1 ABOUT THIS US AND THIS POLICY
Art2Arts Gallery LTD trading as Art2Arts a company registered in England and Wales, Company Registration Number 7795357 whose registered office and trading address is at 20 Queens Crescent, Horndean, Waterlooville, PO8 9NB
Our email address is firstname.lastname@example.org and our website is www.art2arts.co.uk
The policy applies when you use our Website and our services.
This policy was last updated on 20/01/2021
We may make changes to the policy (for example to keep up with changes in the law) so we advise you to check the policy as you use the Website and our Services, although we will let you know about material changes. However, if we make a significant change (for example use your personal data in a way which you wouldn’t expect) then we will actively let you know, for example, by emailing you.
2 CONTACTING US
Who do I contact about personal data or change my mind about how you can use it?
The person responsible for our data protection is Michelle Gibbs whom you can contact if you need any help or information about this policy or about how we collect and use personal data
By Post/mail: Michelle Gibbs, 20 Queens Crescent, Horndean, Waterlooville, PO8 9NB
By Email: email@example.com
3 COLLECTING PERSONAL DATA
Personal data is any information which could identify you, including your name, address and email address and IP address. Special category data is more sensitive, such as information about your health or ethnic origin.
Depending on how you use the Website and services and what we provide to you, we collect a range of personal data from you, including your name and contact information (such as your address, telephone number and email) as well as other information which you choose to give us as you use the Website and our services. You may also choose (consent) to give us special category personal information so that we can provide services to you as you require.
(1) What personal data do you collect?
We collect different types of personal data (any information that could identify you) but on the basis that we collect the minimum amount of data that we need. We may collect your personal data from you in the following ways:
- Identification and contact information – such as your name and contact details (address, email, telephone number), date of birth, gender, and information when you register on the website, apply for a job with us or start to work with us.
- Optional Information which you choose (consent) to give us and allow us to use so we can provide you with our services. This may include Special Categories of personal data (such as health information).
- Customer Service Information you give to us when you ask us for any help and support.
- Accounting and transaction data relating to what you buy from us and the running of our business and paying taxes (financial information is often anonymised – for example, we do not receive card details when you use one to pay us).
- Information from others which you ask or authorise them to provide to us. For example, from your employer where we provide services to your organisation or referrals from our clients and suppliers.
- Marketing information and preferences.
- Statistical information such as information that forms part of the aggregate information. So, for example, we may combine (aggregate) information about how you use the website and use it to share with our partners so we can bring the best discounts and offers to our website.
- Publicly available data such as information you share on social media.
If you choose not to provide us with personal data, we may be unable to provide some services to you. For example, without your email address we will not be able to use email which may be needed to provide our services or products.
(2) How do you collect personal data?
We may collect your personal data from you in the following ways:-
- Information you provide to us when you buy from us or ask us to provide goods and/or services to you.
- Forms you complete, such as when you register with us.
- The information you provide when you communicate with us such as during a meeting or session or by email or telephone.
- Information you provide when using our website (such as when you ask us to help or provide support or give us feedback) or social media (for example, you may comment on one of our blogs or social media posts).
- Any surveys or feedback requests which you choose to complete or competitions which you choose to enter.
- Information we receive when you visit our website from another website or from social media (such as LinkedIn or Twitter).
- If one of the people who work for us give us your contact details as their referee or emergency contact.
4 USING (PROCESSING) AND SHARING PERSONAL DATA
(1) How do you use personal data?
We collect and use personal information in a variety of ways, including when we:
- Supply you with goods and/or services you have asked us for and to fulfil our contractual obligations to you.
- Send you any information you have asked for or which may interest you, where you have consented to this happening, or information we need to tell you about.
- Manage our relationship and communicate with you, including letting you know about important changes.
- Carry out a credit check where you have specifically agreed that we can.
- Deal with any request for help or answer your queries and customer support generally.
- Interact and respond to you on social media.
- Give you the best user experience and to enable you to participate in any interactive features of our Website.
- Ask third parties to provide services to us including professional advisors, IT (including cloud providers), marketing, and outsourced services to help run our business properly and efficiently.
- Have your consent where applicable (for example, any marketing where your consent is required).
- Fulfil our contractual obligations to suppliers and other third parties.
- Assess your ability and suitability if you wish to work with or for us.
- Comply with regulations and legislation.
- To analyse and monitor how our Website is used and to help us to administer it (including security and fraud detection) and to run our business generally.
- Manage our business properly and efficiently.
- Have other legitimate interests to do so.
(2) What is the lawful basis for processing my personal data?
The law says that we cannot process (collect, use or store) your information unless we have a lawful basis for doing so. There are several lawful bases which we rely on, including:-
- Consent - when you agree that we can use your personal data in a particular way. You can withdraw your consent at any time by emailing firstname.lastname@example.org if you change your mind).
- Contractual obligations – to fulfil our contractual obligations to you or because you have asked us to do something before we enter into a contract together.
- Legal obligation – when the law says that we must, such as for tax reasons.
- Legitimate Interest - Sometimes we will process your data when, for example,
- It is in our legitimate interests to do this and
- These interests are not overridden by your data protection rights.
(3) Who do you share personal data with?
There may be times when we must share your personal data with others, for example, where the law requires us or to enforce our rights or protect others. We may also share your data to:-
- Allow authorised third parties who are providing services to us. IT Service Providers (including organisations who host our websites, so they stay online and are secure and organisations who provide us with email services so we can send and receive email), Social media providers, Advertising Organisations, Organisations who provide us with email campaigns and newsletters, Organisations who provide us with analytics’ data, Payment Providers, Credit Reference and Fraud Prevention Agencies and those who help us comply with Money Laundering obligations, Professional Service and other business and individuals who perform functions on our behalf.
