The Patch Lab Privacy Policy

Last updated: 27 September 2026

1. Who we are

The Patch Lab creates identity-led headwear in Cyprus. This Privacy Policy explains how we handle personal data when you browse our website, purchase a cap, contact us, subscribe to updates or use our registration and aftercare services.

The Patch Lab is a project and brand operated by Neofytos Yiangou, sole proprietor trading as Chenzon International, registration number EE38821.

Data controller: Neofytos Yiangou
Registered business name: Chenzon International - EE38821
Correspondence address: Alexandroupoleos 34, 8027 Paphos, Cyprus
Privacy and customer support email: hello@thepatchlab.com.cy
Telephone: +357 95160789
Website: https://www.thepatchlab.com.cy

We process personal data under the General Data Protection Regulation (EU) 2016/679 (“GDPR”), applicable Cyprus data-protection legislation and applicable electronic communications and privacy rules.

2. Information we collect

Depending on your interaction with us, we may process:

• Contact and correspondence details: your name, email address, telephone number and messages sent through email, website forms, live chat or social media.
• Order and delivery details: products purchased, order references, billing information, delivery or courier-collection details, shipment instructions and delivery status.
• Payment and refund information: transaction references, payment status, amounts paid, refund details and cash-on-delivery collection information. For an agreed bank-transfer refund, we may collect the account holder’s name, IBAN and any other information necessary to complete the transfer.
• Registration and aftercare information: order number, date received, contact details, product DNA, product name and colour, security-label number, product and label photographs, condition checks, fit and packaging feedback, experience ratings, problem descriptions and supporting photographs.
• Marketing information: subscription preferences, consent records and unsubscribe requests.
• Website information: IP address, browser and device information, security logs and, where permitted by your cookie choices, page visits and website interactions.

“Product DNA” refers to our design categories: Urban Tactical, Retro Pop and Signature Lab. It does not refer to genetic or biological information.

We receive information directly from you, through website interactions and, where relevant, from payment and delivery providers.

Please provide only information relevant to your request. Product photographs should avoid faces, identity documents, payment cards and unrelated personal details. We do not request sensitive personal information for registration or aftercare.

3. Why we use your information

When relying on legitimate interests, we consider the impact on your privacy and balance our interests against your rights.

Required information is needed to complete the relevant purchase or support process. Without necessary details, we may be unable to fulfil your order or assess your request. Marketing consent is not required to buy a cap or receive support.

4. Gift recipients

If you arrange a gift, we may receive the recipient’s name, delivery or collection details and necessary contact information from you.

We use this information to fulfil the gift order and provide related support, based on our legitimate interests in completing the purchaser’s order. We do not add gift recipients to marketing lists without their own consent.

Please supply only the information needed and make this policy available to the recipient. We also remain responsible for providing the required privacy information within the applicable timeframe: no later than one month after receiving their information, at our first communication with them or, if earlier, when first sharing their information with another recipient such as a courier, unless a legal exception applies.

5. Registration PDFs and aftercare

Our registration form generates a PDF locally in your browser using the information and photographs you select.

Completing the form and generating the PDF do not submit its contents to The Patch Lab or automatically upload the PDF to HubSpot.

After downloading the PDF, you must attach it to an email and send it to hello@thepatchlab.com.cy. The “Email Your Registration” button opens your configured email application; it does not automatically attach the PDF or send your message.

Once received, registration PDFs, photographs and related correspondence may be stored in our business email account, HubSpot and working copies on our computer for registration and aftercare purposes.

Generating a PDF does not, by itself, confirm registration, verify a security number or approve a claim. Your downloaded copy remains on your device unless you delete it.

Ordinary website hosting, security and consented analytics processing are separate from the PDF-generation process.

Registration information and aftercare photographs are not automatically added to a marketing list or used for promotional content.

Cap registration is not required to exercise your statutory cancellation, return or legal guarantee rights. Registration requirements apply only to the additional benefits of the 365-Day Patch Lock Promise, as described in its separate terms.

6. Payments and refunds

Online payments are processed through Stripe. Cash on delivery is available only through ACS.

We receive the information needed to identify and manage your payment, such as your name, order reference, payment status, transaction reference and refund details.

We do not request or store your full payment card number or card security code. Please do not send these details by email, live chat or registration forms.

For an agreed bank-transfer refund of a cash-on-delivery purchase, we collect the bank details necessary to complete the refund. We use these details for the refund and any necessary financial record-keeping.

