Privacy policy

1. Who we are

Paul Kenton Ltd is the “data controller” for the personal data described here — the company that decides how and why your data is used. We are a company registered in England & Wales (Company No. 06295741), with a registered office at Bay Studio, Hele Business Park, Ilfracombe, Devon, EX34 9RA.

Paul Kenton Ltd is registered with the UK Information Commissioner’s Office (ICO). If you have any question about this policy or your data, please email [email protected] or use our contact form.

2. The data we collect

We only collect data we actually need. Depending on how you use the site, this includes:

• Account data — your name and email address. There is no password: you sign in with a one-time code we email you, which we keep only as a secure, one-way hash and which expires after ten minutes.
• Order data — the artworks you buy, order value, order history and any notes you add to an order.
• Payment data — your card payment is handled entirely by our payment provider. We receive confirmation that a payment succeeded and a limited reference (such as the card type and last four digits); we never see or store your full card number.
• Delivery data — the name, delivery address and, where needed, contact details we use to ship your order.
• Marketing data — your email address and your consent status if you sign up for our newsletter.
• Contact data — anything you tell us when you message us, ask about a commission, or contact support.
• Technical & usage data — information about how you use the site and respond to our adverts, from Google Analytics and Google Ads (without cookies unless you accept them — see our Cookie Policy), plus limited security data such as an IP address used to protect our forms from bots.

3. How we use your data, and our lawful bases

UK data protection law requires us to have a valid “lawful basis” for every use of your data. We rely on the following:

To fulfil your order

Taking payment, arranging delivery, issuing a certificate of authenticity and handling returns.

Lawful basis: performance of a contract.

To manage your account

Letting you sign in, view your order history and manage your details.

Lawful basis: performance of a contract.

To send you our newsletter

Only if you have opted in. You can unsubscribe at any time.

Lawful basis: consent.

To send service messages

Order confirmations, dispatch notices, sign-in codes and similar.

Lawful basis: performance of a contract.

To improve and secure the site, and measure our advertising

Understanding how the site is used and whether our adverts work, and protecting it from fraud and abuse.

Lawful basis: consent for analytics and advertising cookies; legitimate interests for cookie-free measurement and for security.

To meet our legal duties

For example keeping accounting and tax records.

Lawful basis: legal obligation.

4. Who we share your data with

We do not sell your personal data. We share it only with the service providers that help us run the site and fulfil your orders. Each acts on our instructions under a contract, and only for the purposes below.

• Stripe — processes card payments securely. Stripe is certified to the PCI-DSS standard for handling card data; your full card details go to Stripe, not to us.
• Klarna — if you choose Klarna at checkout, we share your name, email address, phone number, billing and delivery addresses and what you are ordering, so Klarna can offer and take your payment. Klarna may run identity and credit checks; it does this as a separate data controller, under its own terms and privacy notice (opens in new tab). See our Pay with Klarna page.
• DHL Express — we share the recipient’s name and delivery address so your order can be delivered and cleared through customs where relevant.
• Amazon Web Services (AWS SES & SNS) — sends our service emails and gives us delivery, bounce and complaint feedback so we can keep a suppression list and avoid emailing addresses that should not be contacted. AWS SES also helps us validate email addresses at sign-up.
• Listmonk — our newsletter tool, which we self-host at mail.paulkenton.com. It holds your email address and consent status only while you are subscribed.
• Cloudflare — provides our content-delivery network and image storage (Cloudflare R2), and the Cloudflare Turnstile check that protects our sign-up form from automated abuse.
• Google (Analytics 4 & Ads) — helps us understand how the site is used and measure our adverts. It runs using Google Consent Mode: without cookies unless you accept them. See our Cookie Policy.

We may also disclose data where we are legally required to — for example to comply with a court order, or to establish, exercise or defend legal claims.

5. International transfers

Some of the providers above may process data outside the UK. Where that happens, we rely on the safeguards recognised under UK data protection law — such as UK ‘adequacy’ decisions or the International Data Transfer Agreement / Addendum with Standard Contractual Clauses — so your data keeps an equivalent level of protection wherever it is handled.

6. How long we keep your data

Order and payment records

Kept for at least six years after the relevant transaction, to meet UK tax and accounting requirements.

Account data

Kept for as long as your account is open. You can ask us to close it and delete it at any time (subject to records we must retain by law).

Newsletter data

Kept until you unsubscribe or ask us to remove you.

Contact and support messages

Kept only as long as needed to deal with your enquiry and any follow-up.

7. Your rights

Under UK data protection law you have the right to:

• Access — ask for a copy of the personal data we hold about you.
• Rectification — ask us to correct data that is wrong or incomplete.
• Erasure — ask us to delete your data where there is no ongoing reason to keep it.
• Portability — ask for the data you gave us in a portable, machine-readable format.
• Restriction and objection — ask us to pause a use of your data, or object to uses based on our legitimate interests.
• Withdraw consent — where we rely on your consent (such as marketing or analytics), you can withdraw it at any time without affecting earlier use.

To exercise any of these, email [email protected]. We will respond within one month. If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk, though we would welcome the chance to put things right first.

8. How we keep your data secure

Security matters to us. The whole site runs over HTTPS, so traffic between your browser and our servers is encrypted in transit using TLS. Customer accounts have no passwords to steal: sign-in codes are stored only as secure one-way hashes and expire quickly, card payments are handled by Stripe rather than on our servers, and access to personal data is limited to staff who need it to do their job. No system can be guaranteed perfectly secure, but we take reasonable technical and organisational measures to protect your data.

9. Cookies

When you first visit, a consent banner lets you accept or reject analytics and advertising cookies. Essential cookies keep the site working — signing you in, remembering your basket, and protecting our forms. Google Analytics and Google Ads run on every visit but only use cookies if you accept, and you can change your choice at any time from Cookie settings in the footer. Our Cookie Policy explains this in full.

10. Children

This site is intended for adults and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has given us their data, please contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time to reflect changes to the site or the law. When we do, we will change the “last updated” date at the top of this page, and for significant changes we will take reasonable steps to let you know.

12. Contact us

For anything to do with your data or this policy, email [email protected] or use our contact form. Our postal address is: