Privacy notice

Who is responsible

This website is run by Mugeesa, who is the controller of your personal information under UK data protection law (UK GDPR and the Data Protection Act 2018). You can get in touch about anything in this notice using the contact form.

What is collected and why

When you send a message

The contact form collects your name, email address and message, and the artwork you asked about if any. They are used only to read and reply to your message. The lawful basis is legitimate interests: responding to people who get in touch, including enquiries before a purchase. Messages are deleted after two years at the latest.

When you join the newsletter

The newsletter form collects your email address. It is used only to send you the newsletter, which may include a link to download a newsletter file. The lawful basis is your consent. A record of your consent is kept as proof: the wording you agreed to, when you agreed and confirmed, and a scrambled (one-way hashed) form of your IP address.

You can withdraw consent at any time using the unsubscribe link in every email. After you unsubscribe, a record that you did so is kept for up to two years, so you are not emailed again by mistake, and is then deleted. Sign-ups that are never confirmed are deleted within about nine days.

Security

To protect the forms from spam and abuse, a scrambled (hashed) form of your IP address is used to limit repeated attempts, and Cloudflare Turnstile checks that a person rather than a program is using the form. Raw IP addresses are not stored. The lawful basis is legitimate interests: keeping the website and your information secure.

Who processes it

Your information is handled by these service providers, under contracts that require them to protect it:

• Vercel: hosts the website.
• Supabase: stores the website’s data, in the London region.
• Resend: sends emails, including the newsletter.
• Cloudflare: provides the Turnstile spam check.

Some of these providers may process data in the United States. Where that happens, transfers are protected by the safeguards UK law requires, such as the UK Extension to the EU–US Data Privacy Framework or standard contractual clauses. Your information is never sold or used for advertising.

Cookies

The public website sets no tracking or advertising cookies and uses no analytics. The only cookies are those needed for the artist to sign in to the site’s private admin area, and any strictly necessary cookie Cloudflare Turnstile uses to tell people from bots.

Your rights

You have the right to ask for a copy of your information, to have it corrected or deleted, to restrict or object to its use, and to withdraw consent at any time. To make a request, use the contact form. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

Changes

If this notice changes, the date at the top is updated. Significant changes affecting subscribers are announced by email.