Privacy notice

This notice explains how Kasia Clarke, sole trader, uses personal information in running this website, selling artwork and other products, providing online courses and communicating with customers and subscribers. I am the controller of the personal information I use for these business purposes.

For privacy questions, requests or complaints, email kasia@kasiaclarke.com. Business correspondence details appear below.

Information I use

Depending on how you interact with the business, this can include your name, contact and delivery details, order and payment-status records, enquiries, course enrolment and support information, newsletter preferences and consent records. Website and service providers also process technical information such as IP addresses, device and browser details, security logs and interactions with pages or messages.

Information comes from you and from the services used to take payments, fulfil orders, deliver courses and manage email. Card details are handled through the relevant payment service; please never send full card details, passwords or login codes by email.

Why I use it and the lawful basis

• Orders, delivery and course access: to enter into and perform our contract, including answering questions about a proposed purchase.
• Tax, accounting and legal obligations: to comply with applicable law.
• General enquiries, business administration, security and resolving disputes: legitimate interests in operating and protecting the business, while considering your rights and reasonable expectations.
• Newsletters and promotional emails: your consent where you sign up. If relying on a permitted existing-customer exception, I must meet its conditions, including a clear opt-out when details are collected and in each message.
• Optional tracking: consent where required. Any use of an applicable legal exception must meet its conditions and provide the required information and choices.

Some information is needed to process an order or provide access. If you choose not to provide it, I may be unable to complete that transaction. You do not need to subscribe to marketing to buy.

Email preferences

MailerLite is used for email subscriptions and campaigns. Your selected interests help determine which art or course emails you receive. Delivery records and, where enabled, email-open and link-click information can help assess messages and manage the list. An open signal is not always reliable because email software can load images automatically.

You can object to direct marketing at any time. Use the unsubscribe link in a marketing email or contact me. Where processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing. Unsubscribing from marketing does not stop essential order, access or service messages. A minimal suppression record may be retained to respect your choice.

Service providers and sharing

I use Shopify for the online shop, Teachable for courses and digital purchases, and MailerLite for email marketing. Depending on your transaction, relevant information is also shared with payment providers, delivery or fulfilment services, accounting and IT providers, and professional advisers. Authorised support staff or contractors may access the information needed to help you. Information may be disclosed where required by law or to establish or defend legal claims.

I do not sell my mailing list. Using a provider to deliver a service involves sharing relevant information; it is not the same as selling the list. Providers may act on my instructions and, for some activities, as controllers in their own right. Their notices explain those activities: Shopify, Teachable and MailerLite.

International processing

Some providers process information outside the UK. Where a restricted transfer occurs, an appropriate UK transfer mechanism is required, such as an applicable adequacy regulation or approved contractual safeguards. Contact me for information about the safeguards relevant to your data and how to obtain a copy. The providers’ notices also explain their international processing arrangements.

Cookies and similar technologies

Shop and platform services use cookies or similar storage for functions such as the basket, checkout, account access, security and remembering choices. Analytics and advertising tools, if enabled, can collect information about visits and interactions. Advertising tracking requires consent; other optional technologies require consent unless a specific legal exception applies.

Use the privacy or cookie controls presented by the website or service to make your choices. You can also manage stored cookies through your browser, although blocking essential cookies can prevent checkout or login from working. Browser controls are additional choices and do not replace any consent that the website must obtain. Teachable and other linked services have their own controls.

How long information is kept

Information is kept only for as long as needed for the purpose and applicable legal obligations. Order and accounting records are retained for the relevant tax-record period and, where necessary, to resolve claims. Course records are retained as needed to provide the access purchased and support it. Enquiries are kept while they are being handled and for a reasonable follow-up or dispute period. Marketing records are retained while the subscription is active, subject to periodic review; consent and suppression records may be kept longer to evidence and respect your choices.

The appropriate period depends on the record, transaction and legal requirement. You can ask about the retention criteria applying to your information. Access should be limited to people and providers who need it for the relevant purpose.

Your rights

Depending on the processing and applicable law, you may ask to access or correct your information, erase it, restrict its use, object to processing or receive certain information in a portable form. These rights are not absolute; for example, records may need to be retained for legal obligations. Contact me to exercise them. I may need proportionate information to verify your identity.

I will respond within the applicable statutory timescale, normally one month, and explain any lawful extension or exception. There is normally no fee.

Privacy complaints

If you are unhappy with how your data has been used, email me with the subject “Privacy complaint” and explain your concern. I will acknowledge a data-protection complaint within 30 days, investigate without undue delay, keep you informed and explain the outcome.

You also have the right to complain to the UK Information Commissioner’s Office: ico.org.uk/make-a-complaint or 0303 123 1113.

Changes to this notice

This notice will be updated when relevant practices change. Where required, I will provide additional information or seek fresh consent before using information for a new purpose.