PRIVACY POLICY

GDPR
The General Data Protection Regulation, or GDPR, is a European privacy law effective from May 25, 2018. The GDPR regulates how individuals and organisations may collect, use, and retain personal data.

How this applies to Sacred Intuitive Art

Last updated:18 June 2026

This privacy notice explains how I collect, use, store and protect personal information.

I am Lynn Hanford-Day, a visual artist and educator, teaching in person and online. I am the data controller for personal information I collect through Sacred Intuitive Art.

This means I am responsible for deciding how personal information is used and for keeping it safe.

If you have any questions about this privacy notice, or about how your information is handled, you can contact me at:

Email: lynnhday@icloud.com

Website: www.sacredintuitiveart.com

This privacy notice applies to people who contact me about my art, current and former customers, and visitors to my website.

Information I collect

I may collect and use the following information.

When you contact me, I may collect:

  • your name

  • your email address

  • your phone number

  • the information you choose to share in your enquiry

  • payment information

  • correspondence between us

I only collect information that is necessary for your enquiry.

How I use your information

I use your personal information to:

  • respond to enquiries

  • arrange calls and appointments

  • manage payments, invoices and appointments

  • communicate with you about your enquiries and purchases

  • meet legal and professional responsibilities

  • maintain insurance, tax and accounting records

  • respond to data protection requests or complaints

I do not sell your personal information.

Lawful basis for using your information

Under UK GDPR, I need a lawful basis for using personal information.

For different parts of my work, I may rely on different lawful bases under Article 6 UK GDPR. For example, I may rely on contract where processing is needed to arrange or provide my services, legitimate interests where I need to run my business safely and keep appropriate records, and legal obligation where I need to keep or share information to comply with the law.

  • contract: where information is needed to provide my services

  • legitimate interests: where I need to use information to run my business safely, respond to enquiries, keep appropriate records.

  • legal obligation: where I need to keep or share information to comply with the law

How long I keep information

I keep information only for as long as necessary for the purpose for which it was collected. Retention periods may vary depending on the type of record, legal and professional requirements. As a general guide:

  • enquiry information is usually deleted within 6 months.

  • customer records may be kept for 3 years following a purchase.

  • financial records may be kept for the period required for tax and accounting purposes

  • emails, messages and administrative records are reviewed periodically and deleted when no longer needed

There may be times when I need to keep records for longer, for example where there are legal, insurance, or complaint related reasons. I keep my retention periods under review and aim to make sure they remain justified and proportionate.

Where your information is stored

Your information may be stored in the following systems:

  • Website / contact form: Squarespace

  • Email: iCloud, Google

  • Payments / invoicing: Xero, Stripe, PayPal

  • Cloud storage or backup: iCloud

  • Phone / messages: SMS, WhatsApp

I use appropriate technical and organisational measures to keep information secure. This may include password protection, device security, two-factor authentication, restricted access and secure storage.

Where I use external providers, they may process data on my behalf. I aim to use reputable providers with appropriate data protection and security arrangements.

Website visitors and Cookies

When you visit sacredintuitiveart.com, some technical information may be collected automatically, such as your IP address, device type, browser type, pages visited and the time of your visit. This may happen through website hosting, security, analytics or cookie tools.

My website is hosted by Squarespace. The website may use cookies or similar technologies to make the site work, improve performance, understand visitor behaviour or support security.

You can usually control cookies through your browser settings. If I use cookies or similar technologies that are not strictly necessary, I will make sure the website provides the level of notice, choice or consent required by law. In some cases, current UK rules may allow limited exemptions for certain analytics or functionality cookies, but only where the legal conditions for those exemptions are met.

Sharing your information

I will not share your personal information unless there is a clear reason to do so. Depending on the circumstances, I may share limited information with the following people or organisations where this is necessary, proportionate and lawful:

  • professional advisers, such as an accountant, insurer or legal adