PRIVACY POLICY

This privacy policy applies to the websites www.feltlikerainbows.com and www.radicalrainbowcollective.com, both operated by Sammy Young, a sole trader trading as Felt Like Rainbows and Radical Rainbows Art Collective, based in Wales, United Kingdom.

​

Data controller: Sammy Young (Felt Like Rainbows / Radical Rainbows Art Collective)

Contact email: feltlikerainbows@radicalrainbow.com

Country of operation: United Kingdom (Wales)

​

We take your privacy seriously and are committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

When you browse our websites

• IP address and approximate location (collected automatically by Wix and Google Analytics)

• Browser type, device type, and operating system

• Pages visited, time spent on site, and how you arrived at our site

• Cookie identifiers (see Section 8 on Cookies)
   

When you create a member account or register

• Full name

• Email address

• Username and password (passwords are encrypted and never stored in plain text)

• Profile information you choose to add

• Date of account creation and login history
   

When you make a purchase

• Name and billing/delivery address

• Email address and phone number

• Order details and purchase history

• Payment information — this is processed securely by Wix Payments and/or third-party payment processors. We do not store your full card details on our systems.
   

When you leave a blog comment or product review

• Your name or username

• Your comment or review content

• Date and time of submission

• IP address (collected by Wix for spam and abuse prevention)
   

When you sign up to our newsletter

• Email address

• Name (if provided)

• Marketing preferences and consent record
   

When you contact us

• Name and email address

• Any information you choose to include in your message

We only use your personal data where we have a lawful basis to do so under UK GDPR. The table below explains our uses and the legal basis for each:

Processing orders and fulfilling purchases — legal basis: performance of a contract.

​

Creating and managing your member account — legal basis: performance of a contract.

​

Sending order confirmation and delivery updates — legal basis: performance of a contract.

​

Responding to your enquiries or complaints — legal basis: legitimate interests.

​

Sending marketing emails and newsletters — legal basis: consent. You can withdraw your consent and unsubscribe at any time.

​

Displaying your comments and reviews on our sites — legal basis: consent (given when you submit your comment or review).

​

Analysing website traffic and improving our sites — legal basis: legitimate interests, subject to your cookie consent.

​

Preventing fraud and ensuring security — legal basis: legitimate interests and legal obligation.

​

Complying with legal and tax obligations — legal basis: legal obligation.

Our websites are open to all ages, including children under 13. We take children's privacy very seriously and comply with applicable UK law on the collection of children's data.

​

• Children under 13 may browse our websites, but we ask that they do not submit personal data (including creating an account, leaving comments, or signing up to our newsletter) without the knowledge and consent of a parent or guardian.

• If a child wishes to create a member account, we ask that a parent or guardian registers on their behalf or supervises the registration process.

• We do not knowingly collect personal data from children under 13 without verifiable parental consent.

• We do not use children's data for marketing purposes.

• If you believe we have inadvertently collected personal data from a child under 13 without appropriate consent, please contact us immediately at feltlikerainbows@radicalrainbow.com and we will delete it promptly.

​

Parents and guardians may request to review, update, or delete any personal data submitted by or on behalf of a child by contacting us directly.

We use a number of trusted third-party services to operate our websites and run our business. Each of these may process some of your personal data on our behalf. We have listed them below with a brief explanation of what data they handle and why.

Wix (website platform and hosting)

​

Our websites are built and hosted on the Wix platform. Wix processes data relating to your visits, account, purchases, and form submissions on our behalf. Wix acts as our data processor and operates under a Data Processing Agreement. Wix stores data on servers in the USA and Ireland and complies with UK GDPR via Standard Contractual Clauses.

​

Wix privacy policy: www.wix.com/about/privacy

​

Google Analytics

​

We use Google Analytics to understand how visitors use our websites. This involves the collection of anonymised data about page visits, traffic sources, and user behaviour. Google Analytics uses cookies and may transfer data to the USA under Standard Contractual Clauses.

• IP addresses are anonymised before processing

• We do not use Google Analytics to identify individual visitors

• You can opt out of Google Analytics tracking via your cookie preferences on our site

​

Google privacy policy: policies.google.com/privacy

​

Meta (Facebook/Instagram) Pixel

​

We use the Meta Pixel on our websites to measure the effectiveness of our advertising on Facebook and Instagram, and to allow us to show relevant adverts to people who have visited our site. The Pixel collects data about your visit and shares it with Meta Platforms Ireland Limited.

