Privacy Policy

1. Overview

Kei London Limited is a company registered in England and Wales (registered office at 35-37 Ludgate Hill, Office 7, London, England, EC4M 7JN) (the Company). The Company operates the website www.keilondon.com (the Website).

We take the security and privacy of data seriously and are committed to complying with our legal obligations under the Data Protection Act 2018 (the 2018 Act) and the UK General Data Protection Regulation (UK GDPR) in respect of data privacy and security. We respect your Personal Data, and our use of your Personal Data is subject to the relevant data protection legislation.

2. Controller

The Company obtains, keeps and uses information about you for a number of specific lawful purposes. The Company is a data controller. This means that we are responsible for deciding how we hold and use personal information about you. The Company is registered with the Information Commissioner's Office (ICO). Our registration number is ZB503618.

3. Scope and Purpose

This privacy notice aims to give you information on how the Company collects and processes your personal data, including any data you may provide through this Website when you:

sign up to our newsletter or mailing list;
enquire about, submit your work for consideration, or purchase our artwork and services (whether through the Website, in person, by email, by post, or by telephone).

Please read this privacy policy carefully, as it contains important information on who we are and how and why we collect, store, use and share information about you. It also explains your rights in relation to your information and how to contact us or the supervisory authority in the event you have a complaint.

This policy applies to all data, whether it is stored electronically, on paper, or on other materials. This Website is not intended for children, and we do not knowingly collect data relating to children.

4. Changes to this policy

We will review and update this notice regularly in accordance with our data protection obligations. We will publish any new or modified policies or notices in relation to your data on our Website when adopted. It is important that you read and understand this notice before you share any personal data with us.

5. Data protection principles

When processing your data, the Company will comply with the following data protection principles:

we will process personal information lawfully, fairly and in a transparent manner;
we will collect personal information for specified, explicit and legitimate purposes only, and will not process it in a way that is incompatible with those purposes;
we will only process personal information that is adequate, relevant and necessary for the relevant purposes;
we will keep accurate and up to date personal information, and take reasonable steps to ensure that inaccurate personal information is deleted or corrected without delay;
we will keep personal information in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the information is processed;
we will take appropriate technical and organisational measures to ensure that personal information is kept secure and protected against unauthorised or unlawful processing, and against accidental loss, destruction or damage.

6. How we define processing

Processing means any operation which is performed on personal data, such as collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment, combination, restriction, destruction or erasure. This includes processing personal data which forms part of a filing system and any automated processing.

7. What data we collect

The Company processes information about you (the data subject) for a number of specific lawful purposes, and we seek to ensure that our data collection and processing is always proportionate. Given the nature of our business, we mainly collect Personal Data, and on some occasions may receive Special Categories of Data (for example, if you choose to share health information when requesting reasonable adjustments).

Personal data is information which relates to a living person who can be identified from that data, either on its own or when taken together with other information likely to come into our possession. It includes any expression of opinion about the person and an indication of intentions in respect of that person. It does not include anonymised data.

Special Categories of Personal Data (sometimes called sensitive personal data) includes information about your race, ethnic origin, politics, religious or philosophical beliefs, trade union membership, genetics, biometrics (where used for identification purposes), health, sex life or sexual orientation. We do not routinely collect this data and will only do so where you choose to provide it or where we have a lawful basis. We do not knowingly collect criminal conviction data about you.

8. Categories of Data

We group the data we collect as follows:

Identity Data includes first name, last name, username or similar identifier, title, and (where relevant to a submission or contract) date of birth.
Contact Data includes addresses, email addresses and telephone numbers.
Submission Data includes the portfolio, artist statement, CV, images of work and related materials you send us when enquiring about representation or our services.
Customer Service Data includes details of your enquiries, feedback and our responses.
Transaction Data includes data about services or artwork you purchase from us, payment confirmations and related records. Full card details are handled by our payment processor, not stored by us.
Technical Data includes internet protocol (IP) address, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this Website.
Usage Data includes information about how you use our Website.
Marketing Data includes your marketing and communication preferences.
Aggregated Data such as statistical or demographic data. Aggregated Data may be derived from your personal data but is not considered personal data in law, as it does not directly or indirectly reveal your identity. If we combine Aggregated Data with your personal data so that it can identify you, we treat the combined data as personal data.