- Meet our legal and regulatory obligations such as to HMRC for taxation purposes.
- When selling our business or carrying out associated business activities.
Otherwise we will only share your personal information if you have consented to this.
Where relevant, we take all steps required by law to protect personal data such as, for example, having written agreements with those third parties.
5 YOUR PERSONAL DATA RIGHTS
(1) Your Rights
The law gives you certain rights in relation to your personal data and to exercise or discuss these rights contact Michelle Gibbs at email@example.com
Your rights depend on our reason for processing your information but may include the following:
- Access your personal data
- Rectify your personal data if it is inaccurate or incomplete
- Ask us to erase your personal data and prevent processing in specific circumstances
- Restrict processing of your personal data in certain circumstances
- Data Portability - obtain and reuse your personal data for your own purposes across different services
- Object to processing your personal data in certain circumstances
For more information about your rights you can visit the Information Commissioner’s website visit where you can find detailed information about each of those rights https://ico.org.uk/your-data-matters/
(2) Exercising Your Rights
We will deal with all personal data requests as soon as we are able and usually within one month of receipt. If there is going to be a delay (which could be up to 3 months) in dealing with your request or there is a reason why we can’t comply with your request, we will let you know and explain why within one month of receiving your request.
We will ask you for some information first (primarily identification and clarification).
You also have the right to lodge any data protection complaints with the Information Commissioner's Office (ICO), the UK’s supervisory authority. Visit www.ico.org.uk for more information including how to access their helpline.
6 DATA RETENTION - HOW LONG DO WE KEEP PERSONAL DATA FOR?
Unless you have specifically agreed otherwise, we will only keep your personal data for as long as it is
- Necessary for the purposes for which the personal data are processed
- To enable us to comply with our legal obligations, for example for tax purposes
Retention depends on our relationship with you and please see below:
How long personal information/data is retained
We will retain personal information for 12 months from the date of our last communication.
We will retain personal information for 7 years from the date that you ceased to be a client.
Potential employees who are not placed in employment using our services
We will retain personal information for 12 months from the date of our last communication, unless you agree otherwise.
Employees / workers
We will retain personal information for 7 years from the date that you ceased to be an employee/worked with us.
We will retain personal information for 12 months from the date of our last communication.
We will retain personal information for 7 years from the date that you ceased to be a supplier.
7 PERSONAL DATA SECURITY
(1) What we do
We have implemented appropriate technology and operational security, including policies and measures to protect personal information under our control including from unauthorised access, improper use, alteration, unlawful or accidental destruction, and accidental loss on a “privacy by design and default” basis. This includes
- Encrypting data where possible
- Anonymising or pseudonymising data wherever this is possible
- Storing personal data in our internal systems (such as CRM (client relationship management) software) on secure servers that are not accessible by third parties without our express permission.
- Adhering to appropriate safeguards in accordance with UK Data Protection law if personal data is transferred from the UK and/or from the EEA – see section 8, Transferring of Personal Data To and From the UK section
- Providing internal policies, procedures and training about data protection to, as relevant, our employees and those who work with us
- Regularly reviewing how we process
- Restricting access to personal data to those who need it
- Physical security of our premises and our equipment
(2) Your Role
Please ensure that
- your personal data is accurate and up to date
- you take reasonable care and safety when using your devices and the internet
- if you have a website account with us, you use strong passwords which you regularly change and keep your log-in details secure
- you contact us immediately if you think or know your personal data and/or website account has been used, compromised, or accessed without your express permission or if you have any other such concerns
For more information please contact firstname.lastname@example.org
8 TRANSFERRING OF PERSONAL DATA TO AND FROM THE UK
(1) Receiving Personal Data from the EEA
The UK left the EU on the 31st December 2020. Anyone in the EEA who sends personal data outside the EEA must comply with the relevant GDPR rules. As a UK receiver we aim to assist this process to help protect the privacy of that personal data.
(2) Transferring Data from the UK
We may transfer some data outside the EEA (which may not have the same data protection), but, if we do this, we ensure that we have procedural and technical safeguards to protect the privacy of your data and to comply with the law and our own obligations, including under UK Data Protection law.
9 EXTERNAL WEBSITE LINKS AND SOCIAL MEDIA
You may visit or leave our Website by clicking a link to or from another website or platform operated by others (third parties) and we are not responsible for those websites or platforms – for example, you may use social media icons (such as Twitter). If you do this, please also take the time to read the relevant privacy information provided by other websites/platforms because they may be different. Your information will only be shared where you have agreed to allow this.
10 NON-PERSONAL INFORMATION
We also collect information which does not identify you (non-personal information). This includes the type of internet browser you use or the website from which you linked to our website.
We may also aggregate information which you have submitted to us (for example, your age and the town where you live) which is anonymous - you cannot be identified from this information. We share this aggregate information with third parties to help us run our Website and business effectively.
11 GOOGLE ADWORDS
Our website uses the Google AdWords remarketing service to advertise on third party websites (including Google) to previous visitors to our site.
12 COMPLAINTS AND DISPUTE RESOLUTION
(1) Contacting us
If you have a complaint, please contact Michelle Gibbs
By Post/mail: Michelle Gibbs, 20 Queens Cresecent, Horndean, Waterlooville, PO8 9NB
By Email: insert email address
(2) Contacting the Information Commissioner's Office
You can also lodge any data protection complaints with the Information Commissioner's Office (ICO) who is the UK’s supervisory authority. You can visit https://ico.org.uk/ for more information including the best ways to contact them.