Privacy Policy
Last Updated: 10 June 2026
This Privacy Policy describes how Michelle J Bruce (referred to as "we", "us", or "our") collects, uses, and shares your personal information when you visit or make a purchase from our website.
For the purposes of the UK General Data Protection Regulation (UK GDPR), we are the Data Controller.
1. Personal Information We Collect
When you interact with our website, we collect specific categories of personal data:
Order Information: When you make a purchase, we collect your name, billing address, shipping address, email address, and phone number.
Payment Information: Payment data is processed securely through our third-party payment gateways (e.g. PayPal). We do not store or have access to your full credit card or banking details.
Device Information: When you visit our website, we automatically collect details about your web browser, IP address, time zone, and information about how you interact with our site via cookies.
2. Legal Basis and How We Use Your Data
Under UK GDPR, we only process your personal data when we have a lawful basis to do so:
Performance of a Contract: We use your Order Information to fulfill purchases, arrange tracked domestic and international shipping, issue invoices, and communicate order updates.
Consent: If you opt-in at checkout or via our newsletter form, we will use your email address to send you marketing updates about new prints and art exhibitions. You can withdraw this consent at any time.
Legitimate Interests: We use Device Information to scan for potential risk or fraud and to optimize our gallery website's performance.
3. Sharing Your Personal Data
We do not sell your personal data. We only share your information with trusted third parties necessary to run our micro-business and deliver your art:
E-Commerce Platform: Our website is hosted by Squarespace, which processes your data securely to run our store.
Courier and Shipping Partners: To deliver physical artworks and digital prints, we share your name, delivery address, phone number, and email with domestic and international courier services (e.g., Royal Mail, DHL, FedEx) so they can provide tracking notifications and process customs clearings.
Legal Compliance: We may share your data if required to do so by UK law, or to respond to a lawful request by HM Revenue & Customs (HMRC).
4. International Data Transfers
Because we ship internationally, your data may be transferred to couriers or technical infrastructure located outside the UK or the European Economic Area (EEA). We ensure that any international third-party processors adhere to strict contractual data protections that match UK data security standards.
5. Data Retention
When you place an order through the website, we will maintain your Order Information for our records for a minimum of 6 years to comply with UK tax, accounting, and corporate reporting requirements set by HMRC.
6. Your Legal Rights
If you are a resident of the UK or EU, you hold the following rights under data protection laws:
The right to access the personal data we hold about you.
The right to request that your personal data be corrected or erased.
The right to object to or restrict certain processing, including direct marketing.
The right to file a complaint with the Information Commissioner’s Office (ICO), the UK's supervisory authority for data protection issues (www.ico.org.uk).
To exercise any of these rights, please contact us at [Your Support Email Address].