Privacy policy

Introduction

This Privacy Policy documents how we at Irish Landscape Art (“us”, “we”, or “our”) meet our obligations under data protection legislation (the Data Protection Act 2018 and the General Data Protection Regulation 2016/679 “GDPR”). This policy covers our processing activities as a controller of Personal Data.

Privacy Essentials

Principles of Data Processing

Article (5)(1) of the GDPR covers the principles of data processing. We are mindful of these principles at all times when processing Personal Data and will ensure that all processing is:

  • processed lawfully and fairly and that we are transparent about how and why we process data;
  • only collected when there is a specific purpose to do so and that we do not further process data in a manner that is incompatible with the original purpose;
  • accurate and, where necessary, kept up to date;
  • adequate, relevant and limited to what is necessary for the purpose for which it was collected;
  • only kept for as long as it is necessary for the purpose for which it was collected;
  • kept secure at all times and is protected against any unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures;

As per Article (5)(2) of the GDPR we will ensure that we are able to demonstrate compliance with the above listed principles and be held accountable at all times.

Data Subject Rights

Individuals have certain rights regarding their Personal Data, and it is important to us that we respect these rights so as individuals feel in control of their data. There are certain exemptions to these rights, should individuals look to exercise any of these rights, we will always be clear in our communications and inform them if an exemption applies.

Right of access: Individuals have the right to ask if we hold any of their Personal Data and, if we do, to receive copies of this data as well as details relating to the processing and any third parties in receipt of the data. However, certain exemptions may apply, and we will inform individuals of these on a case-by-case basis.

Right of rectification: If any of the Personal Data we hold is inaccurate, individuals have the right to request us to correct it.

Right to be forgotten: In certain circumstances, individuals have the right to request that we delete their Personal Data. Examples include:

  • where the data is no longer needed for the purpose for which it was originally collected;
  • where consent to use the data has been withdrawn (where there is no other legal reason us to use it);
  • there is no legal reason for us to process the data;
  • deleting the data is a legal requirement.

Right of restriction: Individuals can restrict the use of their data unless we have an overriding legitimate lawful purpose for continuing to process the data.

Right to data portability: Individuals have the right to ask for their Personal Data to be returned to individuals or given to another Data Controller in a commonly used format. This right only applies to Personal Data being processed under the lawful basis of consent or pursuant to a contract and the processing is automated and not manual. It does not apply where it would adversely affect the rights and freedoms of others.

Right to object: The instances where individuals have the right to object to the processing of their data is when the processing is:

  • based on the grounds of public interest or legitimate interest including profiling based on these grounds;
  • used for direct marketing purposes.

Rights relating to automated decision making/profiling: Individuals have the right not to be subject to a decision based solely on automated processing, including profiling which has legal effects on individuals. This right shall not apply where the processing:

  • is necessary for entering into, or performance of, a contract;
  • is based on their consent; or
  • is authorized by law.

Please note that we do not carry out any automated decision making.

Right to make a complaint: Individuals have the right to make a complaint to a relevant Supervisory Authority, in Ireland this is the Data Protection Commission (“DPC”). The contact details are:

Address: 6 Pembroke Row, Dublin 2. D02 X963
Web: www.dataprotection.ie
Tel: 01 765 0100 / 1800 437 737

Collection of Personal Data

In order to provide our services and to operate our website, we must process certain Personal Data. This data may be collected by various means including:

Providing our services: We receive and store information you provide directly to us when individuals:

  • make inquiries about our services;
  • subscribe to our service and create a profile;
  • interact with us about ILA subscriptions, payments or other administrative tasks.

From our website, social media pages: We may collect any personal information that individuals choose to send to us or provide to us including:

  • when visiting our website, we collect certain information related to a device,
  • when individuals provide their details using any of the “Contact” pages on our website;
  • if engaging with us through our social media platforms;
  • when you engaging with us at an event.

Types pf Personal Data

The table below relates solely to data that we process as a Data Controller. Details of data we process as a Data Processor will be documented in individual contracts with our clients.

Personal Data Type Description
Contact & Identity Name, address, email, phone number
Communication & correspondence Email correspondence, phone communications or any other method of communication
Financial data Card details, subscription payments, sale of painting details.

(Note: we use Stripe for all card details and payment processing and do not store card data in open format at any time)
Web & social media Website: your device’s IP address, referring website, what pages your device visited, date and time of visit. Analytical information through Google Analytics

Social Media: photo, contact details, occupation, job title, qualifications
Profile information Details of your experience as an artist, your work and any biographical information you choose to add to your profile on our website

Purposes for Processing

In compliance with data protection legislation, we must have a defined purpose for any processing of Personal Data. We may use the information we collect for a range of reasons, including to:

  • provide, operate and maintain our website and services;
  • process and complete transactions, and send related information, including transaction confirmations;
  • manage our customers’ use of our services, respond to enquiries and comments and provide support;
  • investigate and prevent fraudulent activities, unauthorized access, and other illegal activities; 
  • for any other purposes about which we notify our customers;
  • to fulfil our legal and contractual obligations; and
  • to provide information about any events.

Lawfulness of Processing

As a Data Controller, we will determine the appropriate lawful basis for all processing of personal data. Here we provide further information about the legal grounds we have for processing Personal Data as a Data Controller:

Lawful Basis Details
Performance of a contract
  • to contact you in connection with our services under our Terms & Conditions; 
  • to contact you regarding payments;
  • to manage the services we provide to you; and
  • to process payments
Consent
  • to operate cookies on our website
Legitimate Interests When using this lawful basis, we will ensure that the legitimate interest pursed does not infringe on your privacy right. Our legitimate interests include:

  • providing the best services to our customers;
  • conducting analytics and research on our products and services so that we can continuously improve;
  • protecting our intellectual property rights;
  • promoting and growing our business;
  • ensuring the security of our website and our products and services
Legal Obligation
  • to maintain proper accounts;
  • to report to law enforcement any actions we deem to be illegal

Data Sharing & Transfers

We may employ third party companies and individuals (“Service Providers”),  to assist us in providing our services.

These third parties have access to Personal Data only to perform these tasks on our behalf, they are engaged under contract and are bound by a duty of confidentiality.

Examples of such third parties include:

  • Our website developers
  • Business advisors
  • Professional services (legal, accounting)
  • Though the use of cloud hosting platforms

We do not transfer data outside of the European Economic Area (EEA).

Security & Retention of Personal Data

We will always ensure the confidentiality, integrity, availability, and resilience of personal data we store.  We are obliged to protect the data from inadvertent destruction, amendment, loss, disclosure, corruption, or unlawful processing. We have appropriate technical and organisational measures in place to protect data but individuals should be aware that the transmission of data over the internet will never be fully without risk.

We only keep personal data as long as it is necessary for the purposes for which it was originally collected or to comply with legal requirements. Where possible we record how long we will keep data, where that is not possible, we will explain the criteria for the retention period. Once the retention period has expired, the respective data will be permanently deleted. In most cases we will retain data for the duration of our relationship with a customer. 

Changes to This Privacy Policy

We will review this policy at least annually or in line with any changes or updates. All website visitors and subscribers should continually check this policy for any changes.

Should you require any further information on our processing, please email ILA at info@irishlandscapeart.ie