Privacy Policy

May 2018

This privacy policy sets out how Rosarts uses and protects any information you give when you use this website. Any information you give via this website will only be used in accordance with this privacy policy. Please check this policy occasionally for changes as it may be reviewed and updated from time to time. The latest version will be displayed on this page. We have tried to write it in plain, jargon-free language.

In accordance with the General Data Protection Regulation, we are updating our Privacy Policy to inform you of how we process your personal data. According to the GDPR, ‘personal data’ means any information relating to an identified or identifiable person – for example a name, postal or email address, IP address or location identifier.

This policy aims to help you understand how Rosarts obtain and use any personal data you provide to us when you use this website or any of our linked online systems, such as our email systems. If you have any questions, please get in touch with us at ar@rosarts.co.uk

Who we are

Welcome to Rosarts, an online shop selling art prints and digital design services. Our website address is: https://rosarts.co.uk.

What personal data we collect and why we collect it

Information we collect:

Rosarts may collect the following information from you through your use of this website:

Your name
Your contact information, such as an email address and/or contact telephone number
Your delivery address
Your payment details (via Paypal/Worldpay/Stripe)
Information about your computer and internet connection such as browser type and IP address. This information is for statistical purposes only – i.e. to identify where customers are visiting from.

If you create an account with Rosarts by registering on our website, the details you provide can only be used by you to register and sign into this website. We may use the information you provide such as your name or email address to contact you about any order you make.

What we do with the information we gather

Collecting this data helps us to learn about what you are looking for from us, which helps us to identify and deliver the most relevant products and services to our customers.

We use the information which you provide during your order solely to process your order and contact you about any delays or problems.

The information you provide to us is kept private.

We do not pass on your details to third parties for marketing purposes, and will only pass on your data to third parties for any other purpose if required to do so by law.

Comments

When visitors leave comments on the site we collect the data shown in the comments form, and also the visitor’s IP address and browser user agent string to help spam detection.

An anonymised string created from your email address (also called a hash) may be provided to the Gravatar service to see if you are using it. The Gravatar service privacy policy is available here: https://automattic.com/privacy/. After approval of your comment, your profile picture is visible to the public in the context of your comment.

Media

If you upload images to the website, you should avoid uploading images with embedded location data (EXIF GPS) included. Visitors to the website can download and extract any location data from images on the website.

Consent

We respect your right to privacy and your right to choose how we communicate with you. We will only use the contact details provided by you to communicate with you about your order.

The information you provide to us is kept private. We do not pass on your personal data unless we are required to do so by law.

Any personal information we hold about you is stored and processed under our data protection policy, in line with the new General Data Protection Regulation (GDPR).

Cookies

Our website uses cookies to allow you to move from one part of the website to another without losing the items which sit in your online shopping basket.

Cookies cannot read any information saved on your hard drive and cannot spread viruses.

Our cookies only pass on the information that you have already disclosed to our website.

All computers have the ability to decline cookies. This can be done by activating the setting on your browser which enables you to decline the cookies. Please note that should you choose to decline cookies, you may be unable to access particular parts of our website.

You can read more about cookies here: http://www.allaboutcookies.org/

If you leave a comment on our site you may opt-in to saving your name, email address and website in cookies. These are for your convenience so that you do not have to fill in your details again when you leave another comment. These cookies will last for one year.

If you have an account and you log in to this site, we will set a temporary cookie to determine if your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser.

When you log in, we will also set up several cookies to save your login information and your screen display choices. Login cookies last for two days, and screen options cookies last for a year. If you select “Remember Me”, your login will persist for two weeks. If you log out of your account, the login cookies will be removed.

If you edit or publish an article, an additional cookie will be saved in your browser. This cookie includes no personal data and simply indicates the post ID of the article you just edited. It expires after 1 day.

Embedded content from other websites

Articles on this site may include embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website.

These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracing your interaction with the embedded content if you have an account and are logged in to that website.

This site may contain links to third-party websites (“Linked Sites”), including social media features such as Facebook, YouTube, or Twitter buttons. We are not responsible for the privacy practices or content of any Linked Sites and Linked Sites may collect personally identifiable information from you that is not subject to our control. The data collection practices of Linked Sites will be governed by that site’s privacy policy.

Analytics

We use Google Analytics and online security software to monitor traffic to our website. You can opt-out of Google Analytics tracking should you wish to by selecting ‘reject cookies’ on our cookie bar, or by using this opt-out tool on your browser.

E-Commerce

When you place an order on our website, we collect the following personal data:

Billing details:
First name
Surname
Company name (optional)
Street address
Town/city
County
Postcode
Country

Shipping details (optional)
First name
Surname
Company name
Street address
Town/city
County
Postcode
Country

Email address
Telephone number
IP address

Additionally, certain data is collected by Google Analytics when you make a purchase from our website.

Why do we process this personal data?

Billing details are required to process the debit or credit card transaction and for delivery of the item(s) ordered. Credit and debit card transactions are handled by Stripe, WorldPay or PayPal on behalf of Rosarts. Your card details are encrypted (known as tokenisation) by your web browser before they are transmitted securely to Stripe or PayPal, who will then process the transaction. We do not have access to your credit or debit card details at any time and we do not hold untokenised credit or debit card details on our server. The tokenised version of your card details, which can only be decrypted by Stripe, WorldPay or PayPal, is stored on our server if you select the option to save your payment method in your account.

Shipping details are only required if the item(s) ordered are to be delivered to a different address to the billing details. Your email address is used to contact you regarding your order. Your telephone number is required in case we need to get in touch urgently regarding your order for example if an item in your order is time-limited in some way,

We require your IP address to locate which country you are in because sales are currently restricted to the United Kingdom.

Payment providers’ access to this data:

Depending on the provider you choose to make a transaction with, they will have access to this data.

WorldPay has access to your billing details so they can process the transaction. You can see their privacy policy at https://www.worldpay.com/uk/privacy-policy.

PayPal has access to your billing details so they can process the transaction. You can see their privacy policy at https://www.paypal.com/uk/webapps/mpp/ua/privacy-full.

Stripe has access to your billing details so they can process the transaction. You can see their privacy policy at https://stripe.com/gb/privacy.

The lawful basis for processing this data is contractual necessity.

How long do we retain this personal data?

We retain personal data created through e-commerce for a period of six years.

Who we share your data with

We share website data with the following 3rd party providers: our web host, online security provider, Google Analytics, PayPal, Stripe and WorldPay (for online purchases). The data we share with these providers is related to customers’ visits to the site, any signups to our email list, and/or any purchases that may be made on the site.

Transactional data generated from our payment providers is shared with our accounting software which is provided by our Bank. You can read more about this here: https://www.freeagent.com/company/gdpr/

We do not and will not share your personal data with other companies for marketing purposes, or for any other reason, unless required to do so by law.

How long we retain your data

We retain data that is collected or processed by our website until we delete it or you remove your customer account from our website.

We delete email communications periodically as a matter of course.

If you leave a comment, the comment and its metadata are retained indefinitely. This is so we can recognise and approve any follow-up comments automatically instead of holding them in a moderation queue.

For users that register on our website (if any), we also store the personal information they provide in their user profile. All users can see, edit, or delete their personal information at any time (except they cannot change their username). Website administrators can also see and edit that information.

What rights you have over your data

If you have an account on this site, or have left comments, you can request to receive an exported file of the personal data we hold about you, including any data you have provided to us. You can also request that we erase any personal data we hold about you. This does not include any data we are obliged to keep for administrative, legal, or security purposes.

Your right to be informed

You can contact us at any time for information on how we are processing your personal information. Email us at admin@rosarts.co.uk.

Your right of access

You have the right to access the personal information we hold about you, including any information you have provided to us. You can request to receive an exported file of the personal data we hold about you, including any data you have provided to us. You can do this using a Subject Access Request form, which we can provide to you on request. Email us at rosartsuk@gmail.com.

Your right to rectification

You have the right to request a rectification of any inaccuracies in the information we hold on you, or have it completed if it is incomplete. You can do this verbally or in writing. We will respond to your request within one calendar month.

Your right to erasure

You can also request that we erase any personal data we hold about you. This does not include any data we are obliged to keep for administrative, legal, or security purposes.

Your right to restrict processing

You have the right request that we limit the ways in which we use the information you provide to us. You can do this verbally or in writing. When processing is restricted, we are permitted to store your personal data, but not use it. We will respond to your request within one calendar month.

Your right to data portability

If you have an account on this site, or have left comments, you can request to receive an exported file of the personal data we hold about you, including any data you have provided to us.

Your right to object

If you feel that your personal data is not being handled in an appropriate way by us or if you think there is a problem in the way we are processing your data then you have the right to complain to the ICO.

Online Dispute Resolution

You can use this link to the Online Dispute Resolution Platform. This is an alternative dispute resolution service that is conducted online. It is for consumers and traders who have had a problem or dispute between themselves regarding online purchases. If you have a dispute you can access this portal by clicking on the above link.

Your right not to be subject to automated decision-making including profiling

We occasionally look at user profiles of our website visitors that are created by Google Analytics, to help us learn more about who is visiting our website. You have the right to opt-out of Google Analytics tracking so that your use of our website does not process any of your data. You can download an opt-out browser add-on from Google tools if you wish to do this.

Where we send your data

Visitor comments may be checked through an automated spam detection service.

Our contact information

For any privacy-specific concerns or requests, please contact us via email at rosartsuk@gmail.com.

Additional information

Lawful basis

We process personal data under the following basis:

Contractual necessity: the processing of data that we need in order to carry out the work we provide for our customers. For example, we need to know the name, address and contact details of a customer who wants us to order a print, product or service or to create some design work for them. We also need to know where to send an invoice to if a purchase isn’t being made directly on this site.

How we protect your data

We have carried out a Privacy Impact Assessment for the data we collect from our website and email communications. The website is secured by SSL, as is our email server, to encrypt transmissions between the server and the user’s computer. The number of website administrators with access to this data is kept to a minimum.

What data breach procedures we have in place

A ‘personal data breach’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed. We have the following procedures in place to deal with potential or real data breaches:

Detection and monitoring: we regularly monitor our website to see who is accessing it and we use online firewall technology to block any hacking or unauthorized access attempts. We receive an email from our security provider if there are any security issues occurring in our website. We are also in very close contact with our web host who is also on hand to identify any issues and alert us to them.

Response and reporting: If we detect a breach, we firstly investigate to establish the likelihood and severity of the resulting risk or damage to people’s rights and freedoms. We document the breach, and also the determination made regarding the risks to people’s rights and freedoms as a result. If we determine that this risk is significant, we will report the data breach to the ICO within 72 hours. If we determine that a risk to people’s rights and freedoms is unlikely, we will not report this, but we will still document the breach and explain why the risk was deemed unlikely.

If the data breach poses a high or severe risk to the rights and freedoms of people involved then we will inform those individuals of the data breach immediately and advise them of the steps we’re taking in response.

We will review this policy and update it periodically, please come back and check from time to time as we do so.

For any questions or enquiries regarding your privacy, please email us at rosartsuk@gmail.com.

This policy is effective from April 2015.

This website privacy policy was updated on: 13/02/2019