Privacy

This is a one-person site. There is no mailing list, no advertising, no tracking pixel and no cookie banner, because there is nothing here that would need one. What follows is the complete account.

Who is responsible

Anthony Xuereb is the data controller.
[POSTAL ADDRESS — TO CONFIRM]
anthony@xuereb.co.uk

If you only read the site

Nothing is asked of you and nothing is stored in your browser. There are no cookies. Fonts are served from this site rather than from Google, so no third party learns you were here from loading them.

Vercel Web Analytics counts page views. It sets no cookie and builds no profile: it records the page, the referring site, and a coarse country and device type, and derives a visitor count from a hashed value that is discarded daily and cannot be traced back to you. This is why there is no cookie banner — there is no cookie to consent to.

Lawful basis: legitimate interests (UK GDPR Article 6(1)(f)) — knowing which paintings people look at, using the least identifying method available.

If you email me

Your email sits in my mailbox, hosted by Google, for as long as the conversation is useful. I do not add you to anything.

Lawful basis: legitimate interests — answering someone who wrote to me. If the email is about buying a print, performance of a contract (Article 6(1)(b)).

If you buy a print

Four organisations are involved, and each is given the least it can work with.

Stripe — taking the payment

Payment is processed by Stripe Payments UK Ltd. You enter your card details on Stripe's own form; they never reach this site and I never see them. Stripe sends me your name, email, delivery address, what you bought, and confirmation that payment succeeded.

Stripe sets cookies during checkout, on their domain, to process the payment and detect fraud. They are a controller in their own right for that fraud-prevention work — their privacy policy covers it.

Lawful basis: performance of a contract (Article 6(1)(b)) for the payment; legal obligation (Article 6(1)(c)) for the records HMRC requires; legitimate interests for fraud prevention.

The printer — making and sending your print

Printing and dispatch is handled by Prodigi, a UK print company, acting as my processor on my instructions. They receive your name and delivery address, and the item to print. They do not receive your payment details, and they may not use your address for anything but sending your parcel.

Lawful basis: performance of a contract (Article 6(1)(b)) — you cannot be sent a print without an address to send it to.

Resend — order emails

Order confirmations and dispatch notices are sent through Resend, acting as my processor. They handle your email address and the content of the message.

Lawful basis: performance of a contract (Article 6(1)(b)).

Vercel — hosting

The site runs on Vercel, my processor for hosting. Their servers keep short-lived request logs containing IP addresses, as any web server does, for security and to keep the site working.

Lawful basis: legitimate interests (Article 6(1)(f)) — running a site that stays up and is not attacked.

Where your data goes

Some of these companies are based in, or use servers in, the United States. Transfers out of the UK rely on the UK International Data Transfer Addendum or the UK Extension to the EU–US Data Privacy Framework, which are the safeguards UK GDPR requires.

How long it is kept

• Order records — six years after the end of the tax year they fall in, which is how long HMRC requires business records to be kept.
• Emails — as long as the conversation is useful, then deleted.
• Analytics — aggregate counts only, with nothing that identifies a person to retain.

Your rights

Under UK GDPR you can ask for a copy of what I hold about you, ask for it to be corrected or deleted, ask me to restrict or stop using it, and ask for it in a portable form. Where I rely on legitimate interests you can object, and I will stop unless there is a compelling reason not to.

Email anthony@xuereb.co.uk and I will answer within a month. Deleting an order record is the one request I may have to refuse in part, and only for as long as HMRC requires it to exist.

If you are not satisfied you can complain to the Information Commissioner's Office at ico.org.uk , though I would rather you told me first.

Changes

If this notice changes materially — a new processor, a new purpose — the change is made here before the thing it describes starts happening.

See also terms of sale, delivery and returns and cancellation.