How we collect, use, store, and protect your personal data under the UK GDPR, the EU GDPR, and the UK Data Protection Act 2018.
Lattice Commerce Limited ("Lattice", "we", "us", "our") is a company incorporated in the Hong Kong Special Administrative Region of the People's Republic of China, with company registration number 2096100.
Because we operate TikTok Shop Affiliate accounts on behalf of partners located in the United Kingdom and the European Union, we treat your personal data in compliance with the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486), the UK GDPR, and the EU GDPR, whichever provides the stronger protection in respect of the data concerned. For the purposes of the UK/EU GDPR, Lattice acts as the data controller.
Our data protection contact is privacy@peydra.shop.
We collect only the personal data we need to operate our business. We do not buy personal data from third parties and we do not collect special category data (race, health, religion, biometric, sexual orientation, etc.) for any purpose.
When you apply for our service via our website or WhatsApp:
When you become an active Partner under our Services Agreement, we additionally collect:
When you visit our website, we automatically collect:
Once we begin working together, we generate:
For the avoidance of doubt, Lattice does not collect, request, or hold:
Under the UK GDPR and EU GDPR, we must have a lawful basis for each purpose for which we use your personal data. The table below explains each.
| Purpose | Personal data involved | Lawful basis |
|---|---|---|
| Reviewing and responding to your pilot application | Name, email, WhatsApp, country, TikTok handle, age confirmation | Steps taken at your request prior to entering into a contract (Art. 6(1)(b)) |
| Delivering the Pilot or Services Agreement (e.g. producing and sending you videos, providing engagement guidance, monthly settlement) | All of the above plus payout account last 4 digits and commission data | Performance of a contract you are party to (Art. 6(1)(b)) |
| Confirming your age and country eligibility | Date of birth, country | Legal obligation (Art. 6(1)(c)) and our legitimate interest in lawful business conduct (Art. 6(1)(f)) |
| Maintaining an audit trail of your electronic signature | IP address, user agent, timestamp, typed signature | Legal obligation under eIDAS / Electronic Communications Act 2000 (Art. 6(1)(c)) and our legitimate interest in enforceability (Art. 6(1)(f)) |
| Sending you operational messages via WhatsApp (videos, instructions, settlement) | WhatsApp number, message content | Performance of contract (Art. 6(1)(b)) |
| Sending you optional marketing about Lattice updates and new programmes | Email, WhatsApp number | Your consent, which you can withdraw at any time (Art. 6(1)(a)) |
| Website analytics and improvement | IP address, browsing behaviour, device data | Our legitimate interest in understanding and improving our website (Art. 6(1)(f)) |
| Compliance with tax, accounting, and other legal obligations | Settlement and commission records | Legal obligation (Art. 6(1)(c)) |
We do not sell your personal data, and we do not share it for advertising purposes outside of your direct relationship with us. We share limited personal data only with the categories of recipients below, each acting as our data processor under a written processing agreement that meets the requirements of Article 28 UK/EU GDPR.
| Recipient | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Website hosting, DNS, and CDN | Global (primarily US, with EU edge processing) |
| Formspree, Inc. (or comparable form processor) | Receiving website form submissions | United States, transfers under SCCs |
| WhatsApp Ireland Ltd (Meta Platforms) | Messaging between our team and you | European Union, with Meta's standard transfer safeguards |
| Google Workspace and/or Microsoft 365 | Internal email and document storage | European Union, with provider-grade transfer safeguards |
| Our independent contractors and personnel | Video production, account management, partnership support | United Kingdom, Hong Kong SAR, and the People's Republic of China |
| Professional advisers (lawyers, accountants, auditors) | Legal advice, audit, compliance | United Kingdom |
| HMRC and other competent authorities | Tax and regulatory reporting | United Kingdom |
We will only disclose your personal data to a third party where the law allows us to do so. We will never sell your personal data.
Some of the recipients listed above are located outside the United Kingdom or the European Economic Area, including in the United States, Hong Kong SAR, and the People's Republic of China. Where such transfers occur, they are protected by appropriate safeguards as required by Chapter V of the UK/EU GDPR, namely:
You can request a copy of these safeguards by emailing privacy@peydra.shop.
We keep your personal data only for as long as necessary for the purposes for which it was collected, plus any period required by law.
| Data category | Retention period |
|---|---|
| Pilot application data (if not converted to Services Agreement) | 12 months after application |
| Signed Pilot and Services Agreements + signature audit trail | 7 years after end of contract (HMRC requirement) |
| Commission settlement records | 7 years after end of contract (HMRC requirement) |
| WhatsApp message history | 3 years after end of relationship |
| Marketing data (where consent given) | Until you withdraw consent, plus a short suppression record to honour your withdrawal |
| Website analytics data | 26 months (Google Analytics 4 default) or as configured |
We use appropriate technical and organisational measures to protect your personal data, including:
No security measure is perfect. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the UK Information Commissioner's Office (ICO) within 72 hours and, where required, notify you without undue delay.
Under the UK GDPR and EU GDPR, you have the following rights in respect of your personal data:
To exercise any of these rights, email privacy@peydra.shop. We will respond within one calendar month. We do not charge a fee for exercising your rights, except in the case of manifestly unfounded or excessive requests, in which case the law permits us to charge a reasonable fee or refuse.
Our website uses cookies and similar technologies. A cookie is a small text file placed on your device when you visit a website.
We use the following categories of cookies:
You can change your cookie preferences at any time using the cookie banner at the bottom of the screen, or directly in your browser settings.
Our services are not directed at, and we do not knowingly accept applications from, anyone under the age of 18. If you believe a person under 18 has provided us with personal data, contact us at privacy@peydra.shop and we will delete it.
We may update this Privacy Notice from time to time. We will post the updated version on this page and update the "Last updated" date at the top. For material changes, we will additionally notify you by email or WhatsApp.
Our contact:
Your right to complain: If you are unhappy with how we handle your personal data, you can lodge a complaint with:
We would, however, appreciate the chance to address your concerns before you contact the regulator. Please email us first.
This Privacy Notice is provided in template form. It should be reviewed by a qualified UK data protection solicitor before public deployment.