Legal
Privacy Policy
Plain English summary: We collect your personal data only when you contact us or make a purchase. We don't sell it, we don't use it for advertising, and we don't share it except with the services needed to run the business (payment processing, website hosting). You have the right to see, correct or delete your data at any time.
1. Who we are
The data controller is Emily Duchscherer Kirk Studio Ltd, Company no. 17087196, registered in England and Wales.
Registered address: 188 Lyde Road, Yeovil, Somerset, BA21 5PN
Email: hello@emilyduchschererkirkstudio.co.uk
Phone: 07734 322107
We are registered with the Information Commissioner's Office (ICO) as a data controller.
2. What personal data we collect and why
Contact form enquiries
Data collected: Name, email address, subject, message content.
Legal basis: Legitimate interests (Article 6(1)(f) UK GDPR) — to respond to your enquiry and manage our business relationships.
Retention: We keep enquiry data for up to 2 years, then delete it unless an ongoing business relationship exists.
Online shop orders (Snipcart / Stripe)
Data collected: Name, email address, delivery address, order details. Payment card data is processed directly by Stripe and is never seen or stored by us.
Legal basis: Contract (Article 6(1)(b) UK GDPR) — processing is necessary to fulfil your order.
Retention: Order records are kept for 6 years in line with HMRC requirements for financial records. Payment data is held by Stripe under their own privacy policy.
Commission enquiries
Data collected: Name, email, phone (if provided), details of the commission.
Legal basis: Legitimate interests / pre-contractual steps (Article 6(1)(b) and (f) UK GDPR).
Retention: Retained for the duration of the commission plus 6 years for financial record-keeping.
Email newsletter (if you subscribe)
Data collected: Email address and first name.
Legal basis: Consent (Article 6(1)(a) UK GDPR). You can withdraw consent and unsubscribe at any time via the link in any newsletter email.
Retention: Until you unsubscribe, after which your data is removed from our mailing list within 30 days.
Website analytics
We use Cloudflare Web Analytics, which is cookieless and does not collect personally identifiable information. No consent is required for this. See Cloudflare's privacy policy for details.
3. Who we share your data with
We share personal data only with the third-party services that are essential to running the business. All are acting as data processors on our behalf:
| Service | Purpose | Location |
|---|---|---|
| Snipcart | Shopping cart and order management | Canada (adequacy decision applies) |
| Stripe | Payment processing | USA / UK (Standard Contractual Clauses) |
| Cloudflare | Website hosting, CDN, cookieless analytics | USA / UK (Standard Contractual Clauses) |
| Sanity | Content management system | USA / EU (Standard Contractual Clauses) |
| Mailchimp (if newsletter) | Email newsletter delivery | USA (Standard Contractual Clauses) |
We do not sell, rent or trade personal data to any third party. We do not use personal data for advertising or profiling.
4. International data transfers
Some of our service providers are based outside the UK. Where personal data is transferred outside the UK, we ensure that appropriate safeguards are in place — either an adequacy decision by the UK government, Standard Contractual Clauses (SCCs), or another approved transfer mechanism.
5. Your rights under UK GDPR
You have the following rights regarding your personal data:
- Right of access — you can request a copy of the personal data we hold about you.
- Right to rectification — you can ask us to correct inaccurate data.
- Right to erasure ("right to be forgotten") — you can ask us to delete your data where there is no longer a legitimate reason to hold it.
- Right to restrict processing — you can ask us to limit how we use your data in certain circumstances.
- Right to data portability — you can request your data in a structured, machine-readable format.
- Right to object — you can object to processing based on legitimate interests.
- Right to withdraw consent — where processing is based on consent (e.g. newsletter), you can withdraw at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, contact us at hello@emilyduchschererkirkstudio.co.uk. We will respond within one calendar month.
6. Right to complain
If you believe we have not handled your personal data correctly, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Website: ico.org.uk
Phone: 0303 123 1113
Address: ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
We would always ask that you contact us first so we have the opportunity to resolve any concern directly.
7. Data security
We take reasonable technical and organisational measures to protect your personal data. All data is transmitted over HTTPS. Payment data is handled entirely by Stripe and is never transmitted to or stored on our systems. We do not store payment card details.
8. Children's data
Our website and services are not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe we have inadvertently received data from a child, please contact us and we will delete it promptly.
9. Cookies
For full details of the cookies and local storage used on this site, see our Cookie Notice.
10. Changes to this policy
We may update this policy when our practices change or when required by law. The date at the top of this page shows the most recent update. Significant changes will be noted clearly.