Privacy and cookie policy
Last updated May 2023.
Hello - I’m Vivienne Hollis/Peters, of Beautiful Art for Small Spaces. Welcome to my privacy and cookie policy! This policy sets out information on the personal data I collect about you, and your rights in respect of that data, whether you visit my website at https://www.artforsmallspaces.shop/, you make a purchase on my website, you sign up to my newsletter, or otherwise contact me.
- Introduction
I’ll only process your personal data in line with data protection laws, namely the EU law retained version of the General Data Protection Regulation ((EU) (2016/679), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directives) Regulations 2023, and the California Consumer Protection Act (“CCPA”) (the “data protection laws”). If any of these laws are replaced or superseded, I will also comply with those.
I’m registered with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (ico.org.uk), and my registration number is ZB542182. If you have any concerns about data protection, I’d appreciate it if you contacted me first so I can discuss these with you before you approach the ICO. You can reach me at mini@artlover.com.
- The data I may collect about you
Personal data/information means any information about an individual from which that person can be identified. It doesn’t include anonymous data. I may collect, use, store and transfer different kinds of personal data about you which I have grouped together as follows:
- Identity Data includes first name, family name, last name, username or similar identifier, marital status, title, date of birth and gender.
- Contact Data includes billing address, delivery address, email address and telephone numbers.
- Financial Data includes bank account and payment card details.
- Transaction Data includes details about payments to and from you and other details of products and services you have purchased from me.
- Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access my website.
- Profile Data includes your username and password, purchases or orders made by you, your interests, preferences, feedback, and survey responses.
- Usage Data includes information about how you use my website, my products, and my services.
- Marketing and Communications Data includes your preferences in receiving marketing from me and my third parties and your communication preferences.
Aggregated Data such as statistical or demographic data for any purpose, isn’t considered personal data in law as this data will not directly or indirectly reveal your identity to me. I may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature.
I don’t collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). I also don’t collect any information about criminal convictions and offences.
I may use different methods to collect data from and about you including through:
- Direct interactions. You may give me your Identity and Contact by filling in forms, by corresponding or engaging with me by post, phone, email, social media or otherwise.
- Automated technologies or interactions. As you interact with my website, I will automatically collect Technical Data about your equipment, browsing actions and patterns. I collect this personal data by using cookies, server logs and other similar technologies. I may also receive Technical Data about you if you visit other websites employing my cookies.
- Third parties or publicly available sources. I may receive personal data about you from various third parties and public sources, such as Google, Companies House, or the electoral register.
I will only use your personal data when I can rely on a legitimate (lawful) basis, such as:
- Contract: Where I need to perform the contract, I are about to enter into or have entered into with you
- Legitimate Interests: Where it is necessary for my legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests
- Legal Obligation: Where I need to comply with a legal obligation.
