Thanks for taking the time to check my privacy notice!

In order to go about the business of selling the artwork and portraits I create, operating a website, online Shop, and newsletter, and to keep in touch with you either as a client or a newsletter subscriber, I will need to handle certain information about you from time to time. In line with the General Data Protection Regulation, I want to make sure I am clear about what types of information I use, when and where it may be collected, and how I use it in my business. I'd also like to let you know about your rights concerning this information.

There are two types of information (or data) that may be collected: Personal and Non-Personal.

​

1.   Personal Data
This is data that identifies you. Examples include (but are not limited to) names and email addresses. This information is only collected if you voluntarily submit it to me.
The section below details instances in which personal data is collected, how and why I process it (the purpose), the lawful basis for processing it, and how long I keep it for (retention period).

 

1.1   Communications
The data I process for communications may include your name and email address. This data is processed if we are in communications regarding a potential transaction (eg an email consultation prior to a paid booking being placed).
Purpose for processing this data: To communicate with you; to take steps, at your request, to enter into a contract.
Lawful basis for the processing: Legitimate interests (namely responding to your enquiries and providing information about my services at your request).
Retention period: This data is kept 3 years after the last instance of communication from you, unless a transaction is entered into (see 1.2 Transactions).

 

1.2   Transactions
The data I process for transactions may include your name, contact details and postal address. This data is processed if a transaction is carried out with you, or is in progress. This could be a purchase of my original artwork, a commissioned portrait, or any other of my products purchased directly from me, carried out either online or in person.

This also covers any data that I handle personally in order to process purchases made through my Website Shop. However it's important to note that I personally do not have access to your financial or credit card details at any point.

See more information about Online Shop transactions under Section 3 "Does Amanda Drage Art provide your data to others?"
Purpose for processing this data: To communicate with you; to provide my services; to carry out a contract; to keep proper records for tax purposes.
Lawful bases for the processing: Contractual obligations; Legal obligations; Legitimate interests (namely on the basis of an existing client relationship).
Retention period: This data is kept for 6 years after the work was carried out (in accordance with guidance from HMRC). The exception is names, which are kept indefinitely for my records.

​

1.3   Photographs of pets
This refers to the photographs sent to me as part of the portrait commission process. These are included under Personal Data as a photo may show an identifiable person.
Purpose for processing this data: To provide my services; to carry out a contract or take steps, at your request, to enter into such a contract.
Lawful basis for the processing: Contractual obligations.
Retention period: In the case of a completed contract (whereby a portrait is produced) photographs are kept until the completion of that contract (unless otherwise agreed). In the case of "cold enquiries" (whereby information including photographs may be sent to me, but a booking is neither confirmed nor declined in writing) I will keep photographs for three years before deleting them from my system.

​

1.4   Newsletter communications
The data I process for newsletter communications are your name and email address. This data is collected either via a webform or a pen-and-paper form at an event, in a way which is compliant with the General Data Protection Regulations.
This information is also processed by Mailchimp, which is the service provider for my newsletter.
See their Privacy Policy at https://mailchimp.com/legal/privacy/
Purpose for processing this data: To add you to the mailing list, so you may receive the newsletters.
Lawful basis for the processing: Consent.
Retention period: This data is kept until you unsubscribe from the mailing list, or until I end the service and the mailing list becomes defunct.

​

1.5   Legal obligations to process and retain personal data
I may process any personal data where such processing is necessary, eg to comply with legal obligations to which I am subject (such as record keeping for tax purposes). Similarly I may retain your personal data where such retention is necessary for compliance with legal obligations.

1.6   Other reasons for processing personal data
I may process any personal data identified in this Notice where necessary for the establishment, exercise or defence of legal claims, whether in court proceedings or in an administrative or out-of-court procedure. The lawful basis for this processing is my legitimate interests, namely the protection and assertion of my legal rights, your legal rights and the legal rights of others.

I may process any personal data identified in this Notice where necessary for the purposes of obtaining or maintaining insurance coverage, managing risks, or obtaining professional advice. The lawful basis for this processing is my legitimate interests, namely the proper protection of my business against risks.

​

2.   Non-Personal Data
This is statistical and other analytical information that is collected from visitors to my website. This data is collected by Google Analytics, through the use of Cookies. (Cookies are explained in more detail under Section 6 "About Cookies". The cookies that are used by Google Analytics are detailed in Section 6.4.) Examples of this kind of data might be a visitor's IP address (which is automatically modified to be rendered anonymous), browser information, or pages visited. This data cannot be used to identify or contact you.
Purpose for processing this data: I use this data in order to understand more about visitors to my website (such as how they found me, and what kind of device they might be using to view my site), and what they do once they are there (for example, how many people visit certain pages, and the order in which pages are visited). This data can help in such ways as to build a better understanding of the market for my business, and to inform future decisions in improving my website's design.
Lawful basis for the processing: Legitimate interests (namely monitoring and improving my website and services).

You can find out more about Google’s position on privacy in terms of its analytics service at https://policies.google.com/privacy

​

3.   Does Amanda Drage Art provide your data to others?

When an order is placed through my Online Shop, you must provide certain personal data (eg name, address, phone number and payment details) in order for the transaction to be fulfilled. As my Shop is hosted by Wix.com, your data will be handled by and stored on Wix's databases, which are on secure servers behind a firewall. Wix's payment gateways adhere to the standards set by the Payment Card Industry Data Security Standard, or PCI-DSS, which helps ensure the secure handling of credit card information.

