PRIVACY POLICY - MY GDPR STATEMENT OF COMPLIANCE
​
I have read the Information Commissioner’s Office guidelines for compliance with the new General Data Protection Regulation (GDPR) rules. This document that follows explains how I comply. If you have given me your email address (by emailing me, buying something from my website or subscribing to my website, for example) you should read this to reassure yourself that I only use your data responsibly.



Awareness

I am a sole trader.



The information I hold:

Email addresses of people who have emailed me and to whom I have replied – automatically saved in hotmail.

Email addresses, postal addresses (for physical items) and names of people who have bought something from my website.

 Orders are saved by default in the background of the website, which is securely password-protected.

Payments for commissions are taken via Paypal or Bank Transfer. Both of which are protected via Paypal and your bank. 

       

I do not share this information with anyone. Ever. 



Communicating privacy information

I have put this statement on my website.

I have added a link to my facebook page. 

I have added a link to my e-mail signature.

I have added a statement or link to my Esty and Amazon page.



Individual's rights

On request, I will delete data. If someone asked to see their data, I would take a screenshot of their entry/entries.



Subject access requests

I aim to respond to all requests within 24 hours and usually much sooner.

Lawful basis for processing data

If people have emailed me, they have given me their email address. I do not actively add it to a list but hotmail will save it. I will not add it to any database or spreadsheet unless someone asks me to or gives me explicit and detailed permission.

If authors have brought my illustrations, they have agreed to be named on the license and they understand that I need to hold their email address, name and and address for the license records.

If people have bought something from my Etsy or Amazon page, their postal and email addresses are saved on the websites which are password protected. I do not have access to your payment details through Etsy and Amazon. Please see their own Pivacy Policy to check how this information is stored.
This is standard practice for purchasing online but I do not use their data for anything other than contacting them about a problem with the order. I will delete their email addresses and postal addresses after one year.



Consent

I make the presumption that, by contacting me and expecting a response, a person consents to me using their email address and keeping it stored for future correspondence. If they would like me to remove their details once their commission has been finished, I will do so of course.

I only use personal information myself for what is necessary, I never pass on to third parties, write it down, or keep it anywhere that is not password protected.  



Children

Young  people sometimes email me but I don’t know their age unless they tell me – and I only have their word for that. I would not deliberately keep their email address (but hotmail would save it in my account.) If you think your child has contacted me and would like their email address deleted, please get in touch.


Data breaches

I have done everything I can to prevent this, by strongly password-protecting my computer, and other internet accounts. If any of those organisations were compromised I would take steps to follow their advice immediately.



Data Protection by Design and Data Protection Impact Assessments

I have familiarised myself with the ICO’s code of practice on Privacy Impact Assessments as well as the latest guidance from the Article 29 Working Party, and believe that I am using best practice.



Data Protection Officers

I have appointed myself as the Data protection Officer, as I am a sole trader.



​

International

My lead data protection supervisory authority is the UK’s ICO. This may change after Britain leaves the EU.

​