Privacy Policy
Data protection and cookies for anastasijasarajeva.com
Last updated: 3 September 2026
I respect your privacy. This policy explains what personal data I collect, why I use it, who receives it, how long I keep it, and the choices and rights available to you when you visit this website, contact me, join my newsletter or buy an original artwork.
Please read this policy together with my Terms & Conditions and Shipping & Delivery information.
Personal data means information relating to an identified or identifiable person. Information that has been genuinely anonymised so that nobody can be identified is not personal data.
1. Who I am and who is responsible
This website is operated by Anastasija Sarajeva, a self-employed sole trader based in the United Kingdom. I am the controller of the personal data described in this policy where I decide why and how it is used.
Business and correspondence address:
Anastasija Sarajeva
4 Queens Road
The Old Town Hall, Huddle
SW19 8YB
United Kingdom
Email: info@anastasijasarajeva.com
Website: anastasijasarajeva.com
I have not appointed a data protection officer. Please use the contact details above for any privacy question, rights request or complaint.
Some service providers also decide independently how to use limited information for their own purposes, such as platform security, fraud prevention, regulatory compliance and service improvement. Their own privacy notices apply to that processing. The relevant notices are linked at the end of this policy.
2. Personal data I collect
Depending on how you interact with me, I may collect the following information.
Identity and contact details
Your name, email address, telephone number, billing address, delivery address, country and any delivery instructions you choose to provide.
Enquiry and correspondence details
Your message, the artwork title or reference, your Instagram username where relevant, and correspondence by form, email, telephone or Instagram.
Order and transaction details
The artwork ordered, order number, price, payment status, order date, delivery status, and records of cancellations, returns, refunds, complaints and disputes.
Payment-related details
Stripe collects the card and authentication information needed to process payment. I do not receive or store your complete card number. I receive limited confirmation and transaction information, such as payment status and the payment method type.
Delivery and customs details
Recipient contact details, parcel tracking, proof of delivery, customs information, import or export documentation, and information needed for an insurance or damage claim.
Newsletter details
Your email address, first name, country or location, consent records, subscription status, and campaign delivery, opening and link-click information made available by MailerLite.
Website and device details
Your internet protocol address, browser and device type, operating system, referring page, approximate location derived from technical data, pages viewed, timestamps, interactions, cookie or similar identifiers, and consent choices. Optional analytics and advertising data is collected only as explained in section 5.
Privacy administration details
Records of consent, withdrawals, objections, rights requests, identity checks where reasonably necessary, and privacy complaints.
I do not ask for special category data, such as information about health, ethnicity, religion or sexual orientation, or criminal-offence data. Please do not include such information in a contact form, email or order note unless it is genuinely necessary and we have first agreed a secure way to handle it.
You are not obliged to provide personal data. However, some information is needed to enter into or perform a contract with you—for example, your contact, billing and delivery details when you place an order.
If that information is not provided, I may be unable to accept your order, deliver the artwork or respond to your request.
3. How I receive personal data
I receive personal data:
Directly from you when you use checkout, submit an enquiry, subscribe, email, telephone, message through Instagram, exercise a right or otherwise communicate with me.
From Squarespace, Stripe and MailerLite when they provide the website, commerce, payment and newsletter services I use.
From your browser or device through necessary website functions and, where you consent, Google Analytics, Meta Pixel or other optional technologies.
From couriers, customs authorities, payment providers, insurers and professional advisers where needed to deliver an order, resolve a problem, meet a legal duty or protect legal rights.
If you give me another person’s personal data, such as a recipient’s delivery details, you must have authority to do so and should make this policy available to them.
4. How and why I use personal data
UK data protection law requires a lawful basis for each use of personal data. The main purposes and lawful bases I rely on are set out below. Where EU or EEA data protection law also applies, the corresponding lawful bases are used.
Enquiries and pre-sale discussions
I use personal data to answer questions, identify an artwork and take steps you request before a possible purchase.
