Privacy
What we keep, and why
Last revised
What we collect
Himma Art Studio is a small studio run by one person. We collect the least we can and keep it the shortest time we can.
- When you use the public shop and checkout — the site records a small set of anonymous interaction events such as opening a product, changing a product option, adding to basket, starting checkout, checkout readiness/failure, and starting/submitting an enquiry. These records contain the page path, product ID where relevant, and limited interaction context such as option group or quantity. They do not contain your name, email, enquiry text, payment details, cookie ID, session ID or other persistent visitor identifier.
- When you enquire or ask for first notice — your name where you give it, the email/address you write from, and whatever you choose to tell us about the piece or offer. Archive first-notice requests store only the email you submit and that you asked to hear when the Archive Parcel opens. If a piece is posted, a delivery address.
- When you ask for an invitation — your name, an email address or social handle, and, if you offer it, a line about why.
- When you sign in — your name and email address as Google gives them to us, and the invitation you used. See Signing in.
- When you buy — we keep the order details needed to fulfil the purchase. Card payment is processed by Stripe; the studio receives the payment status and order information but does not receive or store your full card number. For physical orders, the delivery details needed to make and deliver the order are passed to the relevant production and delivery providers.
What it is for
To answer you, to make and post what you asked for, to keep a record of what was sold, to let members in, and to understand whether key parts of the shop and checkout are working as intended. Anonymous interaction counts are used as one source of usability evidence rather than to build visitor profiles or target advertising. We do not build profiles, we do not sell or rent your details, and we do not send newsletters unless you ask for one — in which case every message has a way to stop them.
The lawful bases we rely on are the contract between us when you buy, our legitimate interest in replying to you when you write, and your consent where we ask for it.
Signing in
The public studio and shop are open; the private Garden is entered by invitation and Google is the sign-in provider. When you do, Google tells us your name and email address; we store those with the date you joined and who invited you, so that the invitations can be honoured and, if ever needed, withdrawn. Members may see the codes they have given out and whether each has been used. Nobody outside the studio can see who is a member.
Your Google account and password stay with Google. We never see them. Google's own privacy policy covers what it does with the sign-in.
How long we keep it
Enquiries that go nowhere are deleted within a year. Records of sales are kept for six years, as HMRC requires. Membership details are kept while you are a member and removed within a month of your leaving. Invitation requests we decline are deleted within three months. Anonymous UX research events are automatically removed after 90 days.
Your rights
Under UK data protection law you may ask what we hold about you, ask for it to be corrected or deleted, ask us to stop using it, or ask for a copy to take elsewhere. Write to the studio's email address and we will reply within a month. If you are unhappy with how we handle your information you can complain to the Information Commissioner's Office at ico.org.uk.
Getting in touch
The data controller is Himma Art Studio. Write to the studio's email address, or through the contact page.