Privacy Policy

A legal disclaimer

Last updated: [26/09/2026]

Nicky Carole Artwork respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how we collect, use, store, disclose, and protect personal information when you visit or use [www.nickycaroleartwork.co.uk], purchase artwork, contact us, subscribe to our mailing list, request a commission, or otherwise interact with Nicky Carole Artwork.

This Privacy Policy is intended to provide information relevant to individuals whose personal information is protected under applicable data protection laws, including, where applicable, the UK General Data Protection Regulation (UK GDPR), EU General Data Protection Regulation (EU GDPR), California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and Brazil's Lei Geral de Proteção de Dados (LGPD).

Please read this Privacy Policy carefully.

Who Are We?

The data controller/business responsible for your personal information is:

Nicky Carole Artwork
Owner: [Nicola Cruzan]
Business address: [Hazeldene, Chilsworthy, Cornwall]
Email: [enquiries@nickycaroleartwork.co.uk]
Website: [www.nickycaroleartwork.co.uk]

If you have questions about this Privacy Policy or how we handle your personal information, please contact us using the details above.

Personal Information We Collect

Depending on how you interact with our website and business, we may collect the following categories of personal information:

Information you provide to us

This may include:

Your name
Email address
Postal/billing/shipping address
Telephone number
Information provided when you contact us
Information relating to artwork purchases
Commission or bespoke artwork requirements
Messages, enquiries, feedback, or correspondence
Information you provide when subscribing to our mailing list
Any other information you voluntarily provide to us

Please do not provide sensitive personal information unless we specifically request it and there is a lawful reason for us to process it.

Payment information

If you purchase artwork or services from us, payments may be processed by a third-party payment provider such as [Stripe/PayPal/Shopify/Square].

We generally do not receive or store your complete payment-card number. Payment information is processed by the relevant payment provider in accordance with its own privacy policy and security practices.

Automatically collected information

When you visit our website, certain technical information may be collected automatically, depending on the website technology and cookies we use. This may include:

IP address
Browser type and version
Device type
Operating system
Approximate location derived from IP address
Pages visited
Referring website
Date and time of visits
Website interaction information
Cookie and similar technology information

We only use non-essential cookies and similar technologies where required consent has been obtained.

How We Use Your Personal Information

We may use personal information for the following purposes:

To provide, sell, and deliver artwork and related services
To process and fulfil orders
To communicate with you about your purchases or enquiries
To respond to customer-service requests
To manage commissions and bespoke artwork requests
To process payments
To send order confirmations and other service-related communications
To send marketing communications where permitted by law and, where required, with your consent
To maintain and improve our website
To understand how visitors use our website
To prevent fraud, abuse, and security incidents
To maintain business and financial records
To comply with legal and regulatory obligations
To establish, exercise, or defend legal claims
To protect the rights, property, and safety of our business, customers, and others

We will not use your personal information for purposes that are incompatible with the purposes described in this Privacy Policy unless we have a lawful basis to do so and provide any additional information required by applicable law.

Legal Bases for Processing — GDPR

Depending on how you interact with our website and business, we may collect the following categories of personal information:

Information you provide to us

This may include:

Your name
Email address
Postal/billing/shipping address
Telephone number
Information provided when you contact us
Information relating to artwork purchases
Commission or bespoke artwork requirements
Messages, enquiries, feedback, or correspondence
Information you provide when subscribing to our mailing list
Any other information you voluntarily provide to us

Please do not provide sensitive personal information unless we specifically request it and there is a lawful reason for us to process it.

Marketing Communications

If you subscribe to our mailing list, we may use your name and email address to send you information about:

New artwork
Exhibitions or events
Commissions
Studio news
Products or services
Special offers
Other news relating to Nicky Carole Artwork

You can unsubscribe from marketing emails at any time by clicking the unsubscribe link in the relevant email or by contacting us at [enquiries@nickycaroleartwork.co.uk].

We will not send marketing communications where doing so would breach applicable law.

