Privacy Policy
Introduction
Welcome to the Eva Merendes Art privacy policy.
We respect your privacy and are committed to protecting your personal data. This privacy policy will inform you about how we look after your personal data when you visit our website (regardless of where you visit it from) and tell you about your privacy rights and how the law protects you.
It contains important information on who I am and how and why I collect, store, use and share your personal information. It also explains your rights in relation to your personal information and how to contact me or supervisory authorities in the event you have a complaint.
I collect, use and am responsible for certain personal information about you. When I do so I am subject to data protection laws which apply across the European Union and the United Kingdom and am responsible as the ‘controller’ of that personal information for the purposes of those laws.
By providing me with your data, you warrant to me that you are over 13 years of age. Where I provide services to children under the age of 13 (including workshops or one-to-one lessons), I require the consent of a parent or legal guardian before collecting or processing any personal data relating to that child.I will take reasonable steps to verify that such consent has been given, including communicating directly with a parent or guardian where appropriate. Personal data relating to children will only be collected where it is necessary for the provision of my services and will be handled with additional care and safeguards.
1. Important information and who we are
Purpose of this privacy policy
This privacy policy aims to give you information on how I collect and process your personal data through your use of this website, including any data you may provide when you:
fill in a contact form
sign up to receive newsletters or marketing communications
purchase artwork or other products
book or attend workshops or one-to-one lessons (including those involving children)
correspond with me directly by email, phone or in person
take part in a competition, promotion or survey
While this website is primarily intended for adults, I may collect and process personal data relating to children in connection with the provision of workshops or one-to-one lessons. In such cases, I require the consent of a parent or legal guardian and take appropriate steps to ensure that children’s data is handled safely and in accordance with applicable data protection laws.
I may occasionally provide additional privacy information when collecting your data for specific services (for example, when booking a workshop or signing up to emails). Please read these alongside this policy so you understand how your data is used.
Controller
Eva Merendes Art is the controller and responsible for your personal data (collectively referred to as “I”, “me” or “my” in this privacy policy).
If you have any questions about this privacy policy, including any requests to exercise your legal rights, please contact us using the details set out below.
Contact details
If you have any questions about this privacy policy or my privacy practices, please contact me. My full details are:
Full legal name: Evlampia Vazaka
Trading name: Eva Merendes Art
Email address: art@evamerendes.com
Postal address: Studio 19, Koppel Studios, 29 Thames St, Kingston upon Thames KT1 1PH
You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues. I would appreciate the opportunity to address your concerns first.
Your duty to inform us of changes
It is important that the personal data I hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with me.
Third-party links
This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. I do not control these third-party websites and am not responsible for their privacy statements. When you leave my website, I encourage you to read the privacy policy or notice of every website you visit.
2. The data I collect about you
Personal data means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
I may collect, use, store and transfer different kinds of personal data about you, which I have grouped together as follows:
Identity Data includes first name, last name, title, date of birth (where relevant, for example for children’s workshops) and gender.
Contact Data includes billing address, delivery address, email address and telephone numbers.
Financial Data includes payment information, which is processed securely by third-party payment providers (I do not store full payment card details).
Transaction Data includes details about payments and the products or services you have purchased from me.
Technical Data includes IP address, browser type and version, time zone setting, location, operating system and platform, and other technology on the devices you use to access this website.
Profile Data includes your purchases, interests, preferences, feedback and survey responses.
Usage Data includes information about how you use this website and my services.
Marketing and Communications Data includes your preferences in receiving marketing and your communication preferences.
I also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data may be derived from your personal data but is not considered personal data in law, as it does not directly or indirectly reveal your identity. For example, I may aggregate Usage Data to calculate the percentage of users accessing a specific website feature.
Sensitive Data
Sensitive data includes information about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, health, and genetic or biometric data. I do not generally collect sensitive personal data about you. However, in limited circumstances, I may collect certain health-related information (for example, allergies or medical conditions) where it is necessary to ensure the safety and wellbeing of participants attending workshops or lessons, particularly where children are involved. In such cases, I will only collect the minimum information required and will process it with your explicit consent.
3. How is your personal data collected?
I use different methods to collect data from and about you, including:
Direct interactions
You may provide Identity, Contact and Financial Data by filling in forms or by corresponding with me by post, phone, email or otherwise. This includes personal data you provide when you:
purchase artwork or other products
book or attend workshops or one-to-one lessons
subscribe to newsletters or other communications
request marketing to be sent to you
enter a competition, promotion or survey
provide feedback or contact me
Automated technologies or interactions
As you interact with this website, I may automatically collect Technical Data about your equipment, browsing actions and patterns. This data is collected using cookies and similar technologies. Please see my cookie policy [insert link] for more details.
Third parties
I may receive technical data from analytics providers such as Google. I may also receive Contact, Financial and Transaction Data from third-party payment providers such as PayPal and Stripe and other service providers used to process payments and deliver services.
4. How I use your personal data
I will only use your personal data when the law allows me to. Most commonly, I will use your personal data in the following circumstances:
To perform a contract I am about to enter into or have entered into with you (for example, processing purchases, bookings, or delivering workshops and lessons).
Where it is necessary for my legitimate interests, provided your interests and fundamental rights do not override those interests (for example, improving my services or responding to enquiries).
To comply with a legal obligation (for example, for accounting or tax purposes).
For marketing purposes, where you have given your consent to receive updates about my products, services, workshops or events.
I may send you marketing communications by email (and occasionally by other means, where you have agreed). You have the right to withdraw your consent at any time by contacting me or by clicking the unsubscribe link in any marketing email.
Purposes for which I will use your personal data
I have set out below the ways I use your personal data and the legal bases I rely on. I may process your personal data under more than one lawful basis depending on the specific purpose.
