Privacy policy

This policy explains how I collect and use your personal information when you use this website, buy an artwork, ask about a commission or join my email list. I’m the “controller” of your information under UK data protection law (the UK GDPR and the Data Protection Act 2018).

Who I am

[GAP: your full legal name], trading as [GAP: your trading or studio name, or your own name if you don’t use one]

[GAP: the business address you’ll show publicly (not a PO box)]

[email protected]

[GAP: if you’ve registered with the Information Commissioner’s Office, add “ICO registration number: …” here. If you’re exempt, delete this line.]

What I collect and why

When you buy an artwork

Stripe, my payment provider, collects your name, email address, delivery address and payment details, and shares the first three with me so I can send your artwork. I never see your full card details. Why: to fulfil my contract with you. I also keep sales records because the law requires it.

When you send a commission enquiry

Your name, email address, the size you’re interested in, your message, and any photos or details you send me afterwards. Why: to reply to you and, if you go ahead, to create your painting. This is in my legitimate interests, and then needed for our contract.

When you join my email list

Your email address, and the date you signed up. Why: to send you news about new work, because you’ve asked me to (your consent). Every email has an unsubscribe link, and you can also ask me to remove you at any time.

When you email me

Your email address and whatever you choose to tell me. Why: to reply to you (legitimate interests).

When you visit the website

Like all websites, my hosting provider (Cloudflare) automatically records basic technical information such as your IP address and browser type, to keep the site secure and working. This website doesn’t use advertising or tracking cookies, and doesn’t track you across other websites.

Who I share it with

I only share your information with companies that help me run my business, and only what they need:

• Stripe, which processes payments. See stripe.com/privacy.
• Cloudflare, which hosts this website. See cloudflare.com/privacypolicy.
• Web3Forms, which receives the commission enquiry form and forwards it to my email. Its privacy policy is on web3forms.com.
• EmailOctopus, a UK company that stores my email list and sends my newsletter. Its privacy policy is on emailoctopus.com.
• Google Fonts, which supplies the fonts used on this website. Your browser connects to Google to load them, which shares your IP address with Google. See policies.google.com/privacy.
• [GAP: your delivery companies, e.g. “Royal Mail and [courier], which deliver your artwork.”]
• [GAP: e.g. “My accountant”, if you have one.] I also share information with HMRC, where the law requires it.

I never sell your information or share it for anyone else’s marketing.

Some of these companies are based outside the UK, for example in the United States. Where your information is transferred abroad, it’s protected by safeguards recognised under UK law, such as the UK’s data adequacy arrangements or approved contract terms.

How long I keep it

• Sales records: for as long as HMRC requires. For a sole trader, that’s at least 5 years after the 31 January deadline for the relevant tax return.
• Commission enquiries that don’t go ahead: [GAP: e.g. 12 months], then deleted.
• Commission details and reference photos: until your commission is complete, and then for [GAP: e.g. 12 months] in case of questions, unless you ask me to delete them sooner.
• Email list: until you unsubscribe.

Your rights

You have the right to:

• ask for a copy of the information I hold about you;
• ask me to correct anything that’s wrong;
• ask me to delete your information, unless I need to keep it by law;
• ask me to restrict how I use it, or object to me using it;
• receive your information in a portable format;
• withdraw your consent to marketing emails at any time.

To use any of these rights, email me at [email protected]. I’ll reply within one month.

If you’re not happy with how I’ve handled your information, please tell me first so I can try to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.

Changes to this policy

If I change how I use your information, I’ll update this page and the date at the top.