Privacy notice · Anahita Eastwood

Who is responsible for your data

Anahita Eastwood (sole trader, based in Surrey) is the data controller for personal information collected through this website.

For any question about your data, or to make a request under the UK General Data Protection Regulation, please write to anahitaeastwood@yahoo.co.uk. Her son Michael helps administer the site and is copied on enquiries.

This notice sets out what we collect, why, how long we keep it, who else touches it and the rights you have under the UK General Data Protection Regulation and the Data Protection Act 2018.

What we collect

We collect only what we need to run a small studio.

Order information: your name, delivery address, email address, and the details of what you bought. Payment details are handled by Stripe and are never seen or stored by us.
Contact and commission enquiries: your name, email address, and anything you choose to write in the message.
Newsletter sign-ups: your email address, and your first name if you give it. Sign-up is double opt-in: you receive a confirmation email and click a link before your address is added to the list.
Server logs: standard technical information (IP address, browser type, pages viewed) held briefly by our hosting provider for security and abuse prevention.

We do not use analytics cookies and we do not track you across other websites. Please see the cookies page for the full detail.

Why we hold it, and on what lawful basis

To complete your order and fulfil the contract: order details, addresses, email. Lawful basis: performance of a contract to which you are a party.
To answer your enquiry or commission request: contact form data. Lawful basis: steps taken at your request before entering a contract, and our legitimate interest in replying to people who write to us.
To send you the studio newsletter: your email address (and first name if given). Lawful basis: your consent, which you can withdraw at any time.
To meet our legal duties: order records, invoices and tax records. Lawful basis: legal obligation.
To keep the site safe: server logs and anti-fraud checks. Lawful basis: our legitimate interest in a working, secure website.

Who processes it for us

The following data processors help us run the site. Each is bound by a written contract and its own privacy policy, and each holds only the data needed for its job.

Stripe: payment processing and fraud checks at checkout. Data: your payment details, name, billing address and order value.
Netlify: website hosting and form intake. Data: everything that reaches the server, including contact form submissions and server logs.
Prodigi: print production and dispatch. Data: your name, delivery address and print details when you order a print.
Resend: transactional email (order confirmations, replies from us). Data: your email address and the message content.
Kit: newsletter delivery. Data: your email address, first name if given, and whether you opened or clicked.
Cloudflare: bot protection through Turnstile on our forms. Data: technical signals about the browser, used only to tell humans from bots.

Some of these providers are based outside the United Kingdom. Where your data leaves the United Kingdom, it is protected by the safeguards required under UK GDPR (adequacy decisions, standard contractual clauses or the UK international data transfer addendum, as appropriate).

How long we keep it

Order records: six full financial years, to meet HMRC record-keeping requirements.
Contact and commission messages: up to two years from the last message, then deleted, unless a project is still live.
Newsletter subscribers: until you unsubscribe, plus a short window afterwards to record the unsubscribe request.
Server logs: no longer than 30 days.

Your rights

Under UK GDPR you have the right to:

ask for a copy of the personal data we hold about you,
ask us to correct anything that is wrong,
ask us to delete data we no longer need (subject to our legal duties, in particular the tax records above),
ask us to restrict processing while a query is being resolved,
object to processing based on our legitimate interests,
withdraw consent for the newsletter at any time (there is a one-click unsubscribe link on every issue),
receive certain data in a portable, machine-readable form.

To exercise any of these rights, please write to anahitaeastwood@yahoo.co.uk. We reply within one month; if a request is complex, we may extend that period by up to two further months and will tell you why.

Complaints

If you are not happy with how we have handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk, by post at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, or by telephone on 0303 123 1113. We would rather hear from you first, but this route is always open.