Privacy Policy

This policy explains what personal data Mrs Penny Crichton-Seager, trading as Penny Crichton-Seager Art ("we", "us"), collects through pennyartist.com (the "Site"), why we collect it, and the choices and rights you have over it. We built the Site ourselves, host it ourselves, and don't run ads or tracking on it — this policy is written to reflect that in plain terms, not just to satisfy a checklist.

Effective date: 26 September 2026. Last updated: 26 September 2026.

Our commitments to you

We don't run analytics, tracking pixels, or advertising cookies of any kind.
We never sell your personal information, to anyone, for any reason.
Your card details go straight to Stripe — they never reach our servers.
We only email you about things you've actually done here (orders, your account) — never marketing lists.
The Site doesn't request camera, microphone, location, or any other device permission.
The Site isn't directed at, and we don't knowingly collect data from, children under 13.

1. Who we are

Mrs Penny Crichton-Seager, trading as Penny Crichton-Seager Art, of The Manse, Main Street, Kirk Yetholm, Kelso TD5 8PF, is the data controller for the personal information described in this policy. Penny Crichton-Seager Art operates as a sole trader — there is no separate registered company, company number, or VAT registration to disclose. If you have a question about your data or this policy, see "Contact us" below.

2. Information we collect

We only collect information you give us directly — by creating an account, placing an order, or contacting us. We don't buy or receive personal data about you from third parties.

Account information

If you create an account: your name, email address, and a password (which we store as a one-way cryptographic hash — we can't read it, and neither can anyone who gains access to our database).

Order and delivery information

When you place an order: billing and delivery name and address, phone number, and the order itself (what you bought, quantities, price, and order status). Guest checkout is available and only requires what's needed to fulfil that order.

Payment information

Payments are processed by Stripe. Your card number, expiry date, and security code are sent directly to Stripe and never touch our servers. We retain only the card brand, last four digits, expiry month/year, and a Stripe reference token — enough to show "Visa ending 4242" on your account, not enough to charge the card ourselves outside Stripe's systems.

Trade & wholesale accounts

If you apply for a trade or wholesale account: your business name and any other business details you provide as part of that application and approval process.

Technical and security information

To keep accounts secure, we record the IP address and timestamp of sign-ins to your account, and the number of failed login attempts (used to lock an account temporarily after repeated failures). Our web server also logs requests (IP address, browser user-agent, page requested, timestamp) for a short period, purely for security and troubleshooting — this is standard practice for any web server and isn't used to build a profile of you.

Correspondence

If you email us or use a contact form, we keep that correspondence (and whatever you choose to include in it) so we can respond and keep a record of the conversation.

3. Information we don't collect

To be specific, the Site does not use or request:

Analytics or usage-tracking scripts (no Google Analytics, no equivalents)
Advertising or retargeting pixels (no Meta/Facebook Pixel, no ad networks)
Cross-site or third-party tracking cookies
Camera or microphone access
Precise device location
Contacts, calendar, or file-system access
Biometric data
Full payment card numbers or security codes (Stripe handles these directly)

4. Cookies

The Site uses a small number of strictly necessary cookies to function — nothing more:

Session cookie — keeps you signed in and remembers your cart/checkout as you move between pages. Deleted when you close your browser.
“Remember me” cookie — only set if you tick “remember me” at login, so you don't have to sign in every visit. Persistent until you log out or clear cookies.

These are "strictly necessary" cookies under UK/EU cookie law — they don't require consent because the Site can't function without them, and we don't set any cookie for advertising, analytics, or tracking purposes. We don't use a cookie consent banner because we don't need to ask permission for cookies that fall within the strictly-necessary exemption.

5. How we use your information

We only use your information for the reasons we collected it. Under UK/EU GDPR, each use has a lawful basis:

Process and fulfil your order, handle returns — necessary to perform our contract with you
Create and maintain your account — necessary to perform our contract with you
Send order confirmations, shipping updates, password resets — necessary to perform our contract with you
Keep accounting and tax records of sales — legal obligation
Detect and prevent fraud, secure accounts against unauthorised access — legitimate interest (fraud prevention and security)
Respond to your enquiries and correspondence — legitimate interest (customer service) / contract
Review and approve trade/wholesale account applications — necessary to perform our contract with you, or steps taken at your request before entering one

Where we rely on legitimate interests, we've considered that our use is proportionate, expected, and doesn't override your own rights and freedoms. We do not use your information for automated decision-making or profiling that has a legal or similarly significant effect on you.