• This is only activated after you have given cookie consent on our site

• You can opt out via your cookie preferences or via your Facebook/Instagram ad settings

​

Meta privacy policy: www.facebook.com/privacy/policy

​

Mailchimp (email marketing)

​

We use Mailchimp to manage our newsletter mailing list and send marketing emails. When you sign up to our newsletter, your name and email address are transferred to Mailchimp and stored on their servers in the USA under Standard Contractual Clauses.

• We only add you to our mailing list with your explicit consent

• Every marketing email contains an unsubscribe link

• You can withdraw your consent and unsubscribe at any time

​

Mailchimp privacy policy: mailchimp.com/legal/privacy/

Wix Payments and payment processors

​

Payments made on our site are processed securely by Wix Payments and their underlying payment providers (which may include Stripe). We do not see or store your full card details. Payment processors are PCI-DSS compliant.

​

Other disclosure

​

We will never sell your personal data to third parties. We may share your data with third parties only in the following limited circumstances:

• Where required by law, court order, or government authority

• To protect the rights, safety, or property of ourselves, our customers, or others

• In the event of a business transfer (we would notify you in advance)

• Account information: retained for as long as your account is active, plus up to 2 years after closure

• Order and transaction records: retained for 7 years to meet HMRC tax record requirements

• Newsletter subscriber data: retained until you unsubscribe or withdraw consent

• Blog comments and reviews: retained until you request removal or your account is deleted

• Contact form enquiries: retained for up to 2 years

• Website analytics data: retained in anonymised form for up to 26 months (Google Analytics default)

• When data is no longer needed we securely delete or anonymise it.

You have the following rights in relation to your personal data:

​

• Right of access — you can request a copy of the personal data we hold about you

• Right to rectification — you can ask us to correct inaccurate or incomplete data

• Right to erasure ("right to be forgotten") — you can ask us to delete your personal data in certain circumstances

• Right to restrict processing — you can ask us to limit how we use your data

• Right to data portability — you can ask us to provide your data in a portable format

• Right to object — you can object to processing based on legitimate interests or for direct marketing

• Rights relating to automated decision-making — we do not make solely automated decisions that significantly affect you

• Right to withdraw consent — where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing

• To exercise any of these rights, please contact us at . We will respond within 30 days as required by law.

​

If you are not satisfied with how we handle your request, you have the right to complain to the UK Information Commissioner's Office (ICO):

​

Website: www.ico.org.uk        Phone: 0303 123 1113

Our websites use cookies — small text files placed on your device — to make the sites work, to improve your experience, and to help us understand how our sites are used.

​

Essential cookies

• These are necessary for the website to function and cannot be switched off. They include cookies that remember your login session, shopping cart contents, and cookie consent preferences.

Analytics cookies

• We use Google Analytics cookies to collect anonymised information about how visitors use our websites. These are only placed on your device after you give your consent via our cookie banner.

Marketing cookies

• We use the Meta Pixel, which places cookies to help us measure the effectiveness of our Facebook and Instagram advertising. These are only activated after you give consent.

Managing cookies

• When you first visit our websites, you will be shown a cookie banner asking for your consent to non-essential cookies. You can change your cookie preferences at any time via the cookie settings link on our website. You can also control cookies through your browser settings — please note that disabling cookies may affect how the website functions.

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. These include:

​

• All data transmitted between your browser and our websites is encrypted via HTTPS/SSL

• Passwords are encrypted using one-way encryption — we cannot see your password

• Access to personal data is restricted to those who need it to operate our websites and business

• Our platform provider (Wix) maintains industry-standard physical, electronic, and procedural security measures
  
  Please be aware that no method of data transmission or storage is 100% secure. If you have reason to believe your data has been compromised, please contact us immediately.

Some of our third-party service providers (including Google, Meta, and Mailchimp) store and process data outside the United Kingdom. Where this occurs, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the UK ICO, to protect your data to the same standard as if it remained in the UK.

Our websites may contain links to external websites, including social media platforms and artist websites. We are not responsible for the privacy practices of these sites and encourage you to read their own privacy policies. This privacy policy applies only to our websites.

We may update this privacy policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make significant changes, we will update the "last updated" date at the top of this page and, where appropriate, notify you by email or via a notice on our websites.

We encourage you to review this policy periodically.​