Privacy Policy

1. Who We Are

Chhavi Art ("we", "us", "our") is a sole trader operating as an artist and art educator based in Leighton Buzzard, Bedfordshire, United Kingdom. We can be contacted at hello@chhaviart.com.

We are committed to protecting your personal data and processing it in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and any applicable privacy legislation.

2. Data We Collect

We may collect the following personal data when you interact with our website, purchase artwork, or book a lesson:

• Identity data: first name, last name
• Contact data: email address, telephone or WhatsApp number
• Transaction data: details of purchases made (processed via Stripe; we do not store card details)
• Booking data: lesson type, date, duration, and time preferences
• Marketing data: your preference to receive our newsletter (consent-based)
• Technical data: IP address, browser type, and pages visited (via cookies - see our Cookie Policy)

We do not collect any special category data (such as health information, ethnicity or religious beliefs).

3. How We Use Your Data

We use your personal data for the following purposes:

• To process and fulfil artwork orders, including shipping and correspondence
• To confirm and manage art lesson bookings
• To respond to your enquiries sent via email or WhatsApp
• To send our newsletter, where you have given explicit consent
• To comply with our legal and financial obligations (e.g. record-keeping for HMRC)
• To improve our website based on aggregated, anonymised analytics

4. Legal Basis for Processing

• Contract performance: processing your order or booking
• Legitimate interests: responding to direct enquiries, improving our services
• Legal obligation: financial record-keeping required by law
• Consent: sending our newsletter (you may withdraw consent at any time)

5. Data Sharing and Third Parties

We share your data only where necessary and with appropriate safeguards in place:

• Stripe, Inc.: our payment processor. Card data is handled entirely by Stripe under their own privacy policy. We never see or store your full card details.
• WhatsApp / Meta Platforms: when you contact us via WhatsApp, your messages are subject to Meta's privacy policy.
• Postal and courier services: your name and delivery address are shared to fulfil artwork orders.

We do not sell, rent or share your personal data with any third party for their own marketing purposes.

6. Data Retention

We retain personal data only for as long as necessary for the purpose it was collected, or as required by law. Financial and transaction records are retained for six years in accordance with HMRC requirements. Newsletter subscription data is retained until you unsubscribe.

7. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access: to request a copy of the data we hold about you
• Right to rectification: to correct inaccurate or incomplete data
• Right to erasure: to request deletion of your data where there is no lawful reason to retain it
• Right to restrict processing: to limit how we use your data in certain circumstances
• Right to data portability: to receive your data in a structured, machine-readable format
• Right to object: to processing based on legitimate interests or for direct marketing
• Right to withdraw consent: at any time, where processing is based on consent

To exercise any of these rights, please contact us at hello@chhaviart.com. We will respond within one month.

8. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. Payments are processed exclusively via Stripe, which is PCI DSS compliant. Our website uses HTTPS encryption. We do not store payment card data under any circumstances.

9. Cookies

We use cookies to ensure our website functions correctly and to understand how visitors use it. For full details, please see our Cookie Policy.

10. International Transfers

Some of our third-party providers (including Stripe and Meta) may process data outside the United Kingdom. Where this occurs, we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses approved by the UK Information Commissioner's Office (ICO).

11. Right to Complain

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "last updated" date at the top of this page. We encourage you to review this policy periodically.

Contact us about this policy:
Email: hello@chhaviart.com