9. Basis for processing data

We must have a valid lawful basis in order to process your personal data. We will generally process your personal data in the following circumstances:

where we need the information to take steps at your request prior to entering into a contract with you, or for the performance of a contract to which you are a party;
where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests;
where we need to comply with a legal or regulatory obligation;
where you have provided your consent. Generally we do not rely on consent, but may request your explicit consent in certain circumstances (for example, marketing). Where we rely on your consent, you may withdraw it at any time.

We may process your personal data for more than one lawful ground depending on the specific purpose. Please contact us if you need details of the specific legal ground we are relying on where more than one has been set out.

10. Website Users

When you use our Website, we may automatically collect Technical Data and Usage Data about your equipment, browsing actions and patterns. We collect this data using cookies and similar technologies. We will:

obtain this information from you or from third-party analytics providers (such as Google Analytics);
collect this information to administer and protect our business and Website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data);
collect this data as it is necessary for our legitimate interests (running our business, provision of administration and IT services, and network security);
share this information with relevant personnel within the Company and with third-party service providers responsible for our Website and its maintenance;
collect this information automatically when you use our Website. If you do not wish for this information to be collected, please adjust your cookie settings or do not use our Website.

11. Enquirers, Artists and Customers

We will process your Identity, Contact, Submission, Customer Service, Transaction and Marketing Data when you enquire about or submit your work to us, or purchase services, whether by filling in forms on our Website, by corresponding with us by post, phone or email, or in person. We will:

obtain this information from you;
collect this information so that we can assess your enquiry or submission, provide you with our services, keep and maintain appropriate records, manage any fees and charges, and comply with our reporting obligations;
collect this data as it is necessary in order to enter into and perform a contract with you, for our legitimate interests (to assess submissions, develop and grow our business, maintain records, and provide our services), or to comply with our legal obligations (for example, to account to HMRC for tax);
be unable to assess your enquiry, take steps to enter into a contract, or provide our services if you do not provide the necessary information.

You may choose to provide us with sensitive data relating to your health (for example, a disability) when requesting that we make reasonable adjustments to how we communicate with you. The lawful condition for processing such data is the establishment, exercise or defence of legal claims, and so that we can show we have treated you fairly and complied with our obligations under the Equality Act 2010.

The Company does not carry out automated decision-making (including profiling).

Note on payments: where you purchase a service or artwork online, payments may be processed through Stripe, our third-party payment processor. Your card or payment details are provided directly to and handled by Stripe under its own privacy policy; we do not store your full card details on our systems. We receive confirmation of payment and limited transaction information in order to fulfil your order and maintain our records.

12. How your personal data is collected

We collect most of this information directly from you. However, we may also collect information:

from publicly accessible sources, such as Companies House;
via our Website, where we use cookies (for more information, please see our cookie settings);
via our IT systems, including online forms, email, and automated monitoring of our technical systems and networks.

13. Promotional Communications

When you subscribe to our newsletter or mailing list, or request marketing, we will collect your Identity, Contact and Marketing Data on the basis of consent. We use Mailchimp to manage our mailing list (this service is currently paused). We will collect this information so that we can send you our newsletter, deliver relevant content, notify you of updates, introduce our new services, and measure the effectiveness of our communications.

If you enquire about our services, we have a legitimate interest in processing your personal data for promotional purposes, and we may not need your consent to send you promotional communications if you have entered into negotiations with us or are a business. We will always treat your personal data with the utmost respect and will not share it other than as set out in this notice or with your consent.

You have the right to opt out of receiving promotional communications at any time by contacting us, using the unsubscribe or opt-out link in any promotional email, or updating your marketing preferences.

