Privacy

Who is responsible

Louella Busby is responsible for the personal information used to run this shop. Her contact address is Homelea, Bow Street, TA10 9PQ. For privacy questions or requests, contact the monitored studio inbox at dave@davecooper.dev.

Orders and enquiries

Contact enquiries contain your name, email address and message. Commission enquiries also have fields for budget and timing. These details are stored to answer your enquiry and discuss possible work. Please avoid sending sensitive information that is not needed for your request.

Your name, email address and message are needed to respond to a form enquiry. Budget and timing are optional. You can also contact Louella directly using the details above.

Stripe collects your payment details and checkout contact, phone and delivery information. The shop receives order and payment references, purchase details, totals, email and delivery information to record payment, arrange delivery and provide support. This application does not store full card numbers or card security codes.

Order records can also include carrier and tracking details, delivery progress, studio notes and copies of confirmation emails with their sending status. Names, email and delivery details are needed to fulfil an online order; without sufficient information we cannot deliver it.

Website requests may include technical information such as your IP address, browser or device information and the page requested. The hosting service uses this information to provide and protect the website.

Purposes and lawful bases

We use the following lawful bases:

• Contract: to process purchases, arrange delivery and take steps you request before agreeing a commission.
• Legal obligation: to keep accounting and transaction records where the law requires us to do so.
• Legitimate interests: to answer general enquiries, provide customer support, resolve problems and protect the website. Our interests are responding to people who contact the studio and operating it securely.

We never use customer contact details for marketing.

Services that receive information

• Stripe hosts checkout and processes payment. Relevant purchase and delivery information is returned to the shop. Stripe also uses information for its own payment-security, fraud-prevention and legal purposes, described in Stripe’s privacy notice. Its automated security and fraud checks may affect whether a payment is accepted.
• Neon / Postgres, part of Databricks, stores enquiries, orders and order-email records.
• Resend sends enquiry notifications, customer and studio order emails and dispatch emails. Those messages contain information needed for their purpose.
• Google / Gmail stores studio email correspondence in a personal Gmail account. Only Louella has access to the studio mailbox. See Google’s privacy information for its processing.
• Royal Mail, DPD or Evri receives the delivery information needed to send or return your artwork, according to the courier Louella selects.
• Vercel hosts the site and processes web requests and operational logs, which may include technical request information.

Original orders are not sent to Gelato. Gelato handles print fulfilment only when a print order is processed; print checkout is currently disabled for launch. Historical print fulfilment can still share buyer contact and shipping details with Gelato.

Where information is processed

Some of the services above process information outside the UK, including in the United States. Their published privacy and transfer information explains the relevant safeguards:

• Stripe’s transfer terms describe Data Privacy Framework participation and contractual arrangements for UK transfers.
• Resend’s processing terms describe US processing and standard contractual clauses with the UK transfer addendum.
• Neon’s service terms and the Databricks processing agreement describe processing and contractual UK transfer safeguards.
• Google’s transfer information describes global processing, adequacy arrangements, the UK extension to the EU–US Data Privacy Framework and contractual safeguards for its services.
• Vercel’s privacy notice explains its international processing and published transfer mechanisms.

You can read the published safeguards through these links or contact Louella for more information or a copy. A provider may also keep and use information for its own legal and security purposes, as explained in its privacy information.

Cookies and website technologies

We do not use customer details for analytics. This website does not include analytics or advertising tracking scripts. Hosting and security services process technical request information to serve and protect the website.

Stripe’s hosted checkout uses its own cookies and technologies. See Stripe’s privacy information for its processing.

Keeping information

We keep information according to its purpose:

• Order, accounting and agreed-contract records: six years after the end of the tax year of purchase, or longer where a specific legal obligation or unresolved claim requires it.
• General enquiries and commission discussions that do not become orders: twelve months after the last substantive contact. An agreed commission is kept with its order records.
• Email copies and saved notification records: follow the purpose of the message, retaining necessary order evidence with orders and enquiry correspondence with enquiries, and removing redundant copies when no longer needed.

Louella carries out regular manual deletion reviews, retaining only information needed for the relevant purpose. If an unresolved claim or a legal duty requires longer retention, we keep the relevant records for that purpose and review them when the matter ends.

Technical and email-delivery logs are kept while needed to operate securely, investigate faults and confirm delivery, then deleted or anonymised under the relevant service arrangements.

Deleted information may remain in restricted backups until the provider’s normal expiry cycle. We do not use backup copies for ordinary business activity and reapply necessary deletions if records are restored. Providers may retain their own records for their legal and security duties; deleting our copy does not necessarily remove those records.

Your rights and complaints

Depending on the processing and lawful basis, you can ask to access, correct or erase your information, restrict its use, object to processing or receive portable data. These rights have conditions; an erasure request does not automatically remove records that must legally be kept.

You have the right to object to processing based on legitimate interests. Contact us using the details above to raise an objection.

We normally respond within one month. If we need information to verify your request, or the law permits an extension, we will explain this to you.

Use the studio contact details above to make a request or raise a concern. You can also complain to the Information Commissioner’s Office.