Privacy policy

1. Who controls your data

Voll Studios Ltd, which operates ArtSource, is the data controller for the personal data described in this notice . For any data request, email hello@artsource.store.

2. What we collect

To fulfil your order we collect your name, shipping address and email address. Payment is handled entirely by Stripe; we never see or store your full card details on our servers.

When you first visit, we estimate your country to show prices in your local currency. This normally uses a country code our hosting provider derives from your connection; only if that is unavailable is your IP address sent once to a geolocation service (see section 3) to estimate the country. We do not store your IP address; the country estimate is kept in a strictly-necessary cookie (see section 8).

If you contact us through the trade enquiry form, we collect the company name, your name, email and any message you include, solely to reply to your enquiry.

3. Who we share it with (processors)

We share the minimum data needed with the partners who help us run the shop:

• Stripe— processes your payment.
• Prodigi and Gelato — print and ship your order (they receive your name and shipping address).
• ipwho.is— a fallback geolocation service used only when our hosting provider cannot supply your country. When used, it receives your IP address once and returns only a country code.
• Telegram— we receive an internal notification (via Telegram) when you place an order or submit a trade enquiry, so a person can action it. It carries your name, destination or company, and order or enquiry details.

These processors handle your data under their own terms and applicable data-protection law .

4. Why we use it (lawful bases)

• Performance of a contract — to take payment and fulfil your order.
• Legal obligation— to keep accounting and tax records.
• Legitimate interests — to prevent fraud and protect our business .

5. How long we keep it

We keep order records for 7 years to meet UK tax and accounting requirements . After that, records are deleted or anonymised.

6. Your rights

Under UK GDPR you have the right to access, rectify, erase and port your data, and to object to or restrict certain processing . To exercise any of these, email hello@artsource.store. You also have the right to complain to the UK Information Commissioner’s Office (ICO).

7. International transfers

Some of our processors are based outside the UK, so fulfilling your order can involve transferring your personal data abroad. Stripe processes payments partly in the United States; ipwho.is may process your IP address outside the UK. Where data leaves the UK, it is protected by an approved safeguard, the UK International Data Transfer Agreement or the EU Standard Contractual Clauses with the UK Addendum, so your data keeps an equivalent level of protection . Prodigi and Gelato fulfil within the UK and EU.

8. Cookies

We use only strictly-necessary cookies, so no consent banner is required. We do not use any analytics, advertising or tracking cookies.

• Region cookie— remembers your country so prices stay in your local currency. Set by us, expires after a year.
• Stripe— sets cookies during checkout to process your payment securely and prevent fraud. These are required for payment to work.

9. Children

ArtSource is not directed at children. We do not knowingly collect personal data from anyone under 16.