Privacy Policy

Privacy Policy

Last updated: 26/10/2026

Who I am

This website, www.davidgalanartist.com, is run by David Galan, an artist based in London, United Kingdom. I am the data controller for the personal information collected through this site, which means I decide how and why it is used. You can contact me about anything in this policy at davidgalan_artist@yahoo.com.

What information I collect

When you buy a work, make an enquiry, commission a piece or join my mailing list, I collect the information you give me: your name, email address, postal and delivery address, phone number, and any details you include in your messages. Payments are processed by secure third-party providers, so I never see or store your full card details.

When you browse the site, some information is collected automatically, including your IP address, browser and device type, the pages you visit, and how you arrived at the site. This is gathered through cookies and similar technologies, described below.

How I use your information and why

UK data protection law requires me to have a lawful basis for each use of your information. I use it:

To process and deliver your order, arrange returns and refunds, and communicate with you about your purchase or commission. The lawful basis is performing my contract with you.

To keep sales and tax records required by HMRC. The lawful basis is legal obligation.

To reply to enquiries, keep in touch with collectors who have bought from me, maintain records of who owns my work, and keep the site secure and working well. The lawful basis is my legitimate interests in running my art practice, balanced against your rights.

To send you my newsletter, news of exhibitions and new work. The lawful basis is your consent, which you can withdraw at any time using the unsubscribe link in every email or by contacting me. If you have bought from me, I may also send you news about similar work under the soft opt-in rules, and you can opt out at any time.

I do not sell your personal information, and I do not use it for automated decision-making.

Who I share it with

I share your information only where necessary to run my practice, with:

Wix.com, which hosts this website and stores data submitted through it.
Payment providers (Wix Payments, Stripe and PayPal) to process your payment securely.
Couriers and fine art shippers, who receive your name, address and phone number to deliver your work.
My email marketing provider, if you have joined my mailing list.
My accountant and HMRC, for financial and tax records.
Galleries or exhibition partners, only when they are handling a sale on my behalf and you have been told about it.

I may also disclose information where the law requires it.

International transfers

Some of these providers, including Wix, store or process data outside the UK, including in the United States and the European Economic Area. Where this happens, the transfer is protected by safeguards recognised under UK law, such as UK adequacy regulations or the International Data Transfer Addendum to the EU Standard Contractual Clauses.

How long I keep it

I keep order and payment records for six years after the end of the tax year in which the sale took place, as required for tax purposes. I keep basic records of who owns my original works for longer, as this provenance information protects the authenticity and value of the work for collectors. Enquiries that do not lead to a sale are deleted within two years. Mailing list details are kept until you unsubscribe.

Cookies

The site uses essential cookies that are needed for it to work, such as those that run the shopping cart and checkout. With your consent, it also uses analytics cookies to help me understand how visitors use the site. You can accept or decline non-essential cookies through the banner when you first visit, and change your choice at any time through your browser settings.

Keeping your information secure

Your information is held on the secure systems of the providers listed above, which use encryption and industry-standard security measures. Access to your information on my side is limited to me and those helping me run my practice. No online system is completely secure, but I take reasonable steps to protect your data.

Your rights

Under UK data protection law, you have the right to:

Access the personal information I hold about you.
Ask me to correct information that is inaccurate or incomplete.
Ask me to delete your information, where I have no legal reason to keep it.
Ask me to restrict or object to how I use your information, including for marketing.
Receive your information in a portable format.
Withdraw your consent at any time, where I rely on consent.

To use any of these rights, email me at davidgalan_artist@yahoo.com. I will respond within one month. There is normally no charge.

Complaints

If you are unhappy with how I have handled your information, please contact me first so I can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, at ico.org.uk or on 0303 123 1113.

Children

This website is not intended for anyone under 18, and I do not knowingly collect information from children.

Changes to this policy

I may update this policy from time to time. The latest version will always be on this page, with the date it was last updated shown at the top.