Privacy notice
Last updated: 17 October 2026
This notice explains how Oliver E. J. Arnold ("I", "me") looks after your personal information when you use this website, send an enquiry, buy something, commission work or subscribe to the newsletter. I am a sole trader based in the United Kingdom and I am the "controller" of your information under the UK GDPR and the Data Protection Act 2018.
You can contact me about anything in this notice through oejarnold@protonmail.com. My postal address is: available on request through the contact form.
The short version
- I collect only what I need to answer you, make and deliver your work, take payment and send the newsletter you asked for.
- I do not sell your information, and I do not run advertising trackers, Google Analytics or social media pixels on this site.
- This site sets no cookies. It uses a small amount of storage in your own browser, explained under "Cookies and browser storage" below.
- You can ask to see, correct, export or delete your information at any time.
What I collect, why, and my lawful basis
| What | Why I use it | Lawful basis |
|---|---|---|
| Contact and enquiry forms: your name, email address, the details of your request, any reference photographs or links you send, and your answers to form questions. | To reply to you, prepare a quote and discuss your project. | Taking steps at your request before a contract, and my legitimate interest in answering enquiries. |
| Commissions and orders: your name, delivery and billing address, email, phone number if you give one, order or commission details, payment confirmation and correspondence. | To make and deliver your work, take payment, send updates and keep records. | Performing our contract, and my legal obligation to keep accounting records. |
| Payments: payment is taken by Stripe. I receive confirmation of payment, your name, email, delivery address and the order details. I never see or store your full card number. | To take payment, issue receipts and handle refunds or disputes. | Performing our contract, and legal obligation. |
| Newsletter: your email address, the date you subscribed and, if you arrived from one of my profiles, which one. | To send the studio newsletter and the welcome offer. | Your consent. You can withdraw it at any time with the unsubscribe link in every email. |
| Where you found the site: if you arrive from one of my social media profiles, the platform name is remembered in your browser and attached to any form you send. | To learn which platforms bring in genuine enquiries so I can spend my time well. | My legitimate interest in understanding how people find the studio. It contains no information that identifies you on its own. |
| Visit statistics: page views, country, device type and referring site, collected by Cloudflare Web Analytics without cookies. | To see which pages are read and how the site performs. | My legitimate interest in running and improving the site. |
| Security logs: your IP address and request details are processed by Cloudflare, which hosts the site, to keep it available and protect it from abuse. | Security and reliable delivery of the site. | My legitimate interest in keeping the site safe. |
| Reference photographs of other people: if you send a photograph of someone else, I use it only to make your commission. | To draw the likeness you asked for. | Performing our contract. Please see "Photographs of other people" below. |
I do not make decisions about you by automated means, and I do not profile you.
Who else handles your information
I use a small number of carefully chosen services to run the studio. Each handles your information only on my behalf or for the purpose described, under its own privacy terms.
- Cloudflare, which hosts the site, provides security and delivers privacy-friendly visit statistics.
- Formspree, which receives what you type into the contact, commission and project forms and forwards it to my email.
- Buttondown, which stores newsletter subscribers and sends the newsletter and welcome email.
- Stripe, which takes card and wallet payments. Stripe is also an independent controller for its own fraud-prevention and legal duties.
- Couriers and postal services, which receive your name, address and phone number if needed, to deliver your order.
- My accountant and professional advisers, if needed, and public authorities where I am legally required to share information.
Some of these providers are based in, or process information in, the United States and other countries outside the UK. Where that happens, I rely on UK adequacy regulations, the UK extension to the EU–US Data Privacy Framework, or the UK International Data Transfer Addendum with standard contractual clauses, so your information keeps an equivalent level of protection.
How long I keep information
| Information | How long |
|---|---|
| Enquiries that do not go ahead | Up to 12 months after the last message, then deleted. |
| Commission and order records, invoices and correspondence | 6 years after the end of the tax year in which the work was completed, as required for tax and accounting. |
| Reference photographs | Deleted within 12 months of the commission being delivered, unless you ask me to keep them or delete them sooner. |
| Newsletter subscription | Until you unsubscribe. |
| Visit statistics | Aggregated and anonymous. Kept by Cloudflare for its standard retention period. |
Cookies and browser storage
This site sets no cookies. To work properly it saves a few small notes in your own browser's storage. They never leave your device unless stated, and you can clear them at any time in your browser settings.
| Name | What it does | How long |
|---|---|---|
| Saved items | Remembers the pieces you press "Save for later" on, so the Saved page works. Stays on your device only. | Until you remove them or clear storage. |
| Where you came from | Remembers the social profile you arrived from, added to forms you choose to send. | 90 days. |
| Welcome message and notice choices | Remembers that you closed the welcome message or the commission-status notice so I don't show it again. | Up to 30 days. |
Cloudflare Web Analytics does not use cookies or browser storage and does not track you across other sites. If you would rather not take part in the statistics, a browser or content blocker will prevent it.
Photographs of other people
If you send me a photograph of someone else, please make sure you have their permission, or are their parent or guardian, before doing so. I will not accept images that I believe were taken or shared without consent, and I will not use photographs of children for anything other than your commission. I show finished commissions in my portfolio only if you have agreed (see the commission terms).
Your rights
Under UK data protection law you can ask me to:
- tell you what information I hold about you and give you a copy;
- correct anything that is wrong or incomplete;
- delete your information, where I have no good reason to keep it;
- restrict or object to how I use it, including objecting to anything I do on the basis of legitimate interests;
- give you your information in a portable format; and
- stop sending you marketing at any time (use the unsubscribe link, or tell me).
Where I rely on consent, you can withdraw it whenever you like, without affecting anything done before.
To use any of these rights, contact me through oejarnold@protonmail.com. I will normally answer within one month and will not charge a fee unless a request is clearly unfounded or excessive. I may need to check your identity first.
If you are unhappy with how I have handled your information, please tell me first so I can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Children
This site is for adults and for children with a parent or guardian. I do not knowingly collect information from anyone under 13. If you think a child has sent me their details, please contact me and I will delete them.
Security
Pages are served over HTTPS with a strict content security policy, and the site's code is held in a private repository. No system is completely secure, but I choose services with strong security records and keep access to your information to what is necessary. If a breach affecting your information ever occurs, I will tell you and the ICO where the law requires.
Links to other sites
This site links to social media platforms and other sites I do not control. Their privacy practices are their own, so please read their notices before sharing information.
Changes to this notice
If I change how I use your information I will update this page and the date at the top. If a change is significant, I will tell newsletter subscribers by email.