6. Who we share information with

We share personal information only with the service providers who need it to help us run the Site — never for their own marketing purposes, and never as a sale of your data:

Stripe — processes payments. See Stripe's privacy policy.
Our email delivery provider — sends transactional emails (order confirmations, shipping notices, password resets) on our behalf. It doesn't use your email address for its own purposes.
Delivery/postal carriers — receive the name, address, and phone number needed to deliver your order.

We may also disclose information where required by law, to enforce our terms, or to protect the rights, property, or safety of ourselves or others. We do not sell personal information, and we do not share it with third parties for their own advertising purposes.

7. International transfers

Some of the service providers listed above (for example, Stripe) are based in, or process data in, the United States. Where personal data is transferred outside the UK/EEA, we rely on the safeguards those providers have in place — such as Standard Contractual Clauses or an equivalent recognised transfer mechanism — to ensure your data continues to receive an appropriate level of protection.

8. How long we keep information

Order and transaction records: kept for as long as required by tax and accounting law (in the UK, currently 6 years from the end of the relevant tax year).
Account information: kept while your account is active. If you delete your account, we remove personal information from it except where we're required to retain order records as above.
Sign-in/security logs: kept briefly and rotated automatically — they exist for troubleshooting and abuse prevention, not long-term storage.
Correspondence: kept for a reasonable period to maintain a record of customer service history.

9. How we protect your information

The Site is served entirely over encrypted HTTPS. Passwords are stored as salted one-way hashes, never in plain text. Payment card handling is delegated entirely to Stripe, a PCI DSS Level 1 certified payment processor — we never see or store full card numbers or security codes. Access to the systems that run the Site is restricted to those who need it to operate the business.

10. Children's privacy

The Site is not directed at children, and we do not knowingly collect personal information from anyone under the age of 13. If you believe a child has provided us with personal information, please contact us and we'll delete it.

11. Your rights (UK/EU GDPR)

If you're in the UK or EU, data protection law gives you the following rights over your personal information. To exercise any of these, contact us — we'll respond within one month.

Access — a copy of the personal information we hold about you.
Rectification — correction of inaccurate or incomplete information.
Erasure — deletion of your information ("right to be forgotten"), subject to our legal obligation to retain certain order/tax records.
Restriction — limiting how we use your information in certain circumstances.
Portability — receiving your information in a portable format, or having it transferred directly to another provider.
Objection — objecting to processing based on legitimate interests.
Withdrawing consent — where we rely on consent, at any time, without affecting processing already carried out.

If you're unhappy with how we've handled your data, you also have the right to complain to your national supervisory authority. In the UK, that's the Information Commissioner's Office (ICO).

12. Your rights (California — CCPA)

The California Consumer Privacy Act (CCPA/CPRA) applies in full to larger businesses meeting specific revenue or data-volume thresholds, which a small studio like ours may not meet. Regardless, we extend the following to California residents as a matter of practice, not just where strictly required:

Right to know — what personal information we've collected, used, and shared (see "Information we collect" and "Who we share information with" above).
Right to delete — request deletion of your personal information, subject to legal retention requirements.
Right to correct — request correction of inaccurate personal information.
Right to opt out of sale or sharing — not applicable in practice, since we don't sell personal information or share it for cross-context behavioural advertising.
Non-discrimination — we won't deny you service, charge you a different price, or provide a different level of service for exercising any of these rights.

You can exercise these rights by contacting us directly, or through an authorised agent acting on your behalf.

13. CalOPPA disclosures

Do Not Track: the Site does not track visitors across third-party sites over time, so there is nothing for a "Do Not Track" browser signal to opt you out of. We do not currently respond differently to DNT signals because our practices don't distinguish based on them — we simply don't track.
Categories of personal information collected: see "Information we collect" above.
Third parties with access to personal information: see "Who we share information with" above.
Policy changes: see below.

14. Changes to this policy

If we make a material change to this policy, we'll update the "Last updated" date at the top and, where the change is significant, make it clear on the Site. We encourage you to review this page occasionally.

15. Contact us

Questions about this policy, or want to exercise any of the rights above? Email us at support@pennyartist.com, or write to us at The Manse, Main Street, Kirk Yetholm, Kelso TD5 8PF.