Privacy policy

Privacy Policy

1. Who we are

Sean Phelan Mirror Gilding Ltd, trading as Studio Phelan, is the data controller for the personal information described in this policy.

Company number 13923287, registered in England and Wales. Registered office: F61 Cherwell Business Village, Southam Road, Banbury, Oxfordshire, OX16 2SP, United Kingdom. Email: sean@studiophelan.com

We are registered with the Information Commissioner's Office (ICO), the UK's data protection regulator, under registration reference ZB497238.

"We", "us" and "our" mean Sean Phelan Mirror Gilding Ltd throughout.

2. What this policy covers

This policy covers personal information we collect when you visit our website, buy from us, contact us with an enquiry, or ask us about a commission. It also explains your rights and how to exercise them.

Our website is a headless storefront: the pages you see are served by our own frontend, and orders, payments and customer accounts are handled by Shopify. Both are covered here.

3. The information we collect

Information you give us

  • Name, email address, delivery address, billing address and telephone number if you provide one, when you place an order or ask for a delivery quote
  • The content of your enquiries, including anything you tell us about a room, an access problem, a deadline or a commission brief
  • Any images or measurements you send us for a commission or a quote
  • Marketing preferences, if you opt in

Information we collect automatically

  • Order history, and the status of deliveries and returns
  • Technical information: IP address, browser and device type, and pages viewed
  • Cookies and similar technologies, as described in section 9

Payment information. We do not see or store your full card details. Card payments are processed by Shopify Payments, and we receive only confirmation of payment and limited details such as the card type and last four digits. You can also pay using Shop Pay, Apple Pay or Google Pay, which are wallets that pass your payment through Shopify Payments rather than separate providers.

We do not knowingly collect information from children. Our products are not directed at children and accounts are for adults.

Special category data. We do not ask for it and have no need for it. Please do not send us health, religious or similar sensitive information in an enquiry.

4. Why we use it, and our lawful basis

  • Taking, fulfilling and delivering your order, including customs and export documents (lawful basis: performance of a contract with you)
  • Answering enquiries, quoting freight, discussing a commission (lawful basis: performance of a contract, or our legitimate interest in responding to you)
  • Payment processing, and fraud and chargeback checks (lawful basis: contract, and our legitimate interest in preventing fraud)
  • Handling returns, refunds, damage claims and complaints (lawful basis: contract, and our legal obligations to consumers)
  • Keeping accounting, VAT and export records (lawful basis: legal obligation)
  • Improving the website and understanding how it is used (lawful basis: legitimate interest, or your consent where cookies require it)
  • Marketing emails about new pieces and collections (lawful basis: your consent, or the soft opt-in for existing customers)
  • Establishing, exercising or defending legal claims (lawful basis: legitimate interest)

Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights, and you can object at any time using section 10.

5. Marketing

We will only send you marketing email if you have opted in, or if you have bought from us and we are contacting you about similar pieces. Every marketing email carries an unsubscribe link, and unsubscribing takes effect for all marketing. It does not stop service messages about an order you have placed, which we must still send.

You can sign up for our newsletter using the form at the foot of the website. We use your email address only to send you news of new pieces and collections, and you can unsubscribe at any time using the link in every email. When you sign up, your email address is passed to Klaviyo, the service we use to send our newsletter.

6. Who we share it with

We do not sell your personal information. We share it only with the organisations below, each of which processes it on our instructions under a written contract, and only with what they need.

  • Shopify (Shopify International Ltd): Runs the store, checkout, customer accounts, order records and the admin we work in. What they receive: order, contact, delivery and account data.
  • Shopify Payments: Takes and settles card, Shop Pay, Apple Pay and Google Pay payments, and runs fraud checks. What they receive: payment and billing data, and the card details you enter with them directly.
  • Vercel Inc.: Hosts our website frontend and serves our product images. What they receive: technical data such as IP address and request logs.
  • Klaviyo (Klaviyo, Inc.): Sends our newsletter and manages the list of people who have asked to receive it. What they receive: your email address and the date you signed up. If you also agree to marketing and analytics tracking at checkout, Klaviyo receives basic activity on our checkout pages.
  • Delivery and freight companies: Deliver your piece, and handle crating, export and customs where relevant. What they receive: name, delivery address, contact number, and the customs paperwork the destination country requires.
  • Google (Google Workspace): Carries the email you send us and we send you, at sean@studiophelan.com. What they receive: anything contained in that correspondence.
  • Our accountant (G Hawk Accounting), and professional advisers: Bookkeeping, VAT, and advice if a dispute arises. What they receive: transaction records, and only what is necessary.