Lawful basis: steps before entering a contract; legitimate interests for general enquiries that do not lead to a contract.
Orders and payments
I use personal data to accept, verify, administer and take payment for an order, send confirmations and provide customer service.
Lawful basis: contract; legitimate interests in secure order administration; legal obligation where applicable.
Delivery, customs and after-sales service
I use personal data to pack and deliver an artwork, provide tracking, manage customs, cancellations, returns, refunds, loss, damage or insurance claims.
Lawful basis: contract; legal obligation; legitimate interests in resolving delivery and claims fairly.
Tax, accounts and legal compliance
I use personal data to maintain records, prepare accounts and tax returns, respond to lawful requests, screen restricted transactions and comply with customs, sanctions and other law.
Lawful basis: legal obligation; legitimate interests in operating a compliant business and protecting legal rights.
Security, fraud prevention and legal claims
I use personal data to protect the website, payments, artworks, customers and business; detect misuse; preserve evidence; and establish, exercise or defend claims.
Lawful basis: legitimate interests; legal obligation where a specific duty applies.
Newsletter
I use personal data to send art news, new-work announcements and related marketing to people who actively opted in, and to measure campaign delivery and engagement.
Lawful basis: consent. I do not rely on the customer “soft opt-in” for the newsletter.
Basic website measurement
I use information to understand aggregate page views and keep the website useful while non-essential cookies and identifiers remain restricted.
Lawful basis: legitimate interests in maintaining and improving the website. No Google Analytics or Meta Pixel data is sent before consent.
Optional analytics and advertising
After your choice, I use personal data to understand website use through Google Analytics and measure advertising through Meta Pixel or another disclosed marketing tool.
Lawful basis: consent for the storage or access technology and the related personal-data processing.
Rights requests and privacy complaints
I use personal data to verify, investigate, record and respond to a request or complaint and demonstrate compliance.
Lawful basis: legal obligation; legitimate interests in handling requests consistently and keeping appropriate evidence.
My legitimate interests are the practical interests described above. Before relying on them, I consider whether the use is necessary and whether your interests or rights should take priority. You may object to processing based on legitimate interests; see section 11.
Where I rely on consent, you may refuse or withdraw it at any time without affecting the lawfulness of processing before withdrawal.
Declining optional cookies or marketing does not prevent you from viewing the website or buying an artwork.
5. Cookies and similar technologies
Cookies, pixels, local storage and similar technologies can store information on, or access information from, your device.
A cookie banner and a persistent Cookie Settings control are available on the website so that you can make and later change your choices.
Necessary website functions
Squarespace may use technologies required for security, network management, checkout, shopping-cart functions, payments, fraud prevention and remembering privacy choices.
These operate without optional consent because the site or service you requested cannot work properly without them.
Before you consent
The site restricts Squarespace non-essential cookies. Squarespace may still provide basic, cookie-free page-view counts for aggregate site measurement, but its unique-visitor analytics cookies remain blocked.
Google Analytics, Meta Pixel and any other optional tracking tag do not load, set identifiers or send data before the relevant consent choice.
After you consent to analytics
Squarespace analytics cookies and Google Analytics may distinguish browsers or sessions and collect website interaction and device information so I can understand audience and site performance.
Google Analytics will be used for measurement and will not be linked to Google advertising products unless the notice and consent choices are updated.
After you consent to marketing
Meta Pixel may collect browser and device identifiers, page views and actions such as viewing an artwork, beginning checkout or completing a purchase.
This helps measure or improve advertising. Meta may combine information with data it already holds as described in its own privacy policy.
Changing your choice
Use the Cookie Settings control in the website footer at any time. Rejecting must be as easy as accepting.
You can also clear or block cookies in your browser, although doing so may affect checkout or other necessary functions. Withdrawal applies from that point onward.
Embedded content
No Instagram, YouTube or Vimeo content is currently embedded.