Cookies and Similar Technologies

Our website may use cookies and similar technologies.

Cookies may be used for purposes such as:

Operating essential website functions
Remembering preferences
Security
Understanding website traffic and usage
Measuring the effectiveness of our website
Marketing and advertising, where applicable

Where applicable law requires consent for non-essential cookies, we will ask for your consent before placing or using those cookies.

You can manage cookies through our cookie-consent tool and/or your browser settings.

For more information, please see our Cookie Policy.

Analytics

We may use analytics services such as [Google Analytics] to understand how visitors use our website.

Where applicable, analytics cookies or similar technologies will only be used with your consent.

Analytics providers may process information such as IP address, device information, browser information, pages visited, and interactions with our website.

Who We Share Personal Information With

We may share personal information with trusted third parties where reasonably necessary to operate our business and provide our services.

These may include:

Website hosting providers
E-commerce platforms
Payment processors
Delivery and postal providers
Email and mailing-list providers
Website analytics providers
IT and technical service providers
Professional advisers, such as accountants or legal advisers
Government authorities, regulators, courts, or law-enforcement bodies where legally required

Examples of service providers we currently use are:

Website platform: [WIX]
Payment provider: [N/A]
Email marketing provider: [N/A]
Analytics provider: [Google]
Delivery providers: [N/A]

We do not sell your personal information in the ordinary meaning of the term “sell”.

However, certain disclosures of personal information to third parties for advertising or cross-context behavioural advertising may be treated as a “sale” or “sharing” under California law. If this applies to our business, we will provide the rights and controls required by the CCPA/CPRA.

International Transfers

Some of our service providers may process personal information outside the country in which you live.

Where personal information is transferred internationally, we will take appropriate steps required by applicable data protection law to protect that information.

For individuals protected by the GDPR or UK GDPR, this may include an adequacy decision or appropriate safeguards such as applicable standard contractual clauses.

For individuals protected by the LGPD, international transfers will be carried out using a mechanism permitted under Brazilian law and applicable ANPD regulations.

Brazil's ANPD has specific rules governing international transfers, including adequacy decisions and contractual safeguards. Serviços e Informações do Brasil+1

Where required, further information about international transfers and applicable safeguards can be requested by contacting us.

How Long We Keep Personal Information

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including where necessary to:

Provide products or services
Maintain business and transaction records
Comply with legal, tax, and accounting requirements
Resolve disputes
Establish, exercise, or defend legal claims
Prevent fraud or misuse
Maintain appropriate business records

Retention periods may vary depending on the type of information and the purpose for which it was collected.

When personal information is no longer required, we will securely delete, anonymise, or otherwise dispose of it in accordance with applicable law.

How We Protect Your Information

We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration, disclosure, or destruction.

These measures may include:

Secure website connections
Access controls
Password protection
Limiting access to personal information to people who need it
Using reputable third-party service providers
Keeping software and systems appropriately maintained
Secure deletion or disposal of information when it is no longer required

No internet transmission or electronic storage system can be guaranteed to be completely secure.

Your GDPR and UK GDPR Rights

If the GDPR or UK GDPR applies to you, you may have the following rights, subject to applicable legal conditions and exemptions:

Right of access: You can request a copy of the personal information we hold about you.
Right to rectification: You can ask us to correct inaccurate or incomplete information.
Right to erasure: You can ask us to delete your personal information in certain circumstances.
Right to restriction: You can ask us to restrict processing in certain circumstances.
Right to data portability: In certain circumstances, you can request your personal information in a structured, commonly used, machine-readable format.
Right to object: You may object to certain processing, including processing based on legitimate interests and, where applicable, direct marketing.
Right to withdraw consent: Where processing is based on consent, you may withdraw your consent at any time.
Rights relating to automated decision-making: Where applicable, you may have rights concerning certain solely automated decisions.