- Purposes for which I will use your personal data
I have set out below the ways I may use your personal data, and which of the legitimate bases I rely on to do so:
|
Purpose/Activity |
Type of data |
Lawful basis for processing including basis of legitimate interest |
|
To enable you to submit an enquiry to me, whether via email, phone, through my website or via social media, including but not limited to LinkedIn, Twitter, Facebook and Instagram |
Identity Contact |
Contract Legitimate Interests (to enable me to respond to your enquiry) |
|
To process and deliver your goods including: (a) Manage payments, fees, and charges (b) Manage delivery of your order (c) Collect and recover money owed to me |
Identity Contact Financial Transaction Marketing and Communications |
Contract Legitimate Interests (to enable me to organise delivery of your goods, or to recover debts due to me) |
|
To manage my relationship with you which will include: (a) Notifying you about changes to my terms and conditions or privacy and cookie policy (b) Asking you to leave a review or take a survey |
Identity Contact Profile Marketing and Communications |
Contract Legal Obligation (b) Necessary to comply with a legal obligation Legitimate Interests (to keep my records updated and to study how customers use my products/services) |
|
To enable you to partake in a prize draw, competition or complete a survey |
Identity Contact Profile Usage Marketing and Communications |
Contract Legitimate Interest (to study how customers use my products/services, to develop them and grow my business) |
|
To enable you to register for my newsletter |
Identity Contact Marketing and Communications |
Contract Legitimate Interest (to enable me to provide you with the newsletter/email marketing and present you with information, goods or services I consider you will be interested in) |
|
To administer and protect my business and my website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data) |
Identity Contact Technical |
Legitimate Interests(for running my business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise) Legal Obligation |
|
To deliver relevant website content and advertisements to you and measure or understand the effectiveness of the advertising I serve to you |
Identity Contact Profile Usage Marketing and Communications Technical |
Legitimate Interests (to study how customers use my products/services, to develop them, to grow my business and to inform my marketing strategy) |
|
To use data analytics to improve my website, my products/services, marketing, customer relationships and experiences |
Technical Usage |
Legitimate Interests (to define types of customers for my products and services, to keep my website updated and relevant, to develop my business and to inform my marketing strategy) |
|
To make suggestions and recommendations to you about goods or services that may be of interest to you |
Identity Contact Technical Usage Profile Marketing and Communications |
Legitimate Interests (to develop my products/services and grow my business) |
- Marketing
You may receive marketing communications from me if you have requested information from me or purchased goods or services from me and you haven’t opted out of receiving that marketing. I will get your express opt-in consent before I share your personal data with any third party for marketing purposes.
You can ask me or third parties to stop sending you marketing messages at any time by following the opt-out links on any marketing message sent to you or by contacting me at any time.
Where you opt out of receiving these marketing messages, this won’t apply to personal data provided to me as a result of a product/service purchase, warranty registration, product/service experience or other transactions.
- Cookies
My website uses cookies in accordance with the relevant parts of the Privacy and Electronic Communications (EC Directive) Regulations 2003 and data protection laws to distinguish you from other users of my website. This helps me to provide you with a good experience when you browse my website and also allows me to improve my website. A cookie is a small file of letters and numbers that I store on your browser or the hard drive of your computer if you agree. Cookies contain information that is transferred to your computer’s hard drive.
I use the following cookies:
- Strictly necessary cookies. These are cookies that are required for the operation of my website. They include, for example, cookies that enable you to log into secure areas of my website, use a shopping cart or make use of e-billing services.
- Analytical or performance cookies. These allow me to recognise and count the number of visitors and to see how visitors move around my website when they are using it. This helps me to improve the way my website works, for example, by ensuring that users are finding what they are looking for easily.
- Functionality cookies. These are used to recognise you when you return to my website. This enables me to personalise my content for you, greet you by name and remember your preferences (for example, your choice of language or region).
Please note that third parties may also use cookies, over which I have no control. These named third parties may include, for example, advertising networks and providers of external services like web traffic analysis services. These third-party cookies are likely to be analytical cookies or performance cookies or targeting cookies:
- Google Analytics – this is a web analytics service provided by Google, Inc. The cookies used by Google Analytics help me to analyse how users use my website and to count the number of people who use it. Google Analytics stores your IP address anonymously. Google does not associate your IP address with any personally identifiable information.
- Google Ad Words – these cookies collect information about how visitors use my website. This data is collected anonymously, to help make my marketing communications more relevant, and is used to improve my website’s functionality.
I will always ask for your consent to use non-essential cookies. You are free to withhold consent to this, but it means that I might not be able to provide the full website experience to you, including some elements of video advertising. If at any time you wish to disable my cookies, you can do so through the settings on your browser, or whenever the pop-up appears on the website (each time you access the website).
I may disclose your information in the following cases:
- If I want to sell my business, or my company, I can disclose it to the potential buyer
- I can disclose it to other businesses in my group, as defined in the UK Companies Act 2006
- I can disclose it if I have a legal obligation to do so, or in order to protect other people’s property, safety, or rights
- I can exchange information with others to protect against fraud or credit risks.
