Privacy Policy
Haricot Gallery Ltd ("we", "us", "our") is committed to protecting your privacy and handling your personal data responsibly.
We are the data controller for the personal data described in this policy. If you have any questions or wish to exercise your rights, you can contact us at:
Harry Raikes, harry@haricotgallery.com, Haricot Gallery Ltd, 205 Royal College Street, London, NW1 0SG
We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 when handling your personal data. Further information is available from the Information Commissioner's Office (ICO) at www.ico.org.uk.
We may update this policy from time to time. Please check this page periodically for changes.
Information we collect
We may collect personal information when you contact us by phone, email, or online, including when you use our website, enquire about or purchase an artwork or publication, attend an exhibition or event, register for our newsletter, or apply for a job with us. This may include your name, address, email address, phone number, and payment information, which is processed securely by our payment providers, Stripe and Wix Payments, and not stored directly by us.
How we use your information, and our legal basis
We process a purchase you have made, or carry out our obligations under any contract entered into with you, on the basis that this is necessary for the performance of a contract. We send you communications you have requested or opted into, such as our newsletter, on the basis of your consent, which you can withdraw at any time. We process job applications on the basis of our legitimate interests in recruitment, or as steps taken prior to entering into a contract. We maintain financial records relating to purchases on the basis of our legal obligations, for example under tax law.
Your Rights
Under UK GDPR, you have the right to access the personal data we hold about you, request correction of inaccurate data, request erasure of your data ("right to be forgotten"), restrict or object to how we process your data, request a copy of your data in a portable format, and withdraw consent at any time, for example by unsubscribing from marketing communications. You also have the right to complain to the ICO if you believe we have not handled your data properly. To exercise any of these rights, contact us using the details above. We aim to respond to complaints within 7 working days, in line with our obligations under the Data (Use and Access) Act 2025.
How we protect your data
We use appropriate technical and organisational measures to protect your personal data from loss, misuse, or unauthorised access. If you've signed up to our newsletter, your name and email are stored with Mailchimp. If you've enquired about or purchased an artwork, your name, email, and address are stored on our private database. We will notify you and, where required, the ICO within 72 hours in the event of a data breach likely to result in a risk to your rights and freedoms.
How long we keep your data
We retain personal data only for as long as necessary for the purposes it was collected. Financial records are retained for 6 years, in line with HMRC requirements. Marketing and newsletter data is retained until you unsubscribe or after 2 years of inactivity. Purchase records are retained for 6 years, in line with our financial record-keeping obligations. Enquiry records that do not result in a purchase are retained for 6 years from your last contact with us. We regularly review what we hold and securely delete data we no longer have a basis to retain.
Links to other websites
Our website may contain links to third-party websites. This policy applies only to our website; we encourage you to review the privacy policies of any external sites you visit.
Cookies
Our website uses cookies to help it function properly and to improve your experience.
Strictly necessary cookies — required for the website to work (e.g. remembering items in your basket if you use our Shop, or your cookie consent choice itself). These do not require your consent and cannot be switched off.
Analytics cookies — help us understand how visitors use our website, so we can improve it (Wix Analytics).
Third-party cookies — some cookies are set by services we use on the site, such as (Mailchimp). These third parties may set their own cookies in line with their own privacy policies.
You can withdraw or change your consent at any time by adjusting your cookie settings in your browser, or by clearing your cookies for this site, which will show the consent banner again on your next visit.
You can also control cookies through your browser settings, though blocking cookies may affect how parts of our website function.
Age of consent
If you are aged 13 or under, please get your parent or guardian's permission before providing us with personal information.
International data transfers
We will not transfer your personal data outside the UK without ensuring appropriate safeguards are in place, in accordance with UK GDPR requirements.