Privacy Policy

Fabric Republic is the data controller for your personal data. We are registered in Poland and operate from Kraków. Fabric Republic Plac Nowy 1 Kazimierz, Kraków 31-056 Poland Email: hello@thefabricrepublic.com Our Data Protection Officer (DPO) can be reached at the same address or via dpo@thefabricrepublic.com.

We collect and process the following categories of personal data: Booking Information: • Name, email address, phone number • Payment details (processed securely via our payment providers) • Booking history and preferences Enrolment Information (Graduate Programme): • Academic history and portfolio materials • Passport/national ID for visa support • Language proficiency records • Emergency contact details Marketing & Communications: • Email preferences and subscription status • Website usage data (via cookies) • Feedback and reviews you submit Donation Records (Upcycle Collective): • Contact details for donation receipts • Weight and type of materials donated (anonymised for impact reporting)

We use your personal data for the following purposes: Service Delivery: • Processing bookings and payments • Coordinating experiences and classes • Managing graduate programme applications • Arranging accommodation and logistics Communication: • Sending booking confirmations and reminders • Providing pre-arrival information • Responding to enquiries • Sending newsletters (with your consent) Legal Obligations: • Maintaining financial records • Complying with Polish tax and employment law • Supporting visa applications where required Improvement & Research: • Analysing website usage to improve our services • Collecting anonymised feedback • Reporting on social and environmental impact

We process your data under the following legal bases under GDPR: Contract (Article 6(1)(b)): Processing necessary to fulfil our contract with you — e.g., delivering booked experiences or enrolment services. Consent (Article 6(1)(a)): Marketing communications and optional data processing where you have given explicit consent. Legal Obligation (Article 6(1)(c)): Processing required by Polish or EU law — e.g., tax records, visa documentation. Legitimate Interests (Article 6(1)(f)): Improving our services, fraud prevention, and business analytics, provided your rights and interests do not override these.

We do not sell your personal data. We share data only with: Service Providers: • Payment processors (Stripe, PayPal) • Email service providers • Website hosting and analytics providers Partner Schools (Graduate Programme only): • With your explicit consent, we share application materials with partner schools you have selected Legal Authorities: • When required by Polish law or court order • For visa processing with relevant government agencies All third parties are contractually bound to process your data only for specified purposes and in compliance with GDPR.

Your data is primarily stored and processed within the European Economic Area (EEA). Some of our service providers may process data outside the EEA (e.g., cloud hosting providers). When data is transferred outside the EEA, we ensure appropriate safeguards are in place, such as: • Standard Contractual Clauses (SCCs) • Adequacy decisions by the European Commission • Certification under recognised frameworks

We retain your data only as long as necessary: Booking Records: 7 years (Polish tax law requirement) Enrolment Records: Duration of study + 3 years Marketing Data: Until you unsubscribe or request deletion Website Analytics: 26 months (anonymised after 14 months) Donation Records: 5 years for tax receipt purposes After these periods, data is securely deleted or fully anonymised.

Under GDPR, you have the following rights: • Right to Access: Request a copy of your personal data • Right to Rectification: Correct inaccurate or incomplete data • Right to Erasure: Request deletion of your data ("right to be forgotten") • Right to Restrict Processing: Limit how we use your data • Right to Data Portability: Receive your data in a structured, machine-readable format • Right to Object: Object to processing based on legitimate interests or direct marketing • Right to Withdraw Consent: Withdraw consent at any time (does not affect prior lawful processing) To exercise any of these rights, contact us at hello@thefabricrepublic.com or dpo@thefabricrepublic.com. We respond within 30 days.

Our website uses cookies and similar technologies: Essential Cookies: Required for the website to function (e.g., booking flow, login sessions) Analytics Cookies: Help us understand how visitors use our site (Google Analytics, anonymised IP) Marketing Cookies: Track the effectiveness of our advertising (only with consent) You can manage cookie preferences through your browser settings or our cookie banner. Essential cookies cannot be disabled.

Our services are not directed at children under 13. We do not knowingly collect data from children under 13. Children aged 13–17 may participate in experiences and classes with parental consent. We collect minimal data for these participants and require a parent/guardian contact.

We may update this privacy policy from time to time. Significant changes will be notified via email and posted on our website with an updated date. This policy was last updated on 1 April 2026.

For privacy-related questions or to exercise your rights: Data Protection Officer Fabric Republic Plac Nowy 1 Kazimierz, Kraków 31-056 Poland Email: dpo@thefabricrepublic.com General: hello@thefabricrepublic.com