Your California Privacy Rights — CCPA/CPRA

The CCPA requires covered businesses to provide mechanisms for exercising applicable rights and generally prohibits discriminatory treatment for exercising those rights. California Privacy Protection Agency

How California residents can exercise their rights

You may submit a privacy request by:

Email: [enquiries@nickycaroleartwork.co.uk]
We may need to verify your identity before completing certain requests. We will only request information reasonably necessary to verify your identity and protect against fraudulent requests.

We will respond within the time period required by applicable law.

If we sell or share personal information as those terms are defined under the CCPA, we will provide a “Your Privacy Choices” or equivalent mechanism allowing California residents to exercise applicable opt-out rights.

The CCPA also requires a Notice at Collection at or before the point where covered personal information is collected. California Privacy Protection Agency+1

Your Rights Under Brazil's LGPD

If Brazil's LGPD applies to our processing of your personal information, you may have rights including:

Confirmation that your personal information is being processed
Access to your personal information
Correction of incomplete, inaccurate, or outdated information
Anonymisation, blocking, or deletion of unnecessary or excessive information or information processed unlawfully
Data portability, subject to applicable regulations and commercial/industrial secrecy
Deletion of personal information processed on the basis of consent, subject to legal exceptions
Information about public and private entities with which we have shared your information
Information about the possibility of refusing consent and the consequences of doing so, where consent is requested
Withdrawal of consent
Review of certain automated decisions, where applicable
Other rights provided by applicable Brazilian data protection law

Requests may be submitted using:

Email: [enquiries@nickycaroleartwork.co.uk]

Brazil's ANPD identifies rights such as access, correction, deletion, portability, and information about data sharing as part of the rights available to data subjects under the LGPD. Serviços e Informações do Brasil

Children's Privacy

Our website is not intentionally directed toward children under the age of18 and we do not knowingly collect personal information from children without appropriate legal authorisation.

If you believe a child has provided us with personal information, please contact us so that we can take appropriate steps to delete it where required.

A legal disclaimer

Last updated: [26/09/2026]

Nicky Carole Artwork respects your privacy and is committed to protecting your personal information.

Please read this Privacy Policy carefully.

Who Are We?

The data controller/business responsible for your personal information is:

Nicky Carole Artwork
Owner: [Nicola Cruzan]
Business address: [Hazeldene, Chilsworthy, Cornwall]
Email: [enquiries@nickycaroleartwork.co.uk]
Website: [www.nickycaroleartwork.co.uk]

If you have questions about this Privacy Policy or how we handle your personal information, please contact us using the details above.

Personal Information We Collect

Depending on how you interact with our website and business, we may collect the following categories of personal information:

Information you provide to us

This may include:

Your name
Email address
Postal/billing/shipping address
Telephone number
Information provided when you contact us
Information relating to artwork purchases
Commission or bespoke artwork requirements
Messages, enquiries, feedback, or correspondence
Information you provide when subscribing to our mailing list
Any other information you voluntarily provide to us

Please do not provide sensitive personal information unless we specifically request it and there is a lawful reason for us to process it.

Payment information

If you purchase artwork or services from us, payments may be processed by a third-party payment provider such as [Stripe/PayPal/Shopify/Square].

Automatically collected information

When you visit our website, certain technical information may be collected automatically, depending on the website technology and cookies we use. This may include:

IP address
Browser type and version
Device type
Operating system
Approximate location derived from IP address
Pages visited
Referring website
Date and time of visits
Website interaction information
Cookie and similar technology information

We only use non-essential cookies and similar technologies where required consent has been obtained.

How We Use Your Personal Information

We may use personal information for the following purposes:

To provide, sell, and deliver artwork and related services
To process and fulfil orders
To communicate with you about your purchases or enquiries
To respond to customer-service requests
To manage commissions and bespoke artwork requests
To process payments
To send order confirmations and other service-related communications
To send marketing communications where permitted by law and, where required, with your consent
To maintain and improve our website
To understand how visitors use our website
To prevent fraud, abuse, and security incidents
To maintain business and financial records
To comply with legal and regulatory obligations
To establish, exercise, or defend legal claims
To protect the rights, property, and safety of our business, customers, and others

Legal Bases for Processing — GDPR

Depending on how you interact with our website and business, we may collect the following categories of personal information:

Information you provide to us

This may include:

Your name
Email address
Postal/billing/shipping address
Telephone number
Information provided when you contact us
Information relating to artwork purchases
Commission or bespoke artwork requirements
Messages, enquiries, feedback, or correspondence
Information you provide when subscribing to our mailing list
Any other information you voluntarily provide to us

Please do not provide sensitive personal information unless we specifically request it and there is a lawful reason for us to process it.

Marketing Communications

If you subscribe to our mailing list, we may use your name and email address to send you information about:

New artwork
Exhibitions or events
Commissions
Studio news
Products or services
Special offers
Other news relating to Nicky Carole Artwork

You can unsubscribe from marketing emails at any time by clicking the unsubscribe link in the relevant email or by contacting us at [enquiries@nickycaroleartwork.co.uk].

We will not send marketing communications where doing so would breach applicable law.

Cookies and Similar Technologies

Our website may use cookies and similar technologies.

Cookies may be used for purposes such as:

Operating essential website functions
Remembering preferences
Security
Understanding website traffic and usage
Measuring the effectiveness of our website
Marketing and advertising, where applicable

Where applicable law requires consent for non-essential cookies, we will ask for your consent before placing or using those cookies.

You can manage cookies through our cookie-consent tool and/or your browser settings.

For more information, please see our Cookie Policy.

Analytics

We may use analytics services such as [Google Analytics] to understand how visitors use our website.

Where applicable, analytics cookies or similar technologies will only be used with your consent.

Analytics providers may process information such as IP address, device information, browser information, pages visited, and interactions with our website.

Who We Share Personal Information With

We may share personal information with trusted third parties where reasonably necessary to operate our business and provide our services.

These may include:

Website hosting providers
E-commerce platforms
Payment processors
Delivery and postal providers
Email and mailing-list providers
Website analytics providers
IT and technical service providers
Professional advisers, such as accountants or legal advisers
Government authorities, regulators, courts, or law-enforcement bodies where legally required

Examples of service providers we currently use are:

Website platform: [WIX]
Payment provider: [N/A]
Email marketing provider: [N/A]
Analytics provider: [Google]
Delivery providers: [N/A]

We do not sell your personal information in the ordinary meaning of the term “sell”.

International Transfers

Some of our service providers may process personal information outside the country in which you live.

Where personal information is transferred internationally, we will take appropriate steps required by applicable data protection law to protect that information.

For individuals protected by the GDPR or UK GDPR, this may include an adequacy decision or appropriate safeguards such as applicable standard contractual clauses.

For individuals protected by the LGPD, international transfers will be carried out using a mechanism permitted under Brazilian law and applicable ANPD regulations.

Brazil's ANPD has specific rules governing international transfers, including adequacy decisions and contractual safeguards. Serviços e Informações do Brasil+1

Where required, further information about international transfers and applicable safeguards can be requested by contacting us.

How Long We Keep Personal Information

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including where necessary to:

Provide products or services
Maintain business and transaction records
Comply with legal, tax, and accounting requirements
Resolve disputes
Establish, exercise, or defend legal claims
Prevent fraud or misuse
Maintain appropriate business records

Retention periods may vary depending on the type of information and the purpose for which it was collected.

When personal information is no longer required, we will securely delete, anonymise, or otherwise dispose of it in accordance with applicable law.

How We Protect Your Information

We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration, disclosure, or destruction.

These measures may include:

Secure website connections
Access controls
Password protection
Limiting access to personal information to people who need it
Using reputable third-party service providers
Keeping software and systems appropriately maintained
Secure deletion or disposal of information when it is no longer required

No internet transmission or electronic storage system can be guaranteed to be completely secure.

