Privacy Policy
Last updated: September 2026
1. About this Privacy Policy
This Privacy Policy explains how I (Carol Matassa) collect, use and protect your personal information when you visit my website at www.carolmatassa.com, purchase my artwork, contact me, sign up to my mailing list, or otherwise interact with my business.
I am the data controller responsible for your personal information.
Contact details:
Carol Matassa
carolmatassaart@gmail.com
I take your privacy seriously and will only use your personal information in accordance with applicable UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. What personal information I collect
Depending on how you interact with my website and business, I may collect the following information:
Information you provide directly
This may include:
your name;
email address;
postal and delivery address;
billing address;
telephone number, where you provide it;
details of artwork or products you purchase;
messages or enquiries you send to me; and
any other information you choose to provide.
Information relating to purchases
If you purchase artwork from me, I may collect information necessary to process and fulfil your order, such as your name, contact details, billing and delivery address and details of your purchase.
Payment card details are normally processed directly by my payment provider. I do not normally receive or store your full payment card details.
Information collected automatically
When you visit my website, certain technical information may be collected automatically, such as your IP address, browser type, device information and information about how you use the website.
This may be collected through cookies and similar technologies, depending on the services and settings used on my website.
3. How I use your personal information
I may use your personal information to:
process and fulfil orders for artwork;
arrange delivery of purchases;
communicate with you about your order;
respond to enquiries and messages;
provide customer service;
process payments and refunds;
keep appropriate business and financial records;
send newsletters or information about my artwork and exhibitions, where you have agreed to receive them or where otherwise permitted by law;
maintain and improve my website;
understand how visitors use my website;
protect my website and business against fraud, misuse and security threats; and
comply with legal and regulatory obligations.
I will only use your personal information for purposes that are lawful and appropriate.
4. My lawful bases for using your information
Under UK data protection law, I must have a lawful basis for processing your personal information.
Depending on the circumstances, I may rely on the following lawful bases:
Contract
I may need to use your personal information to process and fulfil an order you have placed with me, arrange delivery, process payment or otherwise take steps at your request before entering into a contract.
Legal obligation
I may need to keep or disclose certain information because I am legally required to do so, for example for tax, accounting or other legal purposes.
Legitimate interests
I may use personal information where this is necessary for my legitimate interests as an artist and business, provided that those interests are not overridden by your rights and interests.
For example, this may include managing customer enquiries, maintaining the security of my website, administering my business and improving my services.
Consent
Where required, I will ask for your consent before using your personal information for a particular purpose, such as certain forms of marketing or non-essential cookies.
Where I rely on consent, you can withdraw it at any time.
5. Marketing
If you choose to subscribe to my mailing list, I may use your name and email address to send you news about my artwork, new collections, exhibitions, events, studio news or other information about my work.
You can unsubscribe from marketing emails at any time by contacting me at carolmatassaart@gmail.com.
I will not sell or rent your personal information to third parties for their own marketing purposes.
6. Who I share your information with
I do not sell your personal information.
I may share relevant personal information with trusted third parties where this is necessary to operate my business, fulfil your order or provide services to you.
Depending on how my business operates, these may include:
payment processing providers;
website hosting and website service providers;
online shop or e-commerce providers;
delivery and postal companies;
email and mailing-list providers;
accounting or bookkeeping services;
professional advisers; and
government, regulatory or law-enforcement authorities where I am legally required to do so.
These organisations should only receive the information they need for the relevant purpose.
Some service providers may process personal information outside the UK. Where this happens, I will take appropriate steps to ensure that your personal information is protected in accordance with applicable UK data protection law.
7. Payments
Payments made through my website may be processed by a third-party payment provider.
Payment information is handled by the relevant payment provider in accordance with its own privacy policy and security procedures.
I do not normally have access to or store your complete payment card details.
8. Delivery
If you purchase artwork from me, I may provide your name, delivery address and other necessary contact information to the postal or courier service responsible for delivering your order.
I only provide the information necessary to arrange delivery.
9. Cookies
My website uses cookies and similar technologies.
Some cookies are necessary for the website to function properly—for example, to enable shopping basket or security functions.
I may also use analytics or other non-essential cookies to understand how visitors use my website and improve its performance.
Where consent is required for non-essential cookies, I will ask for your consent.
10. How long I keep your information
I only keep personal information for as long as I reasonably need it for the purposes described in this Privacy Policy.
For example:
information relating to purchases may be retained for as long as necessary to fulfil the order and deal with returns, refunds, complaints or disputes;
financial and transaction records may be retained for the period required by tax and accounting laws;
correspondence may be retained for as long as reasonably necessary to deal with the relevant enquiry or maintain appropriate business records; and
marketing information will be retained until you unsubscribe, unless there is another lawful reason for retaining it.
When personal information is no longer required, I will securely delete or dispose of it, where appropriate.
11. How I protect your information
I take reasonable technical and organisational measures to protect your personal information from loss, misuse, unauthorised access, alteration or disclosure.
However, no method of transmitting information over the internet or storing information electronically can be guaranteed to be completely secure.
12. Your rights
Under UK data protection law, you may have a number of rights in relation to your personal information, including the right to:
ask for a copy of the personal information I hold about you;
ask me to correct inaccurate or incomplete information;
ask me to delete your personal information in certain circumstances;
ask me to restrict how I use your information in certain circumstances;
object to certain types of processing, including direct marketing;
withdraw consent where I rely on consent as the lawful basis for processing; and
in certain circumstances, ask for your information to be provided to you in a portable format.
These rights are subject to certain legal conditions and exemptions.
If you would like to exercise one of these rights, please contact me at carolmatassaart@gmail.com.
I may need to ask you for information to verify your identity before dealing with your request.
13. Complaints
If you have concerns about how I have used your personal information, please contact me first so that I can try to resolve the issue.
You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO).
Information about making a complaint is available on the ICO's website:
14. Third-party websites
My website may contain links to third-party websites, such as social media platforms, galleries, payment services or other websites.
I am not responsible for the privacy practices or content of those websites. I recommend checking their privacy policies before providing them with personal information.
15. Changes to this Privacy Policy
I may update this Privacy Policy from time to time to reflect changes to my business, website, services or legal requirements.
The latest version will always be published on this page, with the date shown at the top.
16. Contact me
If you have any questions about this Privacy Policy or how I use your personal information, please contact me: