Last updated: 26 July 2026
Who we are
Dan Johnson Art is a sole trader business operated by Dan Johnson, based in Sheffield, UK. Our website address is https://danjohnsonart.co.uk. For any privacy enquiries, contact dan@danjohnsonart.co.uk.
What data we collect and why
Enquiries and contact forms
When you use our contact form, we collect your name, email address, and the content of your message. We use this information solely to respond to your enquiry. Lawful basis: legitimate interest (responding to a genuine enquiry).
Newsletter and marketing emails
If you subscribe to our mailing list, we collect your email address and, optionally, your name. We use this to send you emails about new paintings, exhibitions, workshops, and studio news. Lawful basis: consent (you opt in; you can unsubscribe at any time via the link in every email).
We retain your email address until you unsubscribe or request deletion.
Our sign-up form is protected by Cloudflare Turnstile, which checks that a submission comes from a person rather than an automated script. It runs in invisible mode, so there is nothing for you to click. To do this, Cloudflare processes technical signals including your IP address, User-Agent header, TLS fingerprint, and the site key and origin of the form, and uses them for bot detection and blocking. Cloudflare acts as our processor for this. For details see Cloudflare’s Turnstile Privacy Addendum. Lawful basis: legitimate interests (protecting the form from automated abuse).
Orders and purchases
When you place an order, we collect your name, billing and shipping address, email address, phone number, and payment details. We use this to process and fulfil your order, manage your account, and comply with tax and accounting obligations. Lawful basis: contract (order fulfilment) and legal obligation (tax records).
Order data is retained for 6 years for tax and accounting purposes.
Comments
If you leave a comment on the site, we collect your name, email address, and IP address. Email addresses are not published. Lawful basis: legitimate interest (managing comments and preventing spam).
Cookies
We use cookies for the following purposes:
| Cookie type | Examples | Consent required? |
|---|---|---|
| Strictly necessary | Cart contents, login session, payment session | No — always active |
| Spam prevention | Akismet spam detection (ak_js) | No — strictly necessary |
| Functional | Cookie consent preferences (Complianz) | No — strictly necessary |
| Marketing/analytics | Brevo email tracking | Yes — only after you accept |
You can manage your cookie preferences using the banner on this site. Strictly necessary cookies cannot be disabled as the site cannot function without them.
Who we share your data with
We do not sell your personal data. We share data only with the processors listed below, each under a data processing agreement or equivalent contractual protection.
| Processor | Purpose | Privacy policy |
|---|---|---|
| SiteGround | Website hosting | siteground.com/privacy.htm |
| Automattic / WordPress.com | Website CMS and contact form processing (Jetpack Forms) | automattic.com/privacy |
| WooCommerce | Order and shop management | woocommerce.com/privacy-policy |
| Brevo (Sendinblue) | Email marketing and automation | brevo.com/legal/privacypolicy |
| Stripe | Payment processing | stripe.com/gb/privacy |
| PayPal | Payment processing | paypal.com privacy policy |
| Akismet | Spam detection for forms and comments | automattic.com/privacy |
| Complianz | Cookie consent management | complianz.io/privacy-statement |
| Cloudflare | Bot protection on the newsletter sign-up form (Turnstile) | cloudflare.com/privacypolicy and Turnstile Privacy Addendum |
Where your data is stored and international transfers
Most of the services we use hold data in the UK or the European Economic Area (EEA). Some are based in the United States, which means your personal data may be transferred outside the UK. Where that happens, we rely on one of the safeguards permitted under UK GDPR.
| Processor | Where your data may be held | Safeguard |
|---|---|---|
| SiteGround | Bulgaria (EEA) | Covered by UK adequacy regulations for the EEA |
| Brevo (Sendinblue) | France (EEA) | Covered by UK adequacy regulations for the EEA |
| Complianz | Netherlands (EEA) | Covered by UK adequacy regulations for the EEA |
| Automattic (WordPress.com, Jetpack, Akismet, WooCommerce) | United States | UK Extension to the EU-U.S. Data Privacy Framework |
| Cloudflare | United States | UK Extension to the EU-U.S. Data Privacy Framework, with Standard Contractual Clauses and the UK Addendum as a fallback |
| Stripe | Ireland (EEA), with onward transfers to the United States | UK Extension to the EU-U.S. Data Privacy Framework |
| PayPal | United Kingdom | Your contract is with PayPal UK Ltd, a UK-established company, so we make no transfer outside the UK. Any onward transfers within the PayPal group are covered by PayPal’s own safeguards |
If you would like more detail about the safeguards applying to any of these transfers, or a copy of the relevant documents, email dan@danjohnsonart.co.uk.
Your rights
Under UK GDPR you have the right to:
- Access — request a copy of the personal data we hold about you
- Rectification — ask us to correct inaccurate data
- Erasure — ask us to delete your data (subject to legal retention requirements)
- Portability — receive your data in a portable format
- Objection — object to processing based on legitimate interest
- Restriction — ask us to restrict processing in certain circumstances
We do not use automated decision-making or profiling.
To exercise any of these rights, email dan@danjohnsonart.co.uk. We will respond within one month.
If you are unhappy with how we handle your data, you have the right to complain to the Information Commissioner’s Office (ICO): ico.org.uk.
Data retention summary
| Data | Retention period |
|---|---|
| Newsletter subscribers | Until unsubscribed or deletion requested |
| Order data | 6 years (legal requirement) |
| Contact form enquiries | 2 years, or until resolved |
| Comments | Indefinitely unless deletion requested |
Embedded content
Pages on this site may include embedded content from other websites (e.g. Instagram). Embedded content behaves as if you had visited those websites directly and may set its own cookies.
Future processors
We may add additional processors in future (for example, advertising platforms). This policy will be updated before any new processor goes live.
If you have any questions about this policy, email dan@danjohnsonart.co.uk.
