PRIVACY POLICY

This explains what happens to your information when you use corrodeandcrown.com or get in touch with me, and what your rights are under UK GDPR.

Who is responsible for your data

Corrode & Crown is an independent studio run by one person in Wales. I am the data controller, which means I am the one who decides what happens to anything you give me, and I am the one you hold responsible for it.

You can get in touch through the contact form on this site.

What I collect and why

When you use the contact form

Your name, email address and message. I use these to answer you and for nothing else. They are not sold, not shared, and not added to any list.

Fluent Forms, the plugin that runs the form, also records your IP address, browser type and device type at the moment you submit. This happens automatically and it is there for spam prevention and security. It is not used to identify you or follow you around.

The legal basis is legitimate interest. You contacted me, so I need your details to reply.

If you buy, commission, or stock my work

If you commission a piece, buy work from me, or represent a gallery or shop that takes my work, I will hold your name, email address, postal address where relevant, and a record of what was agreed, made, sent and paid.

This includes business contacts. A named person at a gallery is still a person under UK GDPR, and their work email is still their personal data.

The legal basis is contract, or the steps taken before entering one. For anything financial it is legal obligation, because HMRC requires me to keep business records.

Cookies

Functional cookies only. They help the site work. They do not track you, profile you, or serve you adverts.

  • WP Super Cache, helps pages load faster
  • Yoast SEO, remembers if you have dismissed a notice
  • CookieYes, stores your cookie consent preference

None of these collect personal data or pass anything to third parties.

Who else handles your information

Nothing you send me is sold, rented, or shared for marketing. Two things do touch it in the ordinary course of this site working:

  • DreamHost, which hosts the site and its database, including contact form submissions until they are deleted
  • Fluent Forms, the contact form plugin

Both act on my instructions and cannot use your information for their own purposes.

Where your information is stored

DreamHost is based in the United States and this site is hosted on its servers there, so anything you send through the contact form is stored outside the UK.

Transfers like this are allowed under UK GDPR where proper safeguards are in place. DreamHost’s data processing agreement uses the Standard Contractual Clauses together with the International Data Transfer Addendum issued by the UK Information Commissioner, which is the approved mechanism for sending personal information from the UK to the United States. Their agreement is published at dreamhost.com/legal.

Third party links

This site links out to other places including social media platforms. Once you leave corrodeandcrown.com I have no control over what those sites collect. They have their own privacy policies and you should read them if you have concerns.

Social sharing

This site uses Sassy Social Share buttons. When a page loads, Sassy Social Share may make a request to its own servers. No personal information about you is passed to it unless you actively click a share button.

Newsletter

There is no newsletter from this site at present and no sign-ups are being collected. If one launches, this page will be updated with how sign-up data is collected, stored and used, and how to unsubscribe. In the meantime you can follow my Substack.

How long is data kept

Contact form submissions are deleted once your enquiry has been dealt with and there is no reason left to hold them.

Records of sales, commissions and stockist arrangements are kept for as long as HMRC requires, which for a sole trader is at least five years after the 31 January self assessment deadline for the relevant tax year. After that they are deleted.

Cookie consent records are kept by CookieYes for the period required by law.

Your rights

Under UK GDPR you can ask me to:

  • give you a copy of the personal data I hold about you
  • correct anything that is wrong
  • delete it
  • restrict what I do with it
  • stop processing it altogether

Where I hold your information because of a contract, a commission or a sale for example, you can also ask for it in a portable format.

Use the contact form or email me. It costs you nothing and I will respond within a month.

If you think I am handling your information unlawfully you can complain to the Information Commissioner’s Office at ico.org.uk. You do not have to raise it with me first, though I would rather you did so I have the chance to put it right.

Changes

I may update this occasionally. The date below will always tell you when it last changed.

Last updated: 21 August 2026

— CC / Corrode and Crown