Privacy notice
This explains what happens to your information when you send an enquiry, join the mailing list, buy a print or simply read the site. It is written to be understood rather than to cover anyone.
Who is responsible
Siris Hill Ltd, a company registered in England and Wales, company number company number, registered office registered office address. The company is the data controller for everything described here.
Anything at all, to partners@sirishill.com.
What is collected, and why
| What | Why | Kept for |
|---|---|---|
| Enquiry form: your name, email address, which edition you asked about, and your message | To reply to you. Nothing else. | Two years from your last message, then deleted |
| Mailing list: your email address | To send occasional studio news. Only because you asked. | Until you unsubscribe |
| A purchase: your name, delivery address, email address, the amount and the last four digits of the card | To send you the print, and because HMRC requires sales records | Six years, as tax law requires |
| Server logs: IP address, browser, which page, when | Kept automatically by the host to keep the site working and to stop abuse | About 30 days |
| Visitor statistics: page, country, where you arrived from | To know which work people look at. Not tied to you, not tied to a device, no profile built. | Aggregate only |
| Error reports: the page, the browser, the error | So a broken enquiry form is found by the site rather than by a customer | 90 days |
There is no tracking for advertising, no profiling, no sharing with data brokers, and nothing is ever sold. The site does not use cookies at all – see the cookie policy.
Card payments
Card details are never entered on this site and never reach it. When you buy a print you are handed over to Stripe, who take the payment on their own pages and act as a separate controller of that payment data under their own privacy policy at stripe.com/gb/privacy.
What comes back is your name, delivery address, email address, the amount paid and the last four digits of the card. The full card number is never seen by Siris Hill Ltd and is not stored anywhere in this business.
The legal basis for each of these
- Replying to your enquiry – legitimate interests. You wrote asking for an answer; the answer requires keeping your message long enough to give it.
- The mailing list – consent, which you gave by entering your address, and can withdraw at any time.
- Fulfilling an order – performance of a contract. A print cannot be posted to an address that has not been kept.
- Sales records – legal obligation. HMRC requires six years.
- Logs and error reports – legitimate interests in a site that works and is not being attacked.
Who else handles it
Only the services that make the site run. Each is used for one job and nothing more.
- Netlify – hosting, and receiving the enquiry and mailing list forms
- Stripe – card payments
- Cloudflare – visitor statistics, collected without cookies and without identifying anyone
- Sentry – error reports
- The email provider used for email provider, e.g. Microsoft 365, which is where your message ends up once the form has sent it
Some of these are based in the United States, so your information may be handled outside the UK. Where that happens it is covered by the standard contractual clauses and the UK International Data Transfer Addendum, which is the arrangement UK law provides for exactly this.
Your rights
Under UK GDPR you can ask to:
- see what is held about you
- have it corrected
- have it deleted, where there is no legal reason to keep it
- object to it being used, or ask that its use be restricted
- have it sent to you in a portable form
- withdraw consent for the mailing list, at any time, with no consequence
Email partners@sirishill.com and it will be done within one month. There is no charge.
If the answer is unsatisfactory you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. Doing so costs nothing and does not require going through Siris Hill Ltd first.
Children
The site is not aimed at children and no information is knowingly collected from anyone under 13. If you believe a child has sent something through the form, email and it will be deleted.
Changes
If this notice changes the date at the top changes with it. Anything significant will be said plainly rather than slipped in.