2. What Personal Data I Collect and Why

2.1 Customers: Physical Products (Limited Edition and Open Edition Art Prints)

When you purchase a physical art print I collect your name, email address, billing address, delivery address, order details and payment confirmation, and any communication you send me about your order.

I use this information to process and fulfil your order, arrange printing and shipping through my fulfilment partner The Print Space, and provide customer support. My lawful basis is contract performance (Article 6(1)(b) UK GDPR).

All physical prints are produced on demand and made specifically to order by The Print Space. When you place an order your name, email address and delivery address are automatically shared with The Print Space and Shippy Pro to enable fulfilment and delivery tracking. You will receive tracking information directly from this service.

2.2 Customers: Digital Products 

When you purchase a digital colour palette I collect your name, email address, billing address, order details and payment confirmation.

Digital products are delivered as instant downloads. My lawful basis is contract performance (Article 6(1)(b) UK GDPR).

Your right to cancel digital products: Under the Consumer Contracts Regulations 2013 you have a 14-day cooling off period on digital purchases. However by completing your purchase and accessing your instant download you expressly acknowledge and agree that the digital content has been delivered and your right to cancel is waived, as permitted by Regulation 37 of the Consumer Contracts Regulations 2013. Your statutory rights under the Consumer Rights Act 2015 regarding satisfactory quality and fitness for purpose remain fully intact.

2.3 Payment Processing

All payments are handled securely by my third party payment processors Stripe, PayPal and Apple Pay. Stripe and PayPal are both certified as PCI Level 1 Service Providers.

I never store your full payment card details on my website. If you choose to save your payment details for future purchases, only a secure token and the last 4 digits of your card are stored by Stripe or PayPal within their own secure systems. Your full card details never touch my website.

Apple Pay transactions are processed securely through Stripe and are subject to both Stripe’s and Apple’s privacy policies.

If you choose to save your payment details for future purchases this is handled entirely by Stripe or PayPal under their own privacy policies and requires your explicit consent at checkout.

• Stripe Privacy Policy: https://stripe.com/gb/privacy
• PayPal Privacy Policy: https://www.paypal.com/uk/legalhub/paypal/privacy-full
• Apple Privacy Policy: https://www.apple.com/uk/legal/privacy/

2.4 Customer Accounts

If you create an account on my website I collect and store your name, email address, encrypted password, order history, saved preferences and profile avatar image if you choose to upload one.

My lawful basis is contract performance and legitimate interests in providing you with account functionality (Article 6(1)(b) and 6(1)(f) UK GDPR). You can request deletion of your account at any time by contacting me.

2.5 Contact and Enquiry Forms

When you submit a contact or enquiry form I collect your name, email address and the content of your message. I use this solely to respond to your enquiry. My lawful basis is legitimate interests (Article 6(1)(f) UK GDPR).

My forms are protected by Cloudflare Turnstile, a privacy preserving bot protection service that analyses technical signals from your browser to verify you are human. It does not use tracking cookies or collect personal data for advertising purposes.

2.6 Newsletter and Email Marketing

If you sign up to my newsletter via MailPoet I will collect your email address and name. I use this to send you newsletters, updates and occasional marketing communications.

My lawful basis is consent (Article 6(1)(a) UK GDPR and PECR Regulation 22). You can withdraw your consent and unsubscribe at any time by clicking the unsubscribe link in any email or by contacting me directly. Withdrawal of consent does not affect the lawfulness of processing before withdrawal.

I have a signed Data Processing Agreement in place with MailPoet (Wysija SARL, a French company). Your subscriber data is stored in my own WordPress database on my Hostinger server. MailPoet’s sending infrastructure uses servers in Germany and Finland (EU). Sending records are retained for 3 months and rendered email content is purged after 30 days.

I also have a signed Data Processing Agreement in place with Automattic, the company behind WordPress and WooCommerce, which governs how they process data as part of platform operation.

2.7 Blog

My website includes a blog containing articles and updates about my work. Blog posts do not have a comments section and no personal data is collected through reading my blog.

2.8 Licensing Enquiries (Business Clients)

My website includes a password protected licensing page for business clients interested in licensing my artwork commercially. When you make a licensing enquiry I collect your name, business name, email address and the details of your enquiry.

As licensing is a business to business service the Consumer Rights Act 2015 and Consumer Contracts Regulations 2013 cooling off provisions do not apply. Licensing arrangements are governed by separate contractual terms agreed between us.

My lawful basis is legitimate interests and contract performance (Article 6(1)(b) and 6(1)(f) UK GDPR).

2.9 Website Analytics and Advertising

I use Independent Analytics, a privacy friendly analytics tool installed on my website. It collects anonymised data about how visitors use my site including pages visited and general traffic patterns. It does not use cookies and does not collect personally identifiable information such as IP addresses. All data is stored locally on my server.

I use Google Merchant Centre and Bing Shopping to promote my products through Google and Microsoft advertising networks. I also have my product catalogue connected to Pinterest and use Pinterest tags to measure catalogue performance and reach relevant audiences. These services use cookies and tracking technologies and are only activated after you have given your explicit consent through my cookie banner.

Product feeds for Google Merchant Centre and Bing Shopping are generated using CTX Feed, a WooCommerce plugin by WebAppick, which processes product data only.

• Google Privacy Policy: https://policies.google.com/privacy
• Microsoft Privacy Policy: https://www.microsoft.com/en-gb/privacy
• Pinterest Privacy Policy: policy.pinterest.com/en-gb/privacy-policy

If I add any further analytics or advertising tools in future this policy will be updated and your consent will be managed through my cookie consent banner.

2.10 External Platforms

My website contains links to my social media profiles and to third party marketplaces where my work is also available, including Spoonflower, Creative Market and Patternbank. When you click these links and visit those platforms you leave my website. I am not responsible for the privacy practices of those platforms and recommend you read their own privacy policies. I do not receive any personal data about you from these platforms as a result of clicking those links.

2.11 Visual Data

With your explicit consent I may use photographs of finished products featuring my artwork for promotional purposes on my website or social media. You have the right to withdraw this consent at any time by contacting me directly.