We also disclose information where we are legally required to, for example to HMRC, customs authorities, or in response to a lawful request.

Shopify's own use of data is described in Shopify's privacy policy. Our website's search and filtering is powered by Shopify Search & Discovery, a first-party Shopify feature which adds no further recipient.

If the business is ever sold or restructured, customer information may transfer with it, and you would be told.

7. Not in use yet

8. Sending information outside the UK

Some of the organisations above are based outside the United Kingdom, or use servers outside it. Where information is transferred out of the UK, we rely on the UK government's adequacy regulations for that country, or on the UK International Data Transfer Agreement or Addendum to the EU standard contractual clauses.

Because we ship worldwide, delivering an order outside the UK necessarily means sending your name, address and contact details to a carrier and to the customs authority in your country. There is no way to deliver internationally without this.

9. Cookies

Cookies that are strictly necessary, such as those that keep your basket working and let you check out securely, are set without consent because the site cannot work without them.

We measure how the site is used with Vercel Web Analytics and Vercel Speed Insights. They do not set cookies, do not store your IP address and do not follow you across other websites. They count page views, which pieces are viewed, saved or added to the bag, searches, clicks on enquiry links, how far down a page people scroll, and how quickly pages load, so that we can improve the site and see what is working.

When you add something to your bag, we also note on the bag the page that brought you to us (for example a link from Instagram or a newsletter) and the page you first landed on. This is kept only in the site's memory while you browse and is saved on the order, so that we can see which links lead to orders. It is not stored on your device.

We do not use advertising or personalisation cookies on this site. Because nothing beyond the strictly necessary is stored on your device, there is no cookie banner to show you. If we ever add anything that needs your consent, we will ask for it before it loads, and this section will say so.

10. Your rights

Under UK data protection law you have the right to: be told how your information is used; get a copy of it; have inaccurate information corrected; ask for it to be deleted; restrict or object to how we use it, including objecting to direct marketing at any time; ask for it in a portable format; and withdraw consent where consent is what we rely on.

To exercise any of these, email sean@studiophelan.com. We will respond within one month. There is no charge unless a request is clearly unfounded or excessive. We may ask you to confirm your identity first.

Some rights have limits. We cannot delete records we are legally required to keep, such as VAT and accounting records, and we may keep what we need to defend a legal claim.

11. How long we keep it

  • Order, invoice, VAT and export records: six years after the end of the relevant accounting period, as UK tax law requires
  • Enquiries and quotes that do not become orders: six years, the same as order records
  • Marketing contacts: until you unsubscribe, and then a minimal record so that we do not contact you again
  • Commission drawings, measurements and images: for as long as needed for the commission and any guarantee period afterwards, and then six years in line with our order records

We delete or anonymise information when we no longer need it.

12. Keeping it secure

We use organisations that maintain appropriate technical and organisational security measures, restrict access to those who need it, and hold the store behind authentication. No transmission over the internet is completely secure, so we cannot guarantee absolute security, but we take it seriously and we would tell you and the ICO about a breach where the law requires it.

13. Complaints

If you are unhappy with how we have handled your information, please tell us first at sean@studiophelan.com so we can put it right.

You can also complain to the UK's supervisory authority:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Helpline 0303 123 1113. ico.org.uk

If you live in the European Union, you may instead complain to the supervisory authority in your own country.

14. Changes to this policy

We update this policy when what we do with information changes, in particular when we add or remove a service that handles it. The version on this page is the one in force, and the date at the top tells you when it last changed. Where a change is significant, we will tell customers directly.

15. Contact

Sean Phelan Mirror Gilding Ltd (company no. 13923287) Registered office: F61 Cherwell Business Village, Southam Road, Banbury, Oxfordshire, OX16 2SP, United Kingdom Email: sean@studiophelan.com

We have not appointed a Data Protection Officer, as we are not required to. Data protection questions go to the address above.