You can see Wix's own Privacy Policy at https://www.wix.com/about/privacy

Similarly, if you choose to pay via Paypal, use of your data will then be subject to Paypal's own Policy. Paypal takes several measures to store your data securely, including the use of firewalls, data encryption, and physical access controls to data centres .

You can see Paypal's Privacy Policy at https://www.paypal.com/uk/webapps/mpp/ua/privacy-full

Your personal and non-personal information will not be passed on to third parties for any other reason without your consent, unless it is necessary to fulfil your order. Any such third party will be subject to similar requirements to protect your data.

4.   Amendments to my Privacy Notice
I may need to update this Notice from time to time. In such circumstances, a new version will be published on my website, so you can remain aware of what information I am using, how I am using it, and whether it will be shared with any other parties.
If at any time I decide to use any data in a manner significantly different from those stated in this Notice, a statement of amendment of the Notice will be sent out to subscribers of my email Newsletter. I will also send a personal email notification to all clients I may be undertaking work for, at the time of any significant amendment to this Notice. You will have a choice as to whether or not I use your information in this way.

​

5.   Your rights
- You are entitled to view the personal information that I hold, to amend that information, and even have it deleted if you wish (subject to my legal obligations outlined above - see section 1.5).
- You have the right to restrict or object to any of the processing detailed in this Notice.
- You have the right to complain to a supervisory authority.
- You have the right to withdraw any consent you may have previously given, at any time.

To request to view, amend, or delete data, to restrict or object to processing, or to withdraw consent given, you can contact me directly. See my contact details at the end of this Notice (Section 7) or by using the form on the website Contact page.

To withdraw consent to send email newsletters, simply click the Unsubscribe link at the bottom of any of my newsletters, or contact me as above.

6.   About Cookies

6.1   What are cookies?
A cookie is a small file containing an "identifier" (a string of letters and numbers) that is sent by a web server to a web browser and is stored by the browser. The identifier is then sent back to the server each time the browser requests a page from the server. Cookies do not typically contain any information that personally identifies a user.

6.2   Types of cookies
Like most websites, my website uses some cookies. Some are set by this website directly ("first party cookies"). Others are set by the services my website uses ("third party cookies"). Some cookies are known as "persistent" cookies: these are stored by your web browser until they reach a set expiry date, or until they are deleted by you. Others are known as "session" cookies: these are destroyed at the end of the user session, when the web browser is closed.

For general information on cookies see https://www.aboutcookies.org
For more information on session cookies see https://www.allaboutcookies.org/cookies/session-cookies-used-for.html

​

6.3   First party cookies that are set by this website

​

Cookie name: XSRF-TOKEN
Cookie purpose: Strictly Necessary
This cookie is written to help with site security in preventing Cross-Site Request Forgery attacks.

Cookie name: hs
Cookie purpose: Strictly Necessary/Security
A session cookie, for security purposes.

 

Cookie name: TS*
Cookie purpose: Strictly Necessary/Security
A session cookie, for security purposes.

Cookie name: ssr-caching
Cookie purpose: Strictly Necessary (Performance/Functionality)
A session cookie set by the host of this website (Wix), necessary for cache function.

​

Cookie name: wixSessionTS
Cookie purpose: Strictly Necessary (Performance/Functionality)
A persistent cookie set by the host of this website (Wix), containing a specific ID for the current session, and necessary for site function.

Cookie name: fedops.logger.sessionId
Cookie purpose: Analytics (Non-essential)
This cookie registers statistical data on users' behaviour on the website. This is a persistent cookie, stored for one year.

​

Cookie name: svSession

Cookie purpose: Marketing

This cookie tracks a visitor’s sessions on the site, and helps make advertisements more relevant to the visitor. This is a persistent cookie, stored for two years.

​

6.4   Third party cookies that are set by Google Analytics
I use Google Analytics to analyse the general use of my website. Google Analytics gathers information about website use by means of cookies. See section 2 "Non-Personal Data" to find out how I use this information.
Google's privacy policy is available at: https://policies.google.com/privacy
Google's position on privacy in terms of its analytics service can also be seen via the above link.

Visit https://tools.google.com/dlpage/gaoptout to opt out of being tracked by Google Analytics.

​

Cookie names: _gat, _ga, _gid
Cookie purpose: Statistics
These cookies perform several functions, most of which help me gain an overview of how visitors behave on my site. They may also send data to Google Analytics about a visitor's device and behaviour. These cookies cannot identify visitors personally.

​

6.5   Managing cookies
If you are not happy with the use of any of the cookies listed in this Notice, most browsers allow you to refuse to accept cookies and to delete cookies. The methods for doing so vary from browser to browser, and from version to version. Visit https://www.aboutcookies.org for guidance on how to delete, reject, and manage cookies.

Please be aware that if you reject or disable cookies, you may encounter issues signing up for my newsletter, contacting me via the form on the Contact page, or on other areas of my website.

7.   Amanda Drage Art's business address

Amanda Drage Art can be contacted by post at the following address:

5 Bridge Street

Rothwell

Kettering
NN14 6EW
United Kingdom

You can also use the form on the website Contact page to get in touch.