Stripe and the banks involved may process personal data as independent controllers for payment processing, fraud prevention and regulatory compliance.

For more information, see Stripe’s Privacy Policy.

The eligibility, timing and costs of cancellations, returns and refunds are explained in our separate sales policies.

7. Who receives your information

We share personal data only where needed for the purposes described in this policy:

• HubSpot: website hosting, website forms, live chat, customer management, newsletter subscriptions and delivery, consent records, and storage of registration and aftercare information.
• Namecheap Private Email: receiving, sending and storing business emails and attachments associated with hello@thepatchlab.com.cy.
• Google Analytics: website usage analysis where you have consented to optional analytics.
• Stripe and relevant banks: payment processing, refunds and associated transaction administration.
• ACS and AKIS Express: delivery, courier collection and related shipment enquiries. ACS also handles cash-on-delivery collection where selected.
• Professional advisers: accountants and legal advisers where necessary.
• Authorities and other legally entitled recipients: where disclosure is required by law or necessary for legal proceedings.

Couriers receive the recipient’s name, necessary contact information, delivery or collection details and relevant shipment instructions. For cash-on-delivery orders, ACS also receives the amount to collect and relevant payment instructions. We do not ordinarily share registration PDFs or aftercare photographs with couriers.

Day-to-day access to our customer records is limited to the business owner. This does not exclude necessary processing by the service providers described above.

Where a provider acts as our processor, processing is governed by the applicable data-processing terms. Some providers also act as independent controllers for their own purposes.

Relevant provider information is available here:

• HubSpot Privacy Policy
• Namecheap Privacy Policy
• Google Privacy Policy
• Stripe Privacy Policy

We do not sell personal data or provide customer lists to other businesses for their own direct marketing.

8. International transfers

Our service providers and their subcontractors may process personal data outside the European Economic Area (“EEA”), including in the United States. EU hosting does not necessarily exclude access from outside the EEA.

Where personal data is transferred outside the EEA, the transfer must be covered by an applicable European Commission adequacy decision or another lawful safeguard, such as the European Commission’s Standard Contractual Clauses, together with supplementary measures where necessary.

Reliance on the EU–US Data Privacy Framework applies only where the receiving organisation has an active certification covering the relevant processing. We do not assume that every provider or transfer is covered.

Information about relevant contractual arrangements is available in HubSpot’s Data Processing Agreement, Namecheap’s Data Processing Addendum and Google’s transfer-framework information.

Contact hello@thepatchlab.com.cy to request information about the safeguards relevant to your data and how to obtain a copy, subject to necessary redactions protecting confidential information or other people’s rights.

Using our website or emailing us is not blanket consent to international transfers.

9. Cookies and Google Analytics

Our website uses necessary technologies to provide requested functionality and maintain security.

We also use Google Analytics to understand how visitors use our website and identify improvements. Optional analytics and other non-essential tracking are subject to your consent.

You can accept or reject optional cookies through our cookie banner and change your preferences using Manage Cookies. Withdrawing consent does not affect processing that was lawful before withdrawal.

Refusing optional analytics does not prevent you from purchasing a cap, contacting us or requesting aftercare.

Details of the technologies used, their purposes, providers and durations are available through our cookie information and controls. You can also contact us with questions.

Your browser allows you to delete or block cookies. Blocking technologies needed for a requested function may affect how that function works.

10. Newsletters, reviews and social media

We use HubSpot to manage newsletter subscriptions and send promotional updates to people who have separately opted in.

You can unsubscribe using the link in a promotional email or by contacting hello@thepatchlab.com.cy. Unsubscribing does not stop necessary messages about your purchase, delivery, registration or support request.

A purchase, enquiry, cap registration, social-media tag or aftercare photograph is not permission for unrelated marketing.

We obtain separate consent before publishing identifiable customer photographs or testimonials for promotional purposes.

When you contact us through social media, we use the information you provide to respond. The platform also processes information under its own privacy policy. Please send order numbers and other private information through a private channel.

11. How long we keep information

We retain personal data only for as long as necessary for the purpose for which it was collected, including applicable legal requirements.