To process purchases and bookings (including workshops and one-to-one lessons)
Type of data: Identity, Contact, Financial, Transaction
Lawful basis: Performance of a contract
To manage payments and recover money owed
Type of data: Identity, Contact, Financial, Transaction
Lawful basis:
Performance of a contract
Legitimate interests (to recover debts)
To manage my relationship with you (customer service and updates)
Type of data: Identity, Contact, Profile, Marketing & Communications
Lawful basis:
Performance of a contract
Legal obligation
Legitimate interests
To deliver workshops and lessons safely (including where children are involved)
Type of data: Identity, Contact (and limited health data where necessary)
Lawful basis:
Performance of a contract
Explicit consent (for sensitive data)
To administer and protect my business and website
Type of data: Identity, Contact, Technical
Lawful basis:
Legitimate interests
Legal obligation
To use analytics to improve my website and services
Type of data: Technical, Usage
Lawful basis: Legitimate interests
To send marketing communications (newsletters, updates, workshops and events)
Type of data: Identity, Contact, Marketing & Communications
Lawful basis: Consent
To promote my workshops, events and services, and measure the effectiveness of my advertising
Type of data: Technical, Usage
Lawful basis:
Consent (for cookies and tracking technologies)
Legitimate interests (to promote and grow my business)
Marketing
I may use your personal data to send you updates about my artwork, workshops, events and services. I will only send you marketing communications where:
you have given your consent, or
you have previously purchased or enquired about my services and have not opted out of receiving marketing communications.
You can opt out of receiving marketing communications at any time by:
clicking the unsubscribe link in any email, or
contacting me directly.
How I use your data for marketing
I may use your Identity, Contact and Marketing & Communications Data to send you relevant updates about my products, services, workshops and events. I do not carry out automated decision-making or detailed profiling when sending marketing communications.
Third-party marketing
I do not share your personal data with third parties for their own marketing purposes.
Opting out
You can ask me (or third parties, where applicable) to stop sending you marketing messages at any time by:
clicking the unsubscribe link in any marketing email, or
contacting me directly using the details provided in this privacy policy.
Where you opt out of receiving marketing messages, this will not affect personal data provided as a result of a purchase, booking, or other transaction.
Cookies
You can set your browser to refuse all or some cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, some parts of this website may become inaccessible or not function properly. For more information about the cookies I use, please see my cookie policy [insert link].
Change of purpose
I will only use your personal data for the purposes for which I collected it, unless I reasonably consider that I need to use it for another reason that is compatible with the original purpose.
If I need to use your personal data for an unrelated purpose, I will notify you and explain the legal basis which allows me to do so.
Please note that I may process your personal data without your knowledge or consent where this is required or permitted by law.
5. Disclosures of your personal data
I may share your personal data with the parties set out below for the purposes described in this privacy policy:
Service providers who provide services such as payment processing, website hosting, email delivery, analytics and marketing support
Professional advisers, including accountants, lawyers and insurers
HM Revenue & Customs (HMRC) and other regulators or authorities where required by law
Third parties involved in a business transfer, if I sell, transfer or merge parts of my business or assets
I require all third parties to respect the security of your personal data and to treat it in accordance with the law. I do not allow third-party service providers to use your personal data for their own purposes and only permit them to process it for specified purposes and in accordance with my instructions.
6. International transfers
Some of the third-party service providers I use (for example, payment processors, website hosting, email and analytics providers) may transfer and store your personal data outside the UK and European Economic Area (EEA).
Whenever your personal data is transferred outside the UK or EEA, I ensure that appropriate safeguards are in place to protect your data, including:
transferring data to countries that have been deemed to provide an adequate level of protection by UK or EU authorities; or
using standard contractual clauses (approved data protection contracts) with service providers to ensure your data is protected.
These measures are designed to ensure that your personal data receives a similar level of protection wherever it is processed. If you would like more information about how your data is transferred internationally, please contact me using the details set out in this privacy policy.
7. Data security
I have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, I limit access to your personal data to trusted third parties who need it in order to provide services to me (for example, payment processors, website hosting, email and analytics providers). They will only process your personal data on my instructions and are subject to appropriate confidentiality and data protection obligations.I have procedures in place to deal with any suspected personal data breach and will notify you and any applicable regulator where I am legally required to do so.
8. Data retention
How long will you use my personal data for?
I will only retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including to meet any legal, accounting or reporting requirements. I may retain your personal data for a longer period in the event of a complaint or if I reasonably believe there is a prospect of a dispute or legal claim arising from our relationship.
When determining how long to retain personal data, I consider factors such as the nature and sensitivity of the data, the purposes for which it is used, and any legal requirements. By law, I am required to keep basic information about my customers (including Identity, Contact, Financial and Transaction Data) for six years after they cease being customers for tax purposes. If you are not a customer, I will generally retain your personal data for up to two years after your last interaction with me.
In some circumstances, you can ask me to delete your personal data (see “Request erasure” below for more information). In some cases, I may anonymise your personal data so that it can no longer be associated with you. I may use this anonymised data for research or statistical purposes indefinitely.
9. Your legal rights
Under data protection law, you have certain rights in relation to your personal data. These include the right to:
Request access to your personal data
Request correction of your personal data
Request erasure of your personal data
Object to processing of your personal data
Request restriction of processing your personal data
Request transfer of your personal data to you or a third party
Withdraw consent at any time where I rely on consent to process your data
If you wish to exercise any of these rights, please contact me using the details provided in this privacy policy.
No fee usually required
You will not usually have to pay a fee to access your personal data or to exercise any of your rights. However, I may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, I may refuse to comply with your request in these circumstances.
Changes to this privacy policy
I may update this privacy policy from time to time. When I do, I will update it on this page.