |
| Account data (after deletion request) | 30 days (soft delete), then purged |
| Support correspondence | 2 years after resolution |
| Analytics data | 14 months (GA4 default) |
7. Security
We protect your data using:
- TLS encryption for all data in transit
- AES-256 encryption for data at rest
- Role-based access controls — employees only access data needed for their role
- Regular security reviews and penetration testing
- Third-party processors with SOC 2 Type II or equivalent certifications
Despite these measures, no internet transmission is completely secure. If you believe your account has been compromised, contact us immediately at privacy@lance.design.
8. Your Rights
Under UK GDPR you have the right to:
- Access — request a copy of the personal data we hold about you
- Rectification — ask us to correct inaccurate or incomplete data
- Erasure — request deletion of your data (subject to legal retention requirements)
- Restriction — ask us to limit how we process your data in certain circumstances
- Portability — receive your data in a structured, machine-readable format
- Objection — object to processing based on legitimate interests
- Withdraw consent — where processing is based on consent, withdraw it at any time
To exercise any of these rights, email privacy@lance.design. We will respond within 30 days. We may ask you to verify your identity before processing the request.
9. Cookies
We use cookies and similar tracking technologies. For full details, including how to manage your preferences, see our Cookie Policy.
10. Children
Lance is a professional B2B platform not directed at individuals under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with data, contact us and we will delete it promptly.
11. Links to Other Websites
Our platform may contain links to third-party websites. This Privacy Policy does not apply to those sites. We encourage you to review their privacy policies before sharing any data.
12. Changes to This Policy
We may update this policy from time to time. When we do, we will revise the effective date at the top and, for material changes, notify you by email or an in-app banner. Continued use of Lance after the updated policy takes effect constitutes acceptance of the changes.
13. How to Complain
If you are unhappy with how we handle your data, please contact us first at privacy@lance.design. If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):
- Website: ico.org.uk
- Helpline: 0303 123 1113
We Are Lance Limited — Company No. 17252127 — [REGISTERED ADDRESS — TO BE CONFIRMED]