Before any third-party embed is added, I will assess it, update this policy and the cookie information, and block non-essential storage, access or data transfer until the visitor has made the appropriate choice.
Cookie information
Cookie names, providers and lifespans can change when Squarespace or another service is updated.
I will maintain a current cookie inventory through the live cookie information and periodically test the site to confirm that optional technologies remain blocked before consent.
6. Newsletter and other marketing
MailerLite manages and sends my newsletter. The signup form may ask for your email address, first name and country or location.
I use that information to administer the list, address messages and understand the broad location of my audience. MailerLite may also record delivery, opening, link-clicking, bouncing and unsubscribing so I can operate and improve the newsletter.
I send marketing only to people who have actively opted in.
Buying an artwork, sending an enquiry or contacting me through Instagram or email does not by itself add you to the newsletter. I do not rely on the UK customer soft opt-in.
You can unsubscribe at any time using the link in every marketing email or by contacting me.
Your active newsletter profile will then be removed or marked unsubscribed, but I may retain the minimum information needed on a suppression list so that I do not send marketing to you again by mistake.
7. Who receives personal data
I disclose only the personal data reasonably needed for each purpose. The main recipients are listed below.
Squarespace
Website hosting, forms, commerce, order administration, privacy choices and native analytics. It generally processes customer-controlled form and order data for me, while also using certain technical data for its own stated purposes.
Stripe
Card payment processing, authentication, fraud prevention, refunds, disputes and regulatory compliance. Stripe receives payment and transaction information; I do not receive your complete card details.
MailerLite
Newsletter signup, list management, campaign delivery, consent records and campaign engagement reporting.
Google Workspace
Gmail for correspondence and Google Drive or Google Sheets for securely organised customer, order and business records.
Google Analytics
Optional website measurement after analytics consent only.
Meta
Instagram communications and, after marketing consent, Meta Pixel advertising measurement. Meta’s own terms and privacy notice also apply to its services.
UK accountant
Accounting, tax returns, financial records and professional advice, subject to professional confidentiality and data-protection duties.
Couriers, logistics providers and insurers
Delivery, tracking, proof of delivery, loss or damage handling and insurance claims. The provider may vary by artwork and destination.
Authorities and advisers
Customs and tax authorities, law enforcement, courts, regulators, insurers, legal advisers or IT and security specialists where required by law or reasonably necessary to protect rights, systems, people or property.
I do not sell or rent personal data. I do not permit service providers acting only on my instructions to use customer-controlled information for their own marketing.
8. International transfers
I am based in the United Kingdom. Some providers use infrastructure, group companies or subprocessors in the European Economic Area, the United States and other countries. This can mean that personal data is accessed from or transferred outside the United Kingdom.
Where a restricted transfer occurs, I rely on an applicable UK adequacy regulation, the UK Extension to the EU–US Data Privacy Framework where valid and relevant, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another safeguard permitted by law.
I also consider whether supplementary security measures are appropriate.
For an international order, limited delivery and customs data may need to be sent to a courier, customs authority or delivery partner in the destination country because the transfer is necessary to perform the sales contract or take steps you request. I minimise the information used for that purpose.
Contact me if you would like more information about the safeguard relevant to a particular service or a copy of its main terms, subject to lawful redactions.
9. How long I keep personal data
I keep personal data only for as long as reasonably needed for the purpose collected, including legal, accounting, tax, security and dispute requirements.
My normal retention schedule is set out below.
Unsuccessful enquiries
12 months from the last meaningful contact, unless a dispute or legal reason requires longer.
Orders, tax and accounting records
6 years after the relevant transaction or the end of the applicable accounting period, as appropriate.
Returns, complaints and disputes
6 years after the matter is closed, unless a longer period is required for an active claim or by law.
Newsletter profile
Until you unsubscribe or withdraw consent, after which active marketing use stops without undue delay.