The relevant retention criteria are:

• Orders, invoices and payment records: the period required by applicable Cyprus accounting and tax rules, including any legally required extension for an audit or investigation. These requirements do not automatically apply to unrelated photographs or general correspondence.
• Cancellations, returns and refunds: the time needed to complete the request, meet related financial obligations and retain proportionate evidence for any applicable dispute or legal-claim period.
• Registration and aftercare records: the time needed to administer the 365-Day Patch Lock Promise, applicable statutory remedies and any unresolved support request. The end of the commercial Promise does not automatically end statutory rights.
• Photographs and attachments: only while necessary to verify a product, registration or support issue. Unnecessary duplicates and unrelated images should not remain part of the record. Where a photograph is embedded in a PDF, removing it may require replacing the PDF with a reduced record.
• General enquiries and live-chat messages: until the enquiry and any necessary follow-up are complete, unless the correspondence is needed for an order, support case or identifiable legal purpose.
• Feedback: while needed to assess and improve products or resolve a support issue. Where individual identification is no longer needed, information is deleted or genuinely anonymised.
• Newsletter information: while there is a valid consent and continuing purpose for the subscription. Promotional use stops when you unsubscribe. A minimal suppression record may be retained to respect your opt-out.
• Consent and privacy-request records: while necessary to demonstrate how we handled your choices and requests and address any related complaint or legal obligation.
• Analytics, cookies and security records: according to the relevant purpose, configured retention settings and applicable provider arrangements. Cookie expiry does not necessarily delete associated server-side information.

A specific legal obligation, unresolved dispute or reasonably anticipated legal claim may require retention of relevant records for longer. This does not justify keeping all information indefinitely.

These principles apply to the copies we control in our email account, HubSpot and our computer, including working downloads. Deletion from one location does not automatically remove copies elsewhere.

Deletion is not dependent solely on receiving a customer request. Records that are no longer needed must be deleted or genuinely anonymised.

Provider backups may retain residual copies until removed under the provider’s backup arrangements. We cannot delete a customer’s own downloaded PDF or their own sent-email copy.

12. Keeping information secure

We restrict access to customer records and use appropriate technical and organisational measures to protect personal data held in our email account, HubSpot and our computer.

No internet transmission or storage system is completely risk-free. If a personal-data breach occurs, we assess it and notify the supervisory authority and affected individuals where required by law.

Please avoid sending unnecessary sensitive information, passwords or full payment card details.

13. Your rights and deletion requests

Subject to the GDPR’s conditions, you may request:

• Access to your personal data.
• Correction of inaccurate or incomplete information.
• Erasure of information where there is no lawful reason to retain it.
• Restriction of processing.
• A portable copy of eligible data.
• An objection to processing based on legitimate interests.
• Withdrawal of consent at any time.

You may object to direct marketing at any time.

To exercise your rights, including requesting deletion, email hello@thepatchlab.com.cy. Please provide enough information for us to identify the relevant records. We may request proportionate identity verification where necessary.

We respond without undue delay and normally within one month of receiving your request. Where permitted because of the complexity or number of requests, this may be extended by up to two further months. We will explain any extension within the first month.

Requests are normally free of charge, subject to the GDPR’s exceptions.

The right to erasure is not absolute. We may need to retain limited information for legal obligations or the establishment, exercise or defence of legal claims. If we cannot fully comply, we will explain the reason and your available options.

Requesting deletion does not itself cancel an order or constitute a request for a refund. Please identify any cancellation or return request separately so that we can handle both matters correctly.

14. Complaints

You may raise a concern with us at hello@thepatchlab.com.cy.

You also have the right to complain directly to a supervisory authority, particularly in the EU/EEA country where you live or work or where the alleged infringement occurred. You do not have to contact us first.

In Cyprus:

Commissioner for Personal Data Protection
Website: https://www.gov.cy/dataprotection/
Email: commissioner@dataprotection.gov.cy

15. Automated decisions and children

The Patch Lab does not make decisions producing legal or similarly significant effects about you solely through automated processing.

Selecting a product DNA is choosing a design category, not an automated assessment of your personality. Payment providers may carry out their own security checks under their privacy notices.

Our website is not specifically directed at children. If you believe a child has supplied personal data inappropriately, contact us so that we can assess and address the situation.

Please avoid including identifiable children in registration or support photographs.

16. Changes to this policy

We update this policy when our services, providers, contact details or processing practices change. The current version appears on this page with its update date.

Where required, we will notify you of material changes or obtain fresh consent. Continued use of the website does not constitute consent to new processing that requires consent.

For privacy questions, contact hello@thepatchlab.com.cy.