Privacy & Cookies Notice

Privacy Notice

This privacy notice explains how Rebecca Carrozza (operating as a Sole Trader and Data Controller) collects, uses, and safeguards your personal data in accordance with the UK GDPR and the Data Protection Act 2018.

Contact Email:hello@rebecca-carrozza.co.uk

1. Data Collected, Purposes, and Lawful Bases for Processing

The list below outlines exactly what information is collected, why it is processed, the legal justification under UK law, and how long it is kept.

  • IP Addresses & Device Data (Via Google Analytics)

    • Data Category: IP Addresses & Device Data (Via Google Analytics)

    • Purpose of Collection: Monitoring site traffic, tracking visitor timing, and optimising website user experience.

    • Lawful Basis (UK GDPR): Legitimate Interests: To understand user behaviour and improve website delivery.

    • Retention Period: Held for 14 months from the user's last session before automatic deletion.

  • Contact Details (Name, Email, Phone via Website Form)

    • Data Category: Contact Details (Name, Email, Phone via Website Form)

    • Purpose of Collection: Receiving and responding directly to your custom artwork or commission enquiries.

    • Lawful Basis (UK GDPR): Legitimate Interests / Pre-contractual steps: To answer direct consumer communications.

    • Retention Period: Stored in the business email inbox for 2 years following the last interaction.

  • Marketing Data (Name, Email via Mailchimp)

    • Data Category: Marketing Data (Name, Email via Mailchimp)

    • Purpose of Collection: Broadcasting periodic updates, newsletters, upcoming exhibition details, and store discounts.

    • Lawful Basis (UK GDPR): Consent: Given freely via a double opt-in verification link.

    • Retention Period: Kept until you unsubscribe or withdraw consent, which stops emails immediately.

  • Transaction Data (Name, Email, Phone, Shipping Address)

    • Data Category: Transaction Data (Name, Email, Phone, Shipping Address)

    • Purpose of Collection: Processing orders, managing shipping logistics, and issuing invoices via PayPal.

    • Lawful Basis (UK GDPR): Contractual Obligation: Required to fulfil and deliver your retail order.

    • Retention Period: Maintained for 6 years to comply with UK tax and financial accounting regulations.

  • In-Person Event Data (Physical contact cards at trade shows)

    • Data Category: In-Person Event Data (Physical contact cards at trade shows)

    • Purpose of Collection: Managing custom artwork estimates requested at live exhibitions.

    • Lawful Basis (UK GDPR): Legitimate Interests (to reply to queries) or Consent (if marketing checkbox is ticked).

    • Retention Period: Non-subscribers: Shredded immediately after replying. Subscribers: Shredded immediately after sync to Mailchimp.

  • Telephone Financials (Card details given verbally)

    • Data Category: Telephone Financials (Card details given verbally)

    • Purpose of Collection: Processing manual or emergency order payments.

    • Lawful Basis (UK GDPR): Contractual Obligation: To complete your specific transaction request.

    • Retention Period: Destroyed completely and securely within 24 hours of processing.

2. Third-Party Data Sharing

Your information is never sold, traded, or shared for third-party advertising purposes. To operationalise the business, data is transferred securely to the following external processors:

  • PayPal: Processes payments externally. Your full bank account and credit card details are completely hidden from the artist's view and fall under PayPal’s Privacy Policy.

  • Google: Collects masked network identifiers to evaluate site functionality under Google’s Privacy Policy.

  • Mailchimp: Hosts email marketing databases and delivers newsletters under Mailchimp’s Privacy Policy.

3. Your Rights as a Data Subject

Under the UK GDPR, you possess specific legal rights regarding your personal records:

  • Right of Access: You can request a free copy of all personal files held about you at any time.

  • Right to Rectification: You can request immediate corrections to inaccurate or incomplete data.

  • Right to Erasure: You can demand the deletion of your data when it is no longer required for legal or contractual purposes.

  • Right to Object/Withdraw Consent: You can halt marketing communications instantly.

How to Exercise Your Rights:

  1. Instant Opt-Out: Click the unsubscribe link located in the footer of any automated marketing newsletter.

  2. Manual Request: Email hello@rebecca-carrozza.co.uk from the registered email address. Manual database removals are finalised within 48 hours.

  3. Identity Verification: To protect your privacy, any formal request to view or delete data will require confirmation of your full name and registered email address before processing.

4. Regulatory Complaints

If you believe your personal information has been handled incorrectly, you have the legal right to file an official complaint with the UK supervisory authority: