Privacy policy

Last updated: 9 October 2026

This policy explains what personal data The Alt Art Co collects when you visit thealtart.co, buy from us or contact us, why we collect it and what your rights are.

Who is responsible for your data

The data controller is Jamie Rookyard, trading as The Alt Art Co, Lytchett House, 13 Freeland Park, Wareham Road, Poole, Dorset, BH16 6FA, United Kingdom. For anything about your data, email hello@thealtart.co.

What we collect

Order details: your name, delivery and billing address, email address, phone number (if you give it), what you bought and your order history. Payments are handled by Shopify Payments or another provider you choose (such as PayPal or Apple Pay). We never see or store your full card details.
Account details: if you sign in to a customer account, your email and saved addresses.
Messages: whatever you tell us through the contact form or by email (for example card names and photos for custom requests).
Newsletter: your email address and when and how you signed up.
Device and usage data: IP address, browser and device type, pages viewed and how you reached the site. This is collected through cookies and similar technologies, mostly by Shopify. See our Cookie policy.

Why we use it and our lawful basis

Purpose	Lawful basis (UK GDPR)
Taking payment, printing and delivering your order, sending order and shipping emails, handling returns	Contract
Keeping sales records for tax and accounting (HMRC)	Legal obligation
Replying to messages and custom requests	Legitimate interests (answering your enquiry); contract if it leads to an order
Sending our newsletter and offers	Consent. You can unsubscribe at any time using the link in every email.
Running our affiliate programme (crediting affiliates, paying commission)	Contract (with affiliates); consent for referral cookies
Analytics and marketing cookies	Consent (through our cookie banner)
Keeping the site secure and preventing fraud	Legitimate interests

We don't sell your personal data, and we don't make decisions about you based solely on automated processing.

Who we share it with

We only share what each service needs to do its job:

Shopify: runs our shop, checkout, payments, customer accounts and emails. Shopify's privacy policy: shopify.com/legal/privacy.
Payment providers (Shopify Payments / Stripe, PayPal and similar, if you use them): to process your payment and prevent fraud.
Royal Mail (Click & Drop): your name, address and, for tracked or international services, your email or phone number, to deliver your parcel. For international orders, customs authorities receive the details on the customs declaration.
BixGrow: runs our affiliate programme. If you arrive via an affiliate's link and accept marketing cookies, BixGrow records the referral and, if you buy, the order so the affiliate can be credited. If you join our affiliate programme, BixGrow holds your name, email, social links and payout details.
Porkbun: our domain registrar, which also forwards email sent to our address.
GitHub: our Set Finder loads Pokémon sprite images from GitHub's servers, which receive your IP address when the images load.
Professional advisers, or authorities where the law requires it.

Some of these providers process data outside the UK (for example in Canada, the US or the EU). Where they do, transfers are covered by UK adequacy regulations or by the UK International Data Transfer Agreement or Addendum.

How long we keep it

Order and payment records: 6 years after the end of the tax year they relate to (HMRC requirement).
Messages and custom request details: up to 2 years after our last contact, unless they become part of an order.
Newsletter: until you unsubscribe. After that we keep a suppression record so we don't email you again.
Cookies: see our Cookie policy.

Your rights

Under UK data protection law you have the right to:

access a copy of your personal data;
have inaccurate data corrected;
have your data deleted (unless we have to keep it, for example for tax records);
restrict or object to how we use it, including objecting to direct marketing at any time;
data portability;
withdraw consent at any time (this doesn't affect anything we did before you withdrew it).

To use any of these rights, email hello@thealtart.co. We'll reply within one month. You can change your cookie choices at any time using the "Cookie preferences" link in the footer.

If you're unhappy with how we've handled your data, please tell us first. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, 0303 123 1113.

US residents: you can opt out of the "sale" or "sharing" of personal information for targeted advertising on our Your privacy choices page. We also honour Global Privacy Control signals.

Children

Our shop isn't aimed at children under 13, and we don't knowingly collect their data. Under-18s need a parent's or guardian's permission to order. If you think a child has given us their data, contact us and we'll delete it.

Security

The site and checkout run over encrypted (HTTPS) connections on Shopify's PCI-DSS compliant platform. Access to order data is limited to us and the service providers listed above.