Privacy Policy

Effective Date: August 14, 2026 | Last Updated: August 14, 2026

This Privacy Policy applies to all visitors, users, and customers of paullilleyart.com. By accessing or using this website, you acknowledge that you have read and understood this policy. Please read it carefully before submitting any personal information through this site.

1. Introduction and Overview

Welcome to paullilleyart.com, the personal art portfolio and commerce website of Paul Lilley (referred to in this policy as "we," "us," or "our"). This website serves as a platform to showcase original artwork, accept commission inquiries, and sell artwork and related products directly to customers.

We are committed to protecting your privacy and handling your personal information with transparency and care. This Privacy Policy explains:

What personal information we collect;
Why we collect it and how it is used;
How long we retain it;
Who we may share it with; and
Your rights regarding your personal information.

This policy was last updated on August 14, 2026. If you have any questions about how we handle your data, please contact us using the details in Section 17.

2. Information We Collect

We collect several types of information in connection with your use of this website, as described below.

2.1 Personal Information You Provide Voluntarily

When you interact with this website — such as by filling out a contact form, placing an order, or signing up for our newsletter — you may provide us with:

Name — your first and last name;
Email address — used for correspondence and order communications;
Mailing address — required for the fulfilment of orders and commissions;
Phone number — optional, provided at your discretion for commission coordination.

2.2 Automatically Collected Information

When you visit paullilleyart.com, certain information is collected automatically by our website and third-party services, including:

IP address;
Browser type and version;
Operating system;
Referring URLs (the page you visited before arriving at our site);
Pages visited on our site and time spent on each page;
Date and time of your visit.

This information is generally non-identifying on its own and is used for analytical and security purposes.

2.3 Purchase and Transaction Data

If you make a purchase through this website, we collect:

Billing address and shipping address;
Order details and transaction history;
Payment information — note that all payment card details are processed securely by third-party payment processors. We do not store full card numbers on our systems.

2.4 Communications Data

When you get in touch with us, we retain records of those communications, including:

Emails sent to or from us;
Contact form submissions;
Commission inquiry content and correspondence.

3. How We Collect Information

We collect your information through the following means:

Contact and commission inquiry forms — when you complete and submit a form on the website;
Email newsletter sign-up — when you subscribe to receive updates and announcements;
E-commerce checkout process — when you place an order for artwork or products;
Cookies and tracking technologies — automatically collected when you browse the site (see Section 6 for full details);
Third-party analytics services — such as Google Analytics, which collects usage data on our behalf.

4. How We Use Your Information

We use the personal information we collect for the following purposes:

To respond to inquiries and commission requests — so we can communicate with you about your project or question;
To process and fulfil orders — including coordinating production, packaging, and delivery of artwork;
To send transactional emails — including order confirmations, payment receipts, and shipping updates;
To send marketing and newsletter emails — only where you have given explicit consent to receive these communications;
To improve website performance and user experience — using aggregated analytics data to understand how visitors use the site;
To comply with legal obligations — such as retaining financial records for tax and accounting purposes;
To prevent fraud and ensure website security — by monitoring for suspicious activity and protecting against unauthorised access.

We will not use your personal information for any purpose that is incompatible with the purposes described above without first notifying you and, where required, obtaining your consent.

5. Legal Basis for Processing (GDPR)

If you are located in the European Union or the United Kingdom, we are required under the UK GDPR and EU GDPR to identify a lawful basis for processing your personal data. The legal bases we rely on are:

Consent — we rely on your freely given, specific, and informed consent for newsletter subscriptions and marketing communications. You may withdraw this consent at any time;
Contract performance — processing is necessary to fulfil a contract with you, such as processing an order or delivering a commission;
Legitimate interests — we process certain data on the basis of our legitimate business interests, including website analytics, fraud prevention, and improving the services we offer. We ensure these interests are balanced against your rights and do not override them;
Legal obligation — we may process your data where necessary to comply with a legal requirement, such as retaining financial records as required by tax law.

6. Cookies and Tracking Technologies

6.1 What Are Cookies?

Cookies are small text files placed on your device when you visit a website. They allow the website to recognise your device on subsequent visits and to remember certain information about your preferences and browsing behaviour. Similar technologies, such as web beacons and pixel tags, work in comparable ways.

6.2 Types of Cookies We Use

Strictly Necessary
Essential for the website to function (e.g., shopping cart, session management).
Can Be Disabled? No

Functional
Remember your preferences to enhance your experience (e.g., language, region).
Can Be Disabled? Yes

Analytics / Performance
Collect data about how visitors use the site to help us improve performance. Includes Google Analytics.
Can Be Disabled? Yes

Marketing
Used to deliver relevant content and track the effectiveness of promotions.
Can Be Disabled? Yes

6.3 Google Analytics

This website uses Google Analytics, a web analytics service provided by Google LLC. Google Analytics uses cookies to collect anonymised usage data, such as pages visited, session duration, and general geographic region. This data is used to help us understand how visitors interact with the website and to improve its content and structure.

6.4 Managing Cookies

You can control and manage cookies in the following ways:

Browser settings — most web browsers allow you to refuse or delete cookies through their settings menu. Refer to your browser's help documentation for instructions;
Google Analytics opt-out — you can prevent Google Analytics from collecting data about your visit by installing the Google Analytics Opt-out Browser Add-on, available at tools.google.com/dlpage/gaoptout;
Cookie consent settings — where a cookie consent banner is provided on this site, you may adjust your preferences at any time.

Note

Please be aware that disabling certain cookies — particularly Strictly Necessary cookies — may affect the functionality of this website, including the ability to complete purchases or use the contact form.

7. Analytics

We use Google Analytics (or a comparable analytics platform) to better understand how visitors find and use paullilleyart.com. The data collected through analytics includes:

Pages visited and navigation paths through the site;
Session duration and time spent on individual pages;
Device type and browser information;
Approximate geographic location (country or region level only).

All analytics data is anonymised and aggregated. We do not send personally identifiable information to analytics platforms without your explicit consent. Analytics data helps us make informed decisions about content, design, and performance improvements.

Google's data practices are governed by Google's Privacy Policy, available at policies.google.com/privacy. You may opt out of Google Analytics tracking at any time using the opt-out method described in Section 6.4.

8. Email Communications

8.1 Types of Emails We Send

Order confirmations — sent automatically when a purchase is completed;
Shipping updates — to keep you informed about the status and delivery of your order;
Commission status updates — progress communications relating to your custom artwork project;
Newsletter and marketing emails — announcements of new work, exhibitions, sales, and other updates.

8.2 Consent for Marketing Emails

We will only send you marketing or newsletter emails where you have explicitly opted in to receive them, for example by ticking a consent checkbox when signing up or at checkout. Transactional emails (such as order confirmations) do not require separate consent as they are necessary to fulfil your order.

8.3 Unsubscribing

Every marketing email we send will include a clear and functional unsubscribe link. You may opt out at any time, and your request will be processed promptly. You may also unsubscribe by contacting us directly at privacy@paullilleyart.com.

8.4 Email Service Provider

We use a third-party email service provider to manage and send our email communications. Your email address and related subscriber data will be stored and processed by this provider on our behalf. They are contractually bound to keep your data secure and to use it only for the purpose of delivering our emails.

8.5 Retention of Subscriber Data

Your email address will be retained on our subscriber list until you unsubscribe, or until you submit a deletion request. See Section 10 for full data retention details.

9. Sharing Your Information

9.1 We Do Not Sell Your Data

We do not sell, rent, or trade your personal information to any third party for their own marketing or commercial purposes.

9.2 Third Parties We Share Data With

In order to operate this website and fulfil orders and commissions, we share certain personal information with trusted third-party service providers, categorised as follows:

Payment processors — to securely handle credit/debit card transactions and other payment methods (e.g., Stripe, PayPal);
Email service providers — to manage newsletter subscriptions and send transactional and marketing emails;
Shipping and fulfilment partners — to arrange the delivery of artwork and products to you;
Analytics providers — such as Google Analytics, to analyse website usage (see Section 7);
Website hosting providers — to maintain and serve the website infrastructure.

9.3 Data Protection Requirements

All third-party service providers are carefully selected and are contractually required to implement appropriate technical and organisational measures to protect your personal data. They are permitted to use your data only for the specific purposes we have authorised and in accordance with applicable data protection law.

9.4 International Data Transfers

Some of our third-party service providers may process your data in countries outside the European Union or United Kingdom. Where this occurs, we take steps to ensure that appropriate safeguards are in place, such as the use of Standard Contractual Clauses (SCCs) approved by the European Commission, or equivalent mechanisms recognised under applicable law.

10. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply:

Purchase and transaction records
Retention Period: 7 years
Reason: Legal and tax obligation

Contact form submissions
Retention Period: 2 years, or until resolved
Reason: Business correspondence purposes

Analytics data
Retention Period: Per analytics provider policy (typically 26 months for Google Analytics)
Reason: Website performance analysis

Newsletter subscriber data
Retention Period: Until unsubscribed or deletion requested
Reason: Email marketing with consent

You have the right to request earlier deletion of your personal data. We will comply with such requests promptly, subject to any overriding legal obligations that require us to retain certain records (for example, financial records required by tax law).

11. Your Rights

Depending on your location and the applicable data protection law, you may have some or all of the following rights in relation to your personal information:

Right to Access
You may request a copy of the personal data we hold about you, along with information about how it is used.

Right to Rectification
You may ask us to correct any inaccurate or incomplete personal data we hold about you.

Right to Erasure ("Right to be Forgotten")
You may request that we delete your personal data, subject to certain legal exceptions.

Right to Restrict Processing
You may ask us to limit the way we use your personal data in certain circumstances.

Right to Data Portability
You may request a copy of your personal data in a structured, commonly used, machine-readable format.