I may also contract with third parties to supply services to you on my behalf. These include:
- Credit card processing services
- Order fulfilment service providers
- Analytics service providers
- Event/campaign management service providers
- Website management service providers
- Information technology and related infrastructure provision
- Email delivery services
- My auditors and legal advisors.
It is important to note that these third party processors are bound by data protection obligations in the same way that I, or any company that processes personal data is. If you would like more information about how these third parties process and store your personal data, you can find out more information by clicking the links and visiting their terms and conditions and privacy policies.
Data security is of great importance to me, and to protect your personal data I have put in place suitable physical, electronic, and managerial procedures to safeguard and secure data I collect. In addition, I limit access to your personal data to those employees, agents, contractors and other third parties who have a business to know. They will only process your personal data on my instructions, and they are subject to a duty of confidentiality. I have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where I am legally required to do so.
If there is an incident where I become aware that there has been a data breach, I will let you know without undue delay. I will then take all necessary steps, including informing the ICO, to limit the extent of the breach and to prevent a further recurrence.
It is important to note that I can only do my best to protect your personal data but the transmission of information over the internet is not entirely secure. Any personal data you share with me over the internet is done at your own risk.
I may transfer your personal data outside of the UK or the European Economic Area (EEA) where I engage third parties to provide services on my behalf, such as to receive services or deal with payment. Whenever I transfer your personal data out of the UK or the EEA, I ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:
- I will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data
- Where I use certain service providers, I may use specific contracts approved for use in the UK which give personal data the same protection it has in the UK.
Please contact me if you want further information on the specific mechanism used by me when transferring your personal data out of the UK or the EEA.
I will only retain your personal data for as long as reasonably necessary to fulfil the purposes I collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. I may retain your personal data for a longer period in the event of a complaint or if I reasonably believe there is a prospect of litigation in respect to my relationship with you.
To determine the appropriate retention period for personal data, I consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which I process your personal data and whether I can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.
Under certain circumstances, you have rights under the data protection laws in relation to your personal data:
- Request access to your personal data
- Request correction of your personal data
- Request erasure of your personal data
- Object to processing of your personal data
- Request restriction of processing your personal data
- Request transfer of your personal data
- Right to withdraw consent.
If you wish to exercise any of the rights set out above, please contact me by emailing mini@artlover.com.
You won’t have to pay a fee to access your personal data (or to exercise any of the other rights), but I can charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive, or I can refuse to comply in these circumstances.
I may need you to provide evidence of your identity as a security measure and I may also contact you to ask you for further information in relation to your request to speed up my response.
I try to respond to all legitimate requests within one month, but it could take longer than a month if your request is particularly complex or you have made a number of requests. In this case, I will notify you and keep you updated.
- Notice for California residents of privacy practices and rights
If you are a California resident, California law may provide you with additional rights regarding your personal data.
The CCPA gives you the following rights:
-
- Right to know about the personal information I collect and share:
- The CCPA gives you the right to request that I disclose the specific pieces of personal information I have collected about you
- Please see above for information on the data I collect on you, and how I process it
- I don’t sell your personal information. However, I do disclose your personal data to limited third parties, as described above.
- Right of deletion:
- You have the right to request that I delete your personal information, subject to certain exceptions
- If you wish to delete your personal data, please contact me at mini@artlover.com. Please note that I may require certain information from you in order to verify your identity before proceeding with your request.
- Right to know about the personal information I collect and share:
I collect the categories of personal information from you in connection with your use of my website as described above. I will not discriminate against you for exercising any of your CCPA rights.
- Third party links
This policy only relates to my website and to my business activities. I might have links on/within my website to other websites, and these websites will have their own terms and conditions and privacy policies. You should check those privacy policies before providing your personal data to those websites.
- Changes to this policy
I may update this policy from time to time as laws change or as my website or my services change. If I make material changes to this policy, and I need your consent to those changes, I will contact you by email to do so.