Privacy
Policy.

Who we are

Good Ereseh is an independent fine art practice based in London, United Kingdom, operating through the website goodereseh.com. For the purposes of data protection law, Good Ereseh is the data controller of your personal information.

If you have any questions about how we handle your data, contact us at [email protected].

What information we collect

We collect personal information when you purchase an artwork, make an enquiry, or contact us. The information we collect includes:

• Full name
• Email address
• Phone number (if provided)
• Delivery and billing address
• Payment information - processed securely by Stripe; we do not store card details
• Details of artworks purchased
• Commission enquiry details (if you submit a commission request)
• Messages sent through the contact form

How we use your information

We use your personal information only for the purposes for which it was provided:

Order processing

To process your purchase, send order confirmation emails, arrange delivery, and handle any post-purchase queries.

Commission enquiries

To respond to and manage commission requests submitted through our website.

Legal obligations

To comply with applicable laws, including maintaining transaction records for tax purposes.

We do not use your data for marketing purposes, and we do not sell or share your data with third parties for their own marketing use.

Third parties we work with

To operate our website and process orders, we work with the following trusted third-party services:

• Stripe: payment processing. Your payment information is handled entirely by Stripe and is subject to their privacy policy at stripe.com/privacy.
• Supabase: secure database for order records. Data is stored on encrypted servers.
• Resend: transactional email delivery for order confirmations.
• Netlify: website hosting and form submissions.
• Railway: backend server infrastructure.

Each of these providers operates under their own privacy policies and data processing agreements.

How long we keep your data

We retain order records for seven years in accordance with HMRC requirements for financial records. Commission enquiry correspondence is kept for the duration of the project and up to two years afterwards. Contact form submissions are kept for a maximum of one year.

You may request deletion of your data at any time (subject to legal retention obligations) by contacting [email protected].

Your rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of access: you may request a copy of the personal data we hold about you.
• Right to rectification: you may ask us to correct inaccurate or incomplete data.
• Right to erasure: you may request that we delete your personal data where we have no legitimate reason to continue holding it.
• Right to restriction: you may ask us to restrict processing of your data in certain circumstances.
• Right to portability: you may request a copy of data you have provided to us in a machine-readable format.
• Right to object: you may object to processing of your data where we rely on legitimate interests as the legal basis.

To exercise any of these rights, email [email protected]. We will respond within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

Cookies

Our website uses only essential technical cookies necessary for the site to function. We do not use advertising, tracking, or analytics cookies. No cookie consent banner is required as we do not deploy non-essential cookies.

Changes to this policy

We may update this Privacy Policy from time to time. The date at the top of this page indicates when it was last revised. Continued use of our website following any changes constitutes acceptance of the updated policy.