Your GDPR and UK GDPR Rights

If the GDPR or UK GDPR applies to you, you may have the following rights, subject to applicable legal conditions and exemptions:

Right of access: You can request a copy of the personal information we hold about you.
Right to rectification: You can ask us to correct inaccurate or incomplete information.
Right to erasure: You can ask us to delete your personal information in certain circumstances.
Right to restriction: You can ask us to restrict processing in certain circumstances.
Right to data portability: In certain circumstances, you can request your personal information in a structured, commonly used, machine-readable format.
Right to object: You may object to certain processing, including processing based on legitimate interests and, where applicable, direct marketing.
Right to withdraw consent: Where processing is based on consent, you may withdraw your consent at any time.
Rights relating to automated decision-making: Where applicable, you may have rights concerning certain solely automated decisions.

Your California Privacy Rights — CCPA/CPRA

How California residents can exercise their rights

You may submit a privacy request by:

We will respond within the time period required by applicable law.

The CCPA also requires a Notice at Collection at or before the point where covered personal information is collected. California Privacy Protection Agency+1

Your Rights Under Brazil's LGPD

If Brazil's LGPD applies to our processing of your personal information, you may have rights including:

Confirmation that your personal information is being processed
Access to your personal information
Correction of incomplete, inaccurate, or outdated information
Anonymisation, blocking, or deletion of unnecessary or excessive information or information processed unlawfully
Data portability, subject to applicable regulations and commercial/industrial secrecy
Deletion of personal information processed on the basis of consent, subject to legal exceptions
Information about public and private entities with which we have shared your information
Information about the possibility of refusing consent and the consequences of doing so, where consent is requested
Withdrawal of consent
Review of certain automated decisions, where applicable
Other rights provided by applicable Brazilian data protection law

Requests may be submitted using:

Email: [enquiries@nickycaroleartwork.co.uk]

Children's Privacy

Our website is not intentionally directed toward children under the age of18 and we do not knowingly collect personal information from children without appropriate legal authorisation.

If you believe a child has provided us with personal information, please contact us so that we can take appropriate steps to delete it where required.

Third-Party Websites and Services

Our website may contain links to third-party websites, social-media platforms, marketplaces, payment services, or other external services.

We are not responsible for the privacy practices, content, or security of third-party websites.

We encourage you to read the privacy policies of third-party services before providing them with personal information.

Third-Party Websites and Services

Our website may contain links to third-party websites, social-media platforms, marketplaces, payment services, or other external services.

We are not responsible for the privacy practices, content, or security of third-party websites.

We encourage you to read the privacy policies of third-party services before providing them with personal information.

Social Media

We may operate social-media profiles or include social-media features on our website.

If you interact with these features, the relevant social-media provider may collect information about you in accordance with its own privacy policy.

Your interactions with third-party social-media services are governed by the privacy terms of those services.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our business, website, services, technology, or applicable legal requirements.

When we make significant changes, we will update the “Last updated” date at the top of this Privacy Policy and, where required, provide additional notice.

We recommend checking this page periodically for the latest version.

How to Contact Us

If you have questions about this Privacy Policy, want to exercise a privacy right, or have a concern about how we use your personal information, please contact:

Nicky Carole Artwork
Email: [enquiries@nickycaroleartwork.co.uk]
Address: [Hazeldene, Chilsworthy, Cornwall UK PL18 9PB]
Website: [www.nickycaroleartwork.co.uk]

If you are located in the UK and are dissatisfied with how we have handled your personal information, you may also have the right to complain to the Information Commissioner's Office (ICO).

If you are located in the EU, you may have the right to lodge a complaint with the data protection supervisory authority in your country.

If you are located in Brazil, you may have rights to contact or petition the Autoridade Nacional de Proteção de Dados (ANPD) as provided by applicable law.

Data Protection Contact

For privacy and data-protection enquiries, please contact:

Privacy contact: [Nicola Cruzan]
Email: [enquiries@nickycaroleartwork.co.uk