Privacy Policy
Wizard Bones Art Ltd
Last updated: 14th September 2026
Wizard Bones Art Ltd ("Wizard Bones", "we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains what personal data we collect when you visit our website at www.wizardbonesart.co.uk (the "Website") or place an order with us, how we use it, who we share it with, and what rights you have.
We are a small, owner-run limited company with one employee (the business owner). We only collect the personal data we genuinely need to run our shop and portfolio website, and we keep this policy as simple as possible.
## 1. Who We Are
Wizard Bones Art Ltd is a company registered in England and Wales under company number 16816752.
For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), Wizard Bones Art Ltd is the "data controller" of the personal data described in this policy.
If you have any questions about this policy or how we handle your data, please contact us at: wizardboooonesartwork@outlook.com
## 2. No Customer Accounts – Guest Checkout Only
Our Website does not offer customer accounts. All purchases are made as a guest checkout. We do not store a persistent customer profile, purchase history dashboard, or saved login for you beyond what is described in this policy.
## 3. What Personal Data We Collect
We only collect personal data that is necessary to operate the Website, process your order, and respond to enquiries. This includes:
### 3.1 Information you give us directly
- Name
- Delivery address and, where different, billing address
- Email address
- Telephone number (if provided at checkout, for delivery purposes)
- Order details (products purchased, order value, any personalisation instructions for bespoke/custom items)
- Any information you send us via email, our website contact form, or social media messages (for example, customer service enquiries)
### 3.2 Payment information
Payment card details are entered directly into, and processed by, our payment processor(s) (see clause 6). We do not see, collect or store your full card number, CVV or expiry date on our own systems.
### 3.3 Information collected automatically
Our Website is hosted on Squarespace, which may automatically collect limited technical information when you browse the Website, such as:
- IP address
- Browser type and device information
- Pages visited and time spent on the Website
- Referring website
- Cookie identifiers (see clause 8)
This information is collected via Squarespace's own platform infrastructure and any analytics or cookie tools enabled on the Website.
### 3.4 Information we do not collect
Because we do not offer accounts, we do not collect or store:
- Account passwords
- Saved payment methods
- Wishlists or browsing profiles tied to a named account
## 4. How and Why We Use Your Data
We use your personal data only for the following purposes:
| Purpose | Data used | Legal basis |
|---|---|---|
| Processing and fulfilling your order | Name, address, email, phone, order details | Performance of a contract with you |
| Taking payment | Payment details (via payment processor) | Performance of a contract with you |
| Arranging delivery/shipping | Name, delivery address, email | Performance of a contract with you |
| Responding to customer enquiries or complaints | Name, email, message content | Performance of a contract / legitimate interests in providing customer service |
| Producing print-on-demand items via Printful | Name, delivery address, order/design details | Performance of a contract with you |
| Complying with tax, accounting and legal obligations | Order and transaction records | Legal obligation |
| Preventing fraud and protecting our business | Order and contact details | Legitimate interests |
| Operating and improving the Website (via Squarespace analytics/cookies) | Technical/usage data | Consent (for non-essential cookies) / legitimate interests (for essential functionality) |
| Marketing communications (only if you opt in) | Name, email | Consent |
We do not use your personal data for any automated decision-making or profiling that produces legal or similarly significant effects on you.
## 5. Marketing
We will only send you marketing emails (for example, about new artwork or products) if you have actively opted in to receive them, for example by subscribing via a sign-up form on the Website. You can unsubscribe at any time using the link in any marketing email, or by contacting us at wizardboooonesartwork@outlook.com. We will never sell your personal data to third parties for their own marketing purposes.
## 6. Who We Share Your Data With
As a small business, we rely on a limited number of trusted third-party service providers to run our Website and fulfil orders. We only share the personal data necessary for each provider to perform their function:
- Squarespace, Inc. – our website hosting and e-commerce platform provider, which processes order, checkout and technical/analytics data on our behalf to operate the Website and store.
- Printful – our print-on-demand manufacturing and fulfilment partner, who receives the name, delivery address and order/design details necessary to produce and ship print-on-demand products directly to you.
- Payment processor(s) integrated with our Squarespace checkout (for example, Stripe and/or PayPal, depending on what is enabled at checkout) – who process your payment details directly and securely; we do not receive or store your full card details.