Marketing suppression record
The minimum email address and opt-out evidence while I continue that marketing activity, so your choice is respected.
Google Analytics
Where enabled, user-level and event-level retention is configured for no longer than 14 months. Aggregated reports may remain after identifiers are removed.
Consent, rights and complaint records
For as long as reasonably needed to operate or demonstrate the relevant choice, request or response, subject to periodic review.
Security and platform logs
According to the shortest practical provider setting and the provider’s documented security, backup and deletion cycle.
When a retention period ends, I delete, securely destroy or anonymise the information.
Data may remain for a limited time in isolated backups until the normal backup cycle completes. Genuinely anonymised statistics may be retained because they no longer identify anyone.
10. Security
I use proportionate technical and organisational measures designed to protect personal data from accidental or unlawful loss, alteration, disclosure, access or destruction.
These include encrypted website connections, reputable hosted service providers, access controls, strong account security, multi-factor authentication where available, limited access to business records, and appropriate provider agreements.
No internet or storage system can be guaranteed completely secure.
Please do not send complete card details, account passwords or unnecessary sensitive information by email, contact form or social media. Payments should be completed only through the website’s Stripe checkout.
11. Your data-protection rights
Depending on the circumstances and applicable law, you may have the right to:
Ask whether I use your personal data and receive a copy of it.
Have inaccurate or incomplete information corrected.
Ask for personal data to be erased in certain circumstances.
Ask me to restrict how personal data is used in certain circumstances.
Receive personal data you provided in a structured, commonly used and machine-readable format, and ask for it to be transferred where the portability right applies.
Object to processing based on legitimate interests, including basic website measurement, and object at any time to direct marketing.
Withdraw consent at any time.
Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects, where that right applies.
Rights are not absolute and legal exceptions may apply.
To exercise a right, email info@anastasijasarajeva.com or write to the address in section 1. Please describe your request clearly. I may ask for information reasonably needed to confirm your identity and locate the relevant records.
I normally respond without undue delay and within one month. The period may be extended by up to two further months for a complex request or multiple requests; if so, I will explain within the first month.
There is normally no fee, but the law permits a reasonable fee or refusal in limited cases involving a manifestly unfounded or excessive request.
12. Privacy complaints
You have a legal right to complain to me directly about how your personal data has been used.
Please contact me first if you are concerned about how I have used personal data. You can:
Email info@anastasijasarajeva.com with the subject line “Privacy complaint”.
Use the website contact form.
Write to the address in section 1.
Include your contact details, what happened and the outcome you seek.
I will acknowledge a privacy complaint as soon as reasonably possible and in any event within 30 days, and will respond without undue delay.
I aim to provide a substantive response within 10 working days. If more time is reasonably needed, I will explain why and keep you informed.
You also have the right to complain to the UK Information Commissioner’s Office (ICO). Information is available on the ICO’s data-protection complaints page.
You may also contact the data-protection authority where you live or work if another law applies.
13. Children
The website and its sales service are not directed at children, and an order may be placed only by a person aged 18 or over.
I do not knowingly seek personal data from children.
If you believe a child has provided personal data without appropriate authority, please contact me so I can review and, where appropriate, delete it.
14. Automated decisions
I do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
Squarespace, Stripe, card issuers or other providers may use automated systems for security, authentication, fraud prevention or regulatory checks under their own notices. This can result in a payment being delayed or declined.
Contact me if you believe an order problem needs human review; you may also need to contact Stripe or your card issuer.
15. Changes to this policy
I may update this policy when the website, service providers, shipping arrangements or law changes.
The current version will be posted on the website and the date at the top will be revised.
If a change is material, I will provide a more prominent notice and seek fresh consent where the law requires it.
16. Provider privacy information
These provider notices explain how the main platforms handle information within their own services and for purposes they determine. They do not replace this policy.
For questions about this policy or how I handle personal data, contact info@anastasijasarajeva.com.