Privacy Policy – Glena Art Studio

Last updated: May 2025

PLEASE READ THIS POLICY CAREFULLY BEFORE USING THIS WEBSITE

At Glena Art Studio Ltd (“Glena Art Studio”, “Glena Art”, “we”, or “us”), safeguarding your data, privacy, and financial details is of utmost importance.

This policy, together with our Terms and Conditions and any other documents referenced herein, explains how any personal data we collect from you – or that you provide to us while using our website (including when you sign up for our newsletter, make a purchase, or use our site’s features) – will be handled. Please review the following details to understand what information we collect, how we use it, and under what circumstances we might share it with third parties.

This website is not directed toward children, and we do not knowingly gather data concerning minors.

It is essential that you read this privacy policy along with any other privacy or fair processing notices we may issue on particular occasions when collecting or processing personal data about you, so you are fully informed about how and why your information is being used. This policy is intended to complement, not replace, any other privacy notices we may provide.

CONTROLLER

For the purposes of the retained EU law version of the General Data Protection Regulation ((EU) 2016/679) (“UK GDPR”) and the Data Protection Act 2018 (DPA 2018), the data controller is Glena Art Studio Ltd.

CONTACT DETAILS

If you have any questions about this Privacy Policy, including any requests to exercise your legal rights, please contact us via our contact page and state that your query is for the attention of the DPL.

You also have the right to file a complaint with the Information Commissioner’s Office (ICO), the UK data protection regulator (www.ico.org.uk). However, we encourage you to contact us first so that we can address any concerns.

THIRD-PARTY LINKS

Our website may include links to third-party sites, plug-ins, and applications (for example, Instagram, Facebook, Pinterest, and Stripe). Clicking on these links or enabling such connections might allow third parties to collect or share your data. We do not control these external sites and are not responsible for their privacy practices. When you navigate away from our website, we suggest reviewing the privacy policies of the sites you visit.

INFORMATION WE MAY COLLECT FROM YOU AND HOW WE COLLECT IT

“Personal data” refers to any information relating to an individual from which that individual can be identified, excluding data where the identity is removed (anonymous data).

We may collect, use, store, and transfer various types of personal data about you, which we categorize as follows:

Data You Provide Directly:
This includes any information submitted by you when you fill out forms on our website (www.glenaart.com, our “Site”) or communicate with us via phone, email, or other methods. Unless stated otherwise, references to the Site also include any Glena Art Studio mobile application (“App”) where available.
Examples include:
- Registration or account creation details when you sign up on our Site, subscribe to our services, contact third parties through our Site, report issues, or offer feedback.
- Contact Data: Such as billing and delivery addresses, email addresses, and telephone numbers.
- Identity Data: Such as your name, profile description, gender, photograph, date of birth, national insurance number, and copies of identification documents.
- Transaction Data: Details regarding purchases, payment information, and any transaction-related content linked to your account.
- Marketing and Communications Data: Your preferences regarding receiving marketing communications from us or third parties, and your communication settings.
Data Collected Automatically:
During each visit to our Site, we may automatically gather information using various technologies, including:
- Technical Data: This may include your IP address, login data, browser type and version, time zone, geographic location, browser plug-in details, operating system, and other technology on your device.
- Usage Data: Information regarding your interactions on our Site, such as pages viewed, clickstreams (including dates and times), search queries, page response times, download errors, and other site usage details.
Data Received from Other Sources:
We may receive additional information about you if you engage with our other websites or services. We also work closely with third parties (for instance, business partners, subcontractors for technical, payment, or delivery services, advertising networks, analytics providers, search information providers, and credit reference agencies) and public authorities, from which we may receive data.

We also compile and share aggregated data (statistical or demographic information) for any purpose. Aggregated data is derived from your personal data but does not, by itself, identify you. If aggregated data is combined with personal data to identify you, it will be treated as personal data and processed accordingly.

We do not collect any “Special Categories” of personal data (such as details about race, ethnicity, religious or philosophical beliefs, sexual orientation, political opinions, trade union membership, health information, or genetic/biometric data) nor any data concerning criminal convictions or offenses.

IF YOU FAIL TO PROVIDE PERSONAL DATA

If we are required by law or contractual terms to collect certain personal data and you do not provide it, we may be unable to fulfill our contractual obligations (for example, supplying goods or services). In such cases, we may need to cancel your order or service and will inform you accordingly.

COOKIES

Your browser can be set to reject some or all cookies or to alert you when a cookie is being sent. Please note that disabling cookies might affect your access to certain parts of our website.

For more detailed information on our use of cookies and their purposes, please review our Cookie Policy.

OUR LAWFUL BASIS FOR PROCESSING YOUR INFORMATION

Typically, we do not depend solely on your consent as the basis for processing your personal data, though we will request your consent before sending third-party direct marketing via email or text. You may withdraw your marketing consent at any time by contacting us.

In line with GDPR, we process your data based on the following grounds:

Contractual Necessity: To perform obligations arising from any contract with you.
Legal Compliance: To meet legal requirements that may compel us to process your data or disclose it to law enforcement or regulatory bodies.
Legitimate Interests: For purposes such as responding to queries, enhancing our website and user experience, and informing you about our services, provided these interests are not overridden by your rights.
Consent: In specific instances, where you have explicitly agreed to certain processing activities.

For example, if you have consented, we might share parts of your personal data (e.g., your first name, initial, and photograph) with a third party to complete a transaction or for marketing purposes.

THE PURPOSES FOR WHICH WE WILL USE YOUR PERSONAL DATA

We may process your personal data for various purposes. Below is an outline of the types of data processed and the legal basis for doing so:

Purpose of Processing	Type of Data	Legal Basis
To fulfill contractual obligations (including the Website Terms and Conditions and to provide requested information, products, or services)	Contact Data, Identity Data, Transaction Data	Performance of a Contract
To inform you about similar goods and services we offer	Contact Data	Legitimate Interest
To provide information about requested products or services	Contact Data	Consent
To notify you of changes to our services	Contact Data	Compliance with a Legal Obligation
To ensure our Site content displays optimally on your device	Technical Data, Usage Data	Legitimate Interest
To administer our Site and for internal operations (such as troubleshooting, analysis, testing, research, statistical, and survey purposes)	Technical Data, Usage Data	Legitimate Interest
To enhance our Site’s performance and user experience	Technical Data, Usage Data	Legitimate Interest
To enable interactive features when you choose to use them	Technical Data, Usage Data	Legitimate Interest
To maintain a secure Site environment	Technical Data, Usage Data	Legitimate Interest
To evaluate and deliver relevant advertising	Contact Data	Consent
To suggest products or services that might interest you or other users	Contact Data	Consent
To meet legal requirements for UK-based businesses	Contact Data, Business Information (including tax details)	Compliance with a Legal Obligation

MARKETING

We are committed to giving you choices regarding the use of your personal data, especially for marketing and advertising purposes. We maintain a privacy centre where you can review and adjust your personal data settings, as well as a marketing preference centre for managing the communications we send you.

PROMOTIONAL OFFERS FROM US

Using your Identity, Contact, Technical, Usage, and Profile Data, we may form an opinion of what products or services might interest you. You will receive marketing messages from us if you have requested information or made a purchase and have not opted out.

THIRD-PARTY MARKETING

We will obtain your explicit consent before sharing your personal data with any third party for marketing purposes.

OPTING OUT

At any time, you may instruct us or third parties to cease sending marketing communications by following the opt-out instructions in any message or by contacting us directly. Note that opting out will not affect data provided as part of a transaction or product/service purchase.

CHANGE OF PURPOSE

We will use your personal data only for the purposes for which it was originally collected, unless we reasonably determine that an alternative use is compatible with the original intent. Should you request an explanation on how new processing purposes align with the original purpose, please contact us. If a completely unrelated use becomes necessary, we will notify you and outline the legal basis for such processing. Please be aware that, under certain circumstances, we may process your personal data without your explicit knowledge or consent as required or permitted by law.

DISCLOSURE OF YOUR INFORMATION

Your personal data may be shared with internal parties within Glena Art Studio (including our subsidiaries) as defined in section 1159 of the UK Companies Act 2006.

We may also disclose your information to selected external parties, including:

Business partners, suppliers, and subcontractors necessary to fulfill contracts with you or with them.
Service providers acting as processors (located in the United Kingdom, USA, Malta, Ireland, Spain, Denmark, etc.) who deliver IT, system administration, payment, or delivery services.
Advertising networks and analytics or search engine providers who help improve and optimize our Site.
Professional advisers (such as lawyers, bankers, auditors, and insurers) in the UK and France, acting as processors or joint controllers, who supply consultancy, legal, insurance, or accounting services.
HM Revenue & Customs, regulators, and other authorities requiring the reporting of processing activities.

We may also disclose your personal data in specific situations:

In connection with a sale, transfer, merger, or acquisition, where your data might be transferred to the buyer or seller.
If Glena Art Studio, or substantially all of its assets, is acquired by a third party, your personal data may be among the assets transferred.
If our business undergoes a change, the new owners might use your data in accordance with this privacy policy.
If we are legally obligated to disclose your data to enforce our Terms and Conditions, to protect the rights, property, or safety of Glena Art Studio, our users, or others – including sharing data for fraud prevention or credit risk mitigation.

We require all third-party service providers to adhere to strict data security standards and to use your personal data solely for the purposes we instruct.

WHERE WE STORE YOUR PERSONAL DATA AND INTERNATIONAL TRANSFERS

The personal data we collect may be transferred to and stored in locations outside the UK or European Economic Area (EEA), and may be processed by personnel working outside these regions on behalf of us or our service providers. By providing your personal data, you consent to its transfer, storage, or processing in such locations. We take all reasonably necessary measures to ensure your data is handled securely and in accordance with this policy.

Whenever personal data is transferred outside the UK or EEA, or accessed by third parties in other jurisdictions, we ensure that an equivalent level of protection is provided by:

Transferring your data only to countries with adequate data protection laws.
Utilizing service providers who have implemented contractual clauses approved for use in the UK (e.g., Standard Contractual Clauses) to ensure equivalent data protection.

For more details about the safeguards in place, please contact us.

DATA SECURITY

All information you provide is stored on secure servers with appropriate safeguards to prevent accidental loss, unauthorized use, or disclosure. Access to your personal data is limited to employees, agents, contractors, and third parties who require it for legitimate business reasons and who are bound by confidentiality obligations.

We have established procedures to address any suspected data breaches and will promptly notify you and any relevant regulator should a breach occur that mandates notification.

If you have been given or have chosen a password for accessing certain parts of our Site, you are responsible for maintaining its confidentiality. Please do not share your password with anyone.

While we strive to protect your personal data, internet transmissions cannot be completely secure, so any data sent to our Site is at your own risk. Once received, we implement strict procedures and security measures to prevent unauthorized access.

We continuously train our staff about the importance of confidentiality and maintain physical, electronic, and procedural safeguards in line with legal requirements.

HOW LONG WE HOLD YOUR INFORMATION

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including for legal, accounting, or reporting obligations. In some cases, your data may be kept for longer if a complaint is lodged or if there is a reasonable prospect of litigation regarding our relationship with you.

Retention periods depend on factors such as the amount and sensitivity of data, the purposes for its retention, and the potential risk from unauthorized disclosure, as well as applicable legal or regulatory requirements.

You may request details of our retention policies by contacting us. In some cases, you can ask us to delete your data (see “Your Legal Rights” below). Additionally, for research or statistical purposes, we may anonymize your personal data, after which it will no longer be linked to you.

YOUR LEGAL RIGHTS

Under data protection laws, you have certain rights regarding the personal data we hold. We may require proof of your identity before processing any requests. Your rights include:

Right of Access: You may request a copy of the personal data we hold about you (a “data subject access request”) and verify our lawful processing. If we refuse your request, we will provide reasons.
Right of Correction: Should your data be inaccurate or incomplete, you have the right to request its rectification.
Right of Erasure: In certain circumstances, you may ask us to delete your personal data (for example, if it is no longer necessary for its original purpose or if processing is based solely on your consent).
Right to Object or Restrict Processing: You can object to our processing of your personal data, particularly if we rely on our legitimate interests, unless overriding interests justify the processing. You may also request that we restrict processing, such as during verification of data accuracy. In addition, you may ask us not to use your data for marketing purposes by selecting appropriate options on our forms.
Right of Data Portability: In certain cases, you have the right to receive your personal data in a structured, commonly used, and machine-readable format, or to have it transmitted directly to a third party. Please note that while we endeavor to accommodate such requests, technical limitations or requests involving data on others may restrict us.

To exercise these rights, please contact us.

Our Site may include links to partner networks, advertisers, and affiliates (including Stripe or other third-party payment providers). These external sites have their own privacy policies, and we are not responsible for their practices. Please review their policies before submitting personal data.

ACCESS TO INFORMATION

Depending on local laws, you might have the right to access information held about you. To confirm your identity and ensure secure access, we may ask for additional details. We strive to respond to legitimate requests within one month; however, complex or multiple requests may require additional time. Should this be the case, we will notify you and keep you informed. While access is generally free, we may impose a reasonable fee for requests that are unfounded, repetitive, or excessive.

RIGHT TO WITHDRAW CONSENT

If you have consented to our processing of your personal data for a specific purpose, you have the right to withdraw that consent at any time. Please note that withdrawing consent does not affect the lawfulness of processing conducted before withdrawal, and it may limit our ability to provide certain products or services. You can withdraw your consent by contacting us as specified below. Once your consent is withdrawn, we will no longer process your data for the previously agreed purpose, unless another legal basis applies.

COMPLAINTS

If you are dissatisfied with how your information is handled, please contact us using the details provided in the “Contact Details” section. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) via:

Telephone: 0303 123 11113
Website: https://ico.org.uk/concerns/
Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

For complaints related to our activities outside the UK, you may wish to contact your local supervisory authority. A list of authorities in the EEA is available online.

CHANGES TO OUR PRIVACY POLICY AND YOUR DUTY TO INFORM US OF CHANGES

We regularly review and update our privacy policy. It is important that the personal data we hold about you is accurate and up-to-date, so please inform us of any changes to your information during your relationship with us.

Any modifications to this privacy policy will be posted on this page and, if necessary, communicated to you via email. We recommend checking this page periodically for any updates.