Privacy Policy
This Privacy Policy explains how Albalightstudio Ltd collects, uses, stores, shares and protects personal information when you visit albalightstudio.com, contact the studio, request a quotation, commission artwork, book a workshop, attend an event, subscribe to communications or otherwise interact with us. It is intended to comply with the UK General Data Protection Regulation, the Data Protection Act 2018 and, where relevant, the Privacy and Electronic Communications Regulations 2003.
1. Controller and contact details
The controller responsible for personal data processed through this website and our studio operations is Albalightstudio Ltd, located at 38 Charlotte Road, London EC2A 3PB, United Kingdom. Questions, requests or complaints concerning privacy may be sent to info@albalightstudio.com or by post to the address above.
2. Personal data we may collect
Depending on how you interact with us, we may process identification and contact data such as your name, postal address, email address and telephone number; enquiry and correspondence data; commission or booking details; payment and transaction records; workshop attendance information; preferences and feedback; website technical data such as IP address, browser type, device information, approximate location, referring pages and interaction logs; and marketing preferences or consent records.
Where an artwork commission includes information about another identifiable person, you must have authority to provide that information and should avoid supplying unnecessary sensitive information. We do not intentionally request special-category data. If it is voluntarily included in correspondence, we will process it only where necessary and lawful, and we may ask you to remove or minimise it.
3. How we collect personal data
We collect information directly from you when you complete a form, send an email, call us, visit the studio, place an order, request a commission, register for an event or communicate through another channel. Technical information may be collected automatically by the browser, server logs and essential website technologies. We may also receive information from payment providers, delivery partners, professional advisers, event partners or publicly available sources where this is necessary for a legitimate business purpose.
4. Purposes and lawful bases
We process personal data only when a lawful basis applies. Contractual necessity is used to respond to pre-contract enquiries, prepare quotations, administer bookings, create commissioned work, arrange delivery and manage payment. Legitimate interests may support website security, fraud prevention, service improvement, customer relationship management, record-keeping and the defence of legal claims, provided those interests are not overridden by your rights. Legal obligation applies to accounting, tax, consumer protection and regulatory duties. Consent is used where required for optional marketing, non-essential cookies or the publication of identifiable testimonials and images.
We may use your data to provide requested services; verify and manage bookings; communicate about progress, availability or changes; process payments and refunds; deliver artwork; manage events and workshops; maintain business records; respond to complaints; protect the website and studio; improve our services; and send marketing only where permitted. We do not use personal data for solely automated decisions that produce legal or similarly significant effects.
5. Marketing communications
We will send electronic marketing only where you have consented or where the law permits communication to an existing customer about similar services and you were given a clear opportunity to opt out. Every marketing message will include an unsubscribe method. You may withdraw consent or object to direct marketing at any time by contacting us. Withdrawal does not affect processing that was lawful before withdrawal.
6. Sharing and service providers
We may share limited personal data with service providers that support hosting, email, IT security, payment processing, accounting, professional advice, printing, framing, event administration, delivery or customer support. These providers may process information only for defined purposes and under appropriate contractual safeguards. We may disclose data when required by law, court order or regulatory request; to protect rights, safety or property; or in connection with a genuine business restructuring, subject to confidentiality and data-protection requirements.
We do not sell personal data. We do not permit independent advertising networks to use information collected through this site for behavioural advertising.
7. International transfers
Some carefully selected suppliers may process data outside the United Kingdom. When a restricted transfer occurs, we use a lawful transfer mechanism, such as an adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another mechanism recognised by UK law. We also assess supplementary technical and organisational measures where appropriate.
8. Retention
We retain personal data only for as long as reasonably necessary for the purpose collected, including legal, accounting and dispute-resolution requirements. General enquiries are ordinarily retained for up to 24 months after the last meaningful contact. Customer, commission and transaction records may be retained for up to seven years after completion to meet tax and contractual requirements. Unsuccessful quotation data is generally retained for up to 24 months. Marketing consent records are kept while consent remains active and for a reasonable period afterwards to demonstrate compliance. Security logs are retained for a shorter period unless investigation requires longer storage.
9. Security
We use proportionate technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, alteration, disclosure or destruction. Measures may include access controls, least-privilege permissions, secure configuration, software updates, backups, staff confidentiality obligations and incident-response procedures. No internet transmission is completely risk-free, so you should avoid sending unnecessary confidential information through ordinary email.
10. Your data-protection rights
Subject to statutory conditions and exemptions, you may request access to your personal data; correction of inaccurate or incomplete data; erasure; restriction of processing; portability of data you provided; and objection to processing based on legitimate interests or for direct marketing. Where processing relies on consent, you may withdraw it at any time. You may also ask for information about safeguards used for international transfers.
Requests should be sent to info@albalightstudio.com. We may request proportionate identification before disclosing information. We normally respond within one month, although complex or multiple requests may lawfully take longer. We do not usually charge a fee, but a reasonable fee or refusal may apply to manifestly unfounded or excessive requests.
11. Complaints
Please contact us first so that we can investigate. You also have the right to complain to the Information Commissioner’s Office, the United Kingdom supervisory authority for data protection. Current contact and complaint information is available from the ICO’s official website. Your right to complain is not affected by any attempt to resolve the issue directly with us.
12. Children
The website is not directed at children under 13. Workshop participation by minors must be arranged by a parent, guardian or authorised adult. We do not knowingly collect children’s personal data through the website without appropriate adult involvement. Contact us if you believe a child has provided information improperly so that we can investigate and delete it where required.
13. Third-party links and embedded services
The website may contain links to third-party sites or an embedded mapping service. Those organisations act under their own privacy notices and may collect technical data when their service is loaded or opened. We are not responsible for their independent processing. Review the relevant third-party privacy information before providing data.
14. Cookies and similar technologies
Details of cookies, local storage and comparable technologies are set out in our Cookie Policy. Where the law requires consent for a non-essential technology, it will not be used unless valid consent has been obtained. You may withdraw consent at any time through the available preference mechanism or browser settings.
15. Changes to this policy
We may update this Privacy Policy to reflect legal, technical or operational changes. The revised version will be published on this page with a new “last updated” date. Material changes may also be communicated directly where appropriate and where we hold suitable contact information.