Privacy policy

Information you give us

Depending on how you use the site, you may provide us with information including:

• your name and email address;
• your postal or delivery address;
• information connected with a purchase or payment;
• information provided when creating or using an auction account;
• bids and purchase history;
• information supplied in a workshop application, booking or enquiry;
• comments, messages or other information you choose to send us.

We use this information only for the purposes for which it was provided, to operate shiftinglight.com and our related activities, and where necessary to meet our legal and accounting obligations.

Mailing list and email

We send our regular Postcard from Provence, auction, workshop and other marketing emails only to people who have chosen to subscribe through one of our subscription forms.

Making a purchase, creating an auction account, bidding on a painting, applying for a workshop or contacting us does not automatically add you to our mailing list.

If you make a purchase, book a workshop or otherwise enter into a transaction with us, we may use the contact details you provide to send messages necessary to deal with that transaction, such as confirmations, payment information, delivery details or workshop arrangements. These messages are separate from our marketing mailing list.

You can unsubscribe from marketing emails at any time using the unsubscribe link included in every mailing.

Our mailing lists are managed using Sendy, which we host ourselves, and emails are delivered using Amazon Simple Email Service (Amazon SES). Our newsletters may record whether an email has been opened and whether links in it have been clicked. We use this information to understand the effectiveness of our emails and improve what we send.

Purchases and payments

Payments made through shiftinglight.com are processed by Stripe.

We do not receive or store your complete payment-card number or card security code. Payment information needed to process the payment is handled by Stripe.

We do retain the ordinary transaction and order information needed to administer a purchase. This may include your name, email and delivery address, the item purchased, amount paid, date, payment status, Stripe transaction or payment reference, and information concerning refunds or delivery.

We retain appropriate transaction, invoice and accounting records where required for tax, accounting and legal purposes.

Stripe processes personal and payment information under its own privacy policy.

Auctions

If you create an account to participate in an auction, we retain information needed to operate that account and the auction service. This may include your name, email address, auction pseudonym, account credentials, location or address where required, bidding history and purchase history.

Passwords are stored in protected hashed form; we do not store them as readable passwords.

Auction information may also be retained where reasonably necessary to maintain the integrity and history of our auctions, resolve disputes and meet accounting or legal obligations.

Workshops

If you enquire about or apply for one of our painting workshops, we use the information you provide to deal with your enquiry, application or booking and to organise the workshop.

This can include your contact details, painting experience, workshop choice and practical information you voluntarily provide that is relevant to your participation.

We do not use workshop applications to add people to our marketing mailing list unless they separately choose to subscribe.

Website analytics

We use Plausible Analytics to understand, in aggregate, how people use shiftinglight.com — for example which pages are visited and how visitors arrive at the site.

Plausible is designed to provide website statistics without tracking individual people across the web. It does not use cookies or persistent identifiers and does not store visitors' raw IP addresses. We use this information to understand and improve the website, rather than to build profiles of individual visitors.

Comments, forms and spam protection

If you submit a comment, enquiry or other form on the website, we may retain the information you provide together with technical information reasonably necessary to operate the form, prevent abuse or spam and maintain the security of the website.

We use Cloudflare Turnstile on parts of the site, including comments, to distinguish genuine visitors from automated abuse and spam. In doing so, Cloudflare may process technical information about your browser and device for security purposes.

Like most websites, our servers may also create technical logs containing information such as IP addresses, request times, pages requested, browser information and errors. These logs are used for security, troubleshooting and operation of the site and are not used for advertising.

Service providers

We use a limited number of service providers where necessary to run the website and our business. These include services for:

• website and server hosting;
• payment processing, including Stripe;
• email delivery, including Amazon SES;
• privacy-friendly website analytics, including Plausible;
• security and spam prevention, including Cloudflare Turnstile.

These providers may process information on our behalf or, in some circumstances, as independent data controllers under their own privacy policies.

Some providers may process information outside the European Economic Area. Where data protection law requires safeguards for an international transfer, we rely on the safeguards provided by the relevant service provider and applicable law.

Why we process personal information

Depending on the circumstances, we process personal information because:

• it is necessary to provide something you have requested or to fulfil a contract with you, such as a purchase, auction transaction or workshop booking;
• you have given your consent, particularly when subscribing to marketing emails;
• we have a legitimate interest in operating, securing and improving our website and business, provided that this does not override your rights and interests; or
• we need to comply with legal, tax or accounting obligations.

You can withdraw consent to marketing emails at any time by unsubscribing.

How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, subject to any legal requirements.

For example:

• mailing-list information is retained while you remain subscribed, together with information needed to honour an unsubscribe request;
• purchase and accounting records may be retained for the periods required by tax and accounting law;
• auction records may be retained as part of the operational and transaction history of the auction service;
• workshop and enquiry information is retained for as long as reasonably necessary to administer the booking or correspondence and deal with related business or legal requirements.

We may retain limited records for longer where necessary to establish, exercise or defend legal claims, prevent fraud or comply with the law.

Your rights

Under European data-protection law, you may have rights concerning your personal information, including the right to:

• ask what personal information we hold about you;
• obtain a copy of it;
• correct inaccurate information;
• ask for information to be deleted where applicable;
• restrict or object to certain processing;
• receive certain information in a portable form where applicable; and
• withdraw consent where processing is based on consent.

These rights are subject to the conditions and exceptions provided by law. For example, we may need to retain transaction or accounting records even if you ask us to delete other information.

You also have the right to make a complaint to the Commission Nationale de l'Informatique et des Libertés (CNIL), the French data-protection authority.

Children

shiftinglight.com is not directed specifically at children and we do not knowingly use the website to collect personal information from children for marketing purposes.

Changes to this policy

We may update this privacy policy when the website, the services we use or legal requirements change. The date at the top of the page indicates when it was last updated.

Contact

If you have a question about this privacy policy, want to know what personal information we hold about you, or want to exercise your data-protection rights, please contact Julian Merrow-Smith, shiftinglight.com, France, using the contact form.