Privacy Policy
Last updated: [CONFIRM date]
1. Who we are
Earl's Frames London ("we", "us", "our") is a bespoke picture-framing business operating as a sole trader, based in Peckham, London. We are the "data controller" responsible for your personal data.
- Trading name: Earl's Frames London
- Business address: [CONFIRM full geographic business address]
- Contact for privacy matters: [CONFIRM privacy/contact email]
- ICO registration number: [CONFIRM ICO registration number — see section 11]
2. The information we collect
- Account details — your name, email address, and password (passwords are handled and stored securely by our authentication provider; we never see them in plain text). If you sign in with Google, we receive your name and email from Google.
- Contact & delivery details — phone number and delivery address you provide for an order or save to your account.
- Images you upload — the photos or artwork you upload to the framing tool so we can produce your order.
- Order information — the items, specifications, and order history associated with your account or email.
- Payment information — card payments are processed by Stripe. We do not receive or store your full card details; we receive confirmation of payment only.
- Technical & usage data — with your consent, analytics data about how the site is used (see our Cookie Policy).
3. How we use your information, and our lawful basis
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| To create and manage your account | Performance of a contract |
| To process and deliver your orders | Performance of a contract |
| To take payment via Stripe | Performance of a contract |
| To respond to enquiries and provide support | Legitimate interests |
| To keep records for tax and accounting | Legal obligation |
| Analytics to improve the site | Consent |
4. Who we share your information with
We do not sell your personal data. We share it only with the service providers ("processors") that help us run the business:
| Provider | Purpose |
|---|---|
| Supabase | Database, account authentication, and secure storage of uploaded images |
| Stripe | Payment processing |
| Optional "Sign in with Google" | |
| Vercel | Website hosting |
We may also disclose information where required by law.
5. International transfers
Some of our providers may store or process data outside the UK. Where they do, we rely on appropriate safeguards (such as UK adequacy regulations or standard contractual clauses) to protect your data. [CONFIRM with each provider and a reviewer that suitable safeguards are in place]
6. How long we keep your information
- Order and transaction records — retained for [CONFIRM retention period, e.g. 6 years for tax/accounting].
- Account data — kept until you ask us to delete your account.
- Uploaded images — retained for [CONFIRM image retention period], then deleted.
7. Your rights
Under UK data protection law you have the right to access, correct, delete, restrict, or object to our use of your personal data, to data portability, and to withdraw consent at any time. To exercise any of these, contact us at [CONFIRM privacy/contact email]. We will respond within one month.
You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.
8. Cookies
We use cookies and similar storage as described in our Cookie Policy. Non-essential (analytics) cookies are only used with your consent.
9. How we protect your information
We use technical measures including encrypted connections, database access controls, time-limited signed links for image access, and two-factor authentication on our admin account. No system is completely secure, but we take reasonable steps to protect your data.
10. Children
This site is intended for adults and is not directed at children. We do not knowingly collect data from children.
11. Changes to this policy
We may update this policy from time to time. The "last updated" date above shows when it last changed.
12. Contact us
For any privacy question or request, contact us at [CONFIRM privacy/contact email].