14. Data Sharing

We may share personal data with:

relevant personnel within the Company, so that they may respond to your enquiry, assess your submission, process your order, or for business development and monitoring purposes;
our accountants, auditors and other professional service providers, such as lawyers;
external service suppliers and agents we use to run our business efficiently (for example, website developers and our technology, system and software providers);
third-party service providers responsible for Website functionality, payments and marketing software (for example, Stripe for payment processing, Mailchimp, and Google Analytics).

We only allow our service providers to handle your personal data where we are satisfied they take appropriate measures to protect it. They are only permitted to process your data for the lawful purpose for which it has been shared and in accordance with our instructions, and we impose contractual obligations on them to that effect.

We may disclose your data to law enforcement agencies and regulatory bodies to comply with our legal and regulatory obligations, to enforce our contractual rights or defend legal claims, or to protect the rights, property and safety of ourselves or others, or to prevent fraud. We may also share personal data with a potential buyer of some or all of our business, or during a restructuring; usually this information will be anonymised where possible, and the recipient will be bound by confidentiality. We will not otherwise share your personal data with any third party unless you instruct us to.

15. International Transfers

To deliver our services, it is sometimes necessary for us to share your personal data outside the United Kingdom, for example where you are based outside the UK or where there is an international dimension to our work with you. These transfers are subject to special rules under UK GDPR. Some countries have been assessed by the UK as providing an adequate level of protection for personal data. Where we transfer data to a country that has not been assessed as adequate, we will ensure the transfer complies with data protection law, for example by using standard data protection contract clauses approved for use in the UK. To obtain a copy of those clauses, please contact our Information Manager.

16. Data Security and Retention

Information may be held at our offices and by third-party service providers and agents. We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used, or accessed in an unauthorised way, altered or disclosed. We limit access to your personal information to those who have a business need to know, and they are subject to a duty of confidentiality. We have procedures to deal with any suspected data security breach and will notify you and any applicable regulator where we are legally required to do so.

We will not retain your data for longer than necessary for the purposes set out in this policy. Different retention periods apply to different types of data. We generally keep personal data so that we can respond to complaints or claims, show that we treated you fairly, keep records required by law, prevent fraud, and comply with our regulatory requirements. As standard, we retain client data for 7 years. When it is no longer necessary to retain your personal data, we will delete it securely or anonymise it. If you would like more information on retention periods, please contact us.

17. Your Rights

Under data protection legislation, you may be entitled to the following rights in certain circumstances:

the right to be informed about the collection and use of your personal data;
the right to access your personal data (a subject access request), enabling you to receive a copy of the personal information we hold about you and check we are lawfully processing it;
the right to request correction of incomplete or inaccurate personal data;
the right to request erasure of your personal data (the right to be forgotten) where there is no good reason for us to continue processing it;
the right to object to processing where we are relying on a legitimate interest, and the right to object to processing for direct marketing purposes;
the right to request restriction of processing;
the right to request the transfer of your personal data to another party;
rights in relation to automated decision-making and profiling; you will not be subject to decisions with a significant impact on you based solely on automated decision-making.

You will not have to pay a fee to access your personal data or to exercise any of your other rights, although we may charge a reasonable fee or refuse to comply if your request is unfounded, repetitive or excessive. We may need to request specific information from you to confirm your identity. We try to respond to all legitimate requests within one month, and will let you know if we need longer.

18. Your queries

Alison Clark, our Information Manager, is responsible for overseeing questions in relation to this privacy notice. If you have any questions, including any request to exercise your legal rights, please contact us by email at studio@keilondon.com, or by writing to Kei London Limited, 35-37 Ludgate Hill, Office 7, London, England, EC4M 7JN.

We hope that our Information Manager can resolve any query or concern you raise about our use of your information. However, if you feel we have not addressed your concerns appropriately, you have the right to contact the Information Commissioner's Office at ico.org.uk/concerns or on 0303 123 1113.

19. Third Party Links

Our Website may include links to third-party websites, plug-ins and applications. Clicking those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy practices. When you leave our Website, we encourage you to read the privacy notice of every website you visit.

20. Cookies

You can set your browser to refuse all or some cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this Website may become inaccessible or not function properly. You can manage your preferences at any time through the cookie settings on our Website.

Privacy Policy