- Delivery/courier companies – who receive the name and delivery address necessary to deliver your order.
- Professional advisers (for example, our accountant), where necessary for tax, accounting or legal compliance.
- Law enforcement or regulatory authorities, where we are legally required to disclose information.
We do not sell your personal data to third parties, and we do not share it with any third party for their own independent marketing purposes without your consent.
Some of these providers (such as Squarespace and Printful) may process data on servers located outside the UK, including in the United States. Where this occurs, we rely on appropriate safeguards required under UK data protection law, such as the provider's participation in an approved data transfer mechanism (for example, the UK Extension to the EU-US Data Privacy Framework, or Standard Contractual Clauses / the UK International Data Transfer Addendum). You can find more information in Squarespace's and Printful's own privacy policies.
## 7. How Long We Keep Your Data
We only keep personal data for as long as necessary for the purposes described in this policy:
- Order and transaction records: retained for 6 years from the end of the relevant tax year, in line with UK HMRC record-keeping requirements for a limited company.
- Customer service correspondence: retained for as long as reasonably necessary to resolve your enquiry and for a reasonable period afterwards in case of follow-up queries (typically no more than 2 years).
- Marketing opt-ins: retained until you unsubscribe or withdraw consent.
- Website technical/analytics data: retained in accordance with Squarespace's own data retention settings and any cookie consent preferences you set (see clause 8).
After the applicable retention period, we will securely delete or anonymise your personal data.
## 8. Cookies
Our Website, hosted on Squarespace, may use cookies and similar technologies to operate correctly and to understand how visitors use the site. Cookies may include:
- Strictly necessary cookies – required for core Website and checkout functionality (for example, remembering items in your basket). These cannot be switched off as they are essential to the Website working.
- Analytics/performance cookies – used to understand visitor numbers and behaviour, helping us improve the Website. These are only set with your consent, where required.
- Third-party cookies – which may be set by embedded content or services (for example, payment providers or social media sharing buttons).
Where a cookie consent banner is presented on the Website, you can choose which non-essential cookies to accept or reject. You can also control or delete cookies through your browser settings at any time; please note that disabling essential cookies may affect the functionality of the Website, including checkout.
## 9. Your Rights
Under UK data protection law, you have the following rights in relation to your personal data:
- Right of access – to ask us for a copy of the personal data we hold about you.
- Right to rectification – to ask us to correct inaccurate or incomplete data.
- Right to erasure – to ask us to delete your personal data, where applicable (note this may be limited where we have a legal obligation to retain order/tax records).
- Right to restrict processing – to ask us to limit how we use your data in certain circumstances.
- Right to object – to object to our processing of your data, including for direct marketing purposes.
- Right to data portability – to ask us to provide your data in a portable format, where technically feasible and applicable.
- Right to withdraw consent – where we rely on your consent (for example, for marketing emails or non-essential cookies), you can withdraw this at any time.
To exercise any of these rights, please contact us at [insert contact email]. We will respond within one month, in accordance with UK GDPR requirements. We may need to verify your identity before actioning certain requests.
You also have the right to lodge a complaint with the UK's data protection regulator, the Information Commissioner's Office (ICO), at [www.ico.org.uk](https://www.ico.org.uk) or by calling 0303 123 1113, if you believe we have not handled your personal data properly. We would, however, appreciate the opportunity to address your concerns directly first — please get in touch with us in the first instance.
## 10. Data Security
As a small business, we take reasonable and proportionate steps to protect your personal data, including relying on the security measures built into Squarespace's hosting and checkout infrastructure and reputable third-party payment processors, who are themselves required to comply with data protection and payment card industry (PCI DSS) security standards. While we take data security seriously, no method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security.
## 11. Children's Privacy
Our Website and products are not directed at children, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.
## 12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time, for example to reflect changes in the law or in how our Website and business operate. Any changes will be posted on this page with a revised "Last updated" date. We encourage you to review this policy periodically.
## 13. Contact Us
If you have any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact:
Wizard Bones Art Ltd
Email: wizardboooonesartwork@outlook.com
---
This Privacy Policy should be read alongside our separate Terms and Conditions and Returns & Refunds Policy.