At Shamsu.art, we are committed to protecting your personal information and handling it responsibly in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

When you contact us, place an order, request a commission, subscribe to our newsletter or complete a form on our website, we may collect personal information that you voluntarily provide. This may include your name, email address, telephone number, billing address and order details. We only collect information that is necessary to provide our services, respond to enquiries or send marketing communications where you have given consent.

When you visit shamsu.art, certain technical information is collected automatically. This may include your IP address, browser type, device information, pages visited, time spent on pages and general browsing behaviour. This data is used to improve website performance, security and user experience.

Our website is hosted by Squarespace, which processes technical data such as IP addresses and usage information to provide hosting, analytics and security services. Squarespace acts as a data processor on our behalf.

We use Stripe to process online payments securely. When you purchase through our website, your payment details are processed directly by Stripe. We do not store or have access to your full card details. Stripe processes payment information in accordance with its own privacy policy and maintains PCI-DSS security compliance.

We may also accept payment via direct bank transfer. Where bank transfer is used, payment processing is handled by the relevant financial institutions. We retain transaction records as required for accounting, tax and legal obligations.

We use your personal information to respond to enquiries, manage orders and commissions, provide customer support, deliver purchased artwork and send marketing communications where you have opted in. Marketing communications may include updates about new artwork, personalised commissions, workshops, exhibitions and special offers. You may unsubscribe from marketing emails at any time by clicking the unsubscribe link in our emails or by contacting us directly.

We do not sell, rent or trade your personal data to third parties. Personal data is only shared with trusted service providers where necessary to operate our website and business, including hosting providers, payment processors and secure communication platforms. These providers are required to process data securely and only in accordance with applicable data protection laws.

Our website uses cookies to ensure proper functionality and to analyse visitor activity. Non-essential cookies are used only where you have provided consent via our cookie banner. You can manage cookie preferences through your browser settings.

We rely on lawful bases under UK data protection law to process your personal information. These include your consent (for marketing communications), performance of a contract (where you purchase artwork or request services), compliance with legal obligations (including financial record keeping) and our legitimate interests in operating and improving our business responsibly.

We retain order and transaction records for up to six years in accordance with UK accounting and tax requirements. Personal data collected for marketing purposes is retained until you withdraw consent.

We take appropriate technical and organisational measures to safeguard your personal information against unauthorised access, loss, misuse or disclosure.

Under UK data protection law, you have the right to request access to the personal data we hold about you, request correction of inaccurate information, request deletion of your data, object to processing for marketing purposes, request restriction of processing in certain circumstances and withdraw consent at any time. To exercise your rights, please contact us at artspaceshams@gmail.com.

If you are not satisfied with how your data is handled, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at www.ico.org.uk.

[January 2026]