Home / Privacy Policy
Privacy Policy
Last updated: 2026-10-08
Who we are
Red Art London Ltd (trading as Red Art) is the data controller for the personal data described on this page. You can contact us about privacy matters at [email protected] or Unit 61, Stables Market, Chalk Farm Road, London NW1 8AH .
What we collect
- Account details: name, email, password (stored securely, never in plain text).
- Order details: delivery and billing address, phone number, order history.
- Photos you upload for custom canvas, mug or cushion orders.
- Product reviews you submit, together with a one-way hash of your IP address (used only to limit one review per product per visitor — we do not store your actual IP address for this).
- Messages you send us through our contact form.
- Your newsletter preference, if you opt in or out.
- Payment is handled entirely by Stripe — we never see or store your card number.
Why we use it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Processing and delivering your order | Performance of a contract with you |
| Producing your custom photo item | Performance of a contract with you |
| Keeping accounting and tax records | Legal obligation |
| Preventing fraud and abuse (e.g. review spam) | Legitimate interest |
| Sending you marketing emails | Your consent, which you can withdraw at any time |
Who we share data with
- Stripe — to process payments securely.
- Hostinger — our web hosting provider, which stores the site's data.
- Resend (Resend, Inc.) — our email delivery provider. It sends the emails our site generates on our behalf, as our data processor (see below).
- Bunny Fonts — loads our website fonts.
- OpenStreetMap — provides the map on our Contact page.
- Our delivery carriers — to deliver your order.
We do not sell your personal data to anyone.
Email delivery. The transactional emails our site sends to you (order confirmations, shipping and order status updates, password resets, email verification, and replies to messages sent through our contact form) are delivered by our email delivery provider, Resend (Resend, Inc.), acting on our behalf as our data processor. Resend processes your name, your email address and the content of the email (for example, your order summary) only in order to deliver that email, on our instructions. We send these emails from Resend's EU (Ireland) region.
International transfers
Stripe may process payment data outside the UK, including in the United States, under approved safeguards such as the UK-US Data Bridge or Standard Contractual Clauses / International Data Transfer Agreements.
How long we keep your data
- Order and accounting records: 6 years, as required by HMRC.
- Photos uploaded but never used in a completed order: automatically deleted after 30 days.
- Consent records (see our Cookie Policy): kept for 6 years, in case we need to show what you agreed to.
- Account data: kept while your account is active, or as needed to resolve a dispute.
Your rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you.
- Have inaccurate data corrected.
- Ask us to delete your data, where we're not required to keep it.
- Restrict or object to certain processing.
- Receive your data in a portable format.
- Withdraw consent (e.g. to marketing emails) at any time.
To exercise any of these rights, email [email protected].
Complaints
If you're unhappy with how we've handled your data, please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.
Other things to know
We don't use your data for any automated decision-making that has a legal or similarly significant effect on you. Our site is not directed at children, and we don't knowingly collect data from children. We may update this policy from time to time; the date at the top of this page shows when it was last changed.