Privacy policy.

Who we are

This website is run by Luis Alvarez Art & Interiors Limited ("we", "us"), a company registered in England and Wales (Company No. 14874620), registered office 74 Commodore House, 2 Admiralty Avenue, London E16 2PY. We are the controller of the personal information described here.

Questions about your data: email info@luisalvarezarts.com or WhatsApp +44 7711 373168.

What we collect

• When you order: your name, email, phone number (optional), delivery address, what you bought, how much you paid and any notes for Luis.
• When you pay: your card or wallet details go straight to our payment provider, Stripe. We never see or store your full card number. Stripe tells us the payment went through and the type of payment used.
• When you enquire or ask about a commission: your name, email, phone number (optional) and your message, including any details of the piece you would like.
• When you join the Private View: your first name, email address, your mobile number if you choose to add it, and where you signed up (for example the stall, the footer or checkout).
• When you contact us on WhatsApp, Instagram, email or by phone: the details and messages you choose to send.
• Technical information: our hosting provider keeps short-term server logs (such as IP address, browser type and the pages requested) to keep the site secure and working.

Why we use it, and our legal basis

• To take, deliver and support your order, including answering questions and handling returns. Basis: to perform our contract with you.
• To reply to enquiries and quote for commissions. Basis: to take steps at your request before a contract, and our legitimate interest in answering you.
• To send Private View emails about new pieces and offers, and WhatsApp or text messages if you gave us your mobile number for this. Basis: your consent. You can unsubscribe at any time using the link in any email, by replying STOP to a message, or by asking us.
• To prevent fraud and keep the site secure. Basis: our legitimate interests and Stripe's fraud checks.
• To keep business and tax records. Basis: legal obligation.

We do not sell your information, and we do not use it for automated decisions that affect you.

Who helps us run the shop

We share only what each service needs to do its job, under agreements that require them to protect it:

• Stripe (payments and fraud prevention). See Stripe's privacy policy.
• Vercel (website hosting).
• Supabase (our order and product database, hosted in Frankfurt, Germany).
• Microsoft 365 (our business email).
• Delivery companies, such as Royal Mail or a courier, receive your name and delivery address so your parcel arrives.
• Email delivery provider, when we send order and Private View emails.
• Google Maps loads only if you choose to show the map on the Visit page.
• WhatsApp and Instagram (Meta) handle any messages you send us there, under their own privacy policies.
• Our accountant, and HMRC or other authorities where the law requires it.

Some of these providers may process data outside the UK, for example in the European Economic Area or the United States. Where that happens, the transfer is protected by UK adequacy regulations or approved safeguards such as the UK International Data Transfer Addendum.

How long we keep it

• Orders and payment records: 6 years after the end of the financial year they belong to, as required for tax and accounting.
• Enquiries and commission conversations: up to 2 years after our last contact, unless they lead to an order.
• Private View list: until you unsubscribe. We then keep only a record that you unsubscribed, so we don't email you again.
• Server logs: a short period, usually days or weeks, as set by our hosting provider.

Cookies and storage on your device

We keep things simple and do not use advertising or tracking cookies.

• Your basket and checkout choices (such as delivery option and country) are saved in your own browser, so they are still there if you come back. Nothing is sent to us until you check out.
• Stripe sets cookies on the checkout page that are needed to take payment safely and prevent fraud.
• Google Maps may set cookies, but only after you press the button to show the map.

If we ever add website analytics or other optional cookies, we will update this policy and ask for your permission first where the law requires it.

Your rights

Under UK data protection law you can ask us to:

• give you a copy of the personal information we hold about you;
• correct anything that is wrong or incomplete;
• delete your information, where we don't need to keep it;
• restrict or object to how we use it, including stopping marketing emails at any time;
• send your information to you or another organisation in a common format.

Email info@luisalvarezarts.com to make a request. We will reply within one month. It is free unless a request is clearly unfounded or excessive.

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

Keeping it safe

The website uses a secure (https) connection. Payments are handled by Stripe, which is certified to the highest card security standard (PCI DSS Level 1). Access to our order records is limited to Luis and the people who help him run the shop, and is password protected.

Children

Our shop is meant for adults, and some pieces contain strong language. We do not knowingly collect information from anyone under 16.

Changes to this policy

We may update this policy from time to time, for example when we add a new service. The date at the top shows when it last changed.