Right to Object
You may object to processing based on our legitimate interests, or to the use of your data for direct marketing at any time.

Right to Withdraw Consent
Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

11.1 How to Exercise Your Rights

To exercise any of the rights listed above, please contact us by email at:

privacy@paullilleyart.com

Please use the subject line "Data Request" and include sufficient information to allow us to identify your account and verify your identity.

11.2 Response Timeframe

Under the GDPR / UK GDPR: we will respond within 30 days of receiving your request. In complex cases, this may be extended by a further two months, and we will notify you accordingly.
Under the CCPA / CPRA: we will respond within 45 days of receiving your request, with the possibility of one 45-day extension where reasonably necessary.

12. California Residents – CCPA / CPRA Rights

If you are a resident of California, you are entitled to additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

12.1 Your California Privacy Rights

Right to Know — you have the right to know what personal information we collect, use, disclose, and share about you, and the purposes for which it is used;
Right to Delete — you have the right to request the deletion of personal information we have collected from you, subject to certain exceptions;
Right to Opt-Out of Sale or Sharing — you have the right to opt out of the sale or sharing of your personal information with third parties. We do not sell or share personal information for cross-context behavioural advertising;
Right to Correct — you have the right to request correction of inaccurate personal information;
Right to Limit Use of Sensitive Personal Information — where applicable;
Right to Non-Discrimination — we will not discriminate against you for exercising any of your CCPA/CPRA rights. You will not be denied goods or services, charged different prices, or provided a different level of service as a result of exercising these rights.

12.2 How to Submit a California Privacy Request

California residents may submit a request by:

Email: privacy@paullilleyart.com (subject line: "California Privacy Request"); or
Contact form: available at paullilleyart.com.

We will verify your identity before processing your request and will respond within the timeframe specified in Section 11.2.

13. Children's Privacy

This website is not directed at, and is not intended for use by, children under the age of 13. We do not knowingly collect personal information from children under 13 in compliance with the Children's Online Privacy Protection Act (COPPA) and applicable international law.

If you are a parent or guardian and believe that your child has provided us with personal information without your consent, please contact us immediately at privacy@paullilleyart.com. We will take prompt steps to investigate and, where confirmed, to delete the information from our records.

14. Data Security

We take the security of your personal information seriously and implement reasonable technical and organisational measures to protect it against unauthorised access, loss, alteration, or disclosure. These measures include:

HTTPS / SSL encryption — all data transmitted between your browser and our website is encrypted using industry-standard SSL/TLS technology;
Access controls — access to personal data is restricted to authorised personnel only, on a need-to-know basis;
Third-party security standards — our payment processors maintain PCI-DSS compliance and other relevant security certifications.

Important Notice

Please be aware that no method of transmission over the internet, and no method of electronic storage, is 100% secure. While we strive to protect your personal data, we cannot guarantee its absolute security.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we are committed to notifying affected individuals and relevant regulatory authorities as required by applicable law (e.g., within 72 hours under the UK/EU GDPR).

15. Third-Party Links

paullilleyart.com may contain links to external websites, including social media platforms, online galleries, and other third-party services. These links are provided for your convenience and information only.

We are not responsible for the privacy practices, content, or data handling of any third-party websites. Once you leave our website by following a link, this Privacy Policy no longer applies. We strongly encourage you to review the privacy policy of any third-party site you visit before providing any personal information.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we do, we will:

Update the "Last Updated" date at the top of this document;
Notify subscribers via email and/or display a prominent notice on the website where changes are material.

Your continued use of paullilleyart.com following the posting of any changes to this Privacy Policy constitutes your acceptance of those changes. We encourage you to review this page periodically to stay informed about how we protect your information.

Where we are required by law to obtain your consent to any changes, we will do so before the changes take effect.

17. Contact Information

If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please contact us using the details below:

Name: Paul Lilley
Website: paullilleyart.com
Privacy Enquiries Email: privacy@paullilleyart.com

GDPR Data Subject Requests: Please email [new email address] with the subject line: "Data Request"

17.1 Right to Lodge a Complaint

If you are not satisfied with how we have handled your personal data or responded to your request, you have the right to lodge a complaint with the relevant data protection authority for your jurisdiction:

United Kingdom: Information Commissioner's Office (ICO) — ico.org.uk
European Union: Your local EU supervisory authority (a list is available at edpb.europa.eu);
United States: Your applicable state data protection or consumer protection authority.

We would, however, appreciate the opportunity to address your concerns directly before you contact a regulatory authority, and we encourage you to reach out to us first.

Legal Disclaimer: This Privacy Policy has been prepared for informational purposes and represents a good-faith effort to address common data protection obligations. However, data protection law varies by jurisdiction and changes frequently. The website owner is strongly advised to have this document reviewed by a qualified legal professional familiar with the applicable laws of their specific jurisdiction — including but not limited to UK GDPR, EU GDPR, CCPA/CPRA, and COPPA — before publishing it.

This document does not constitute legal advice.

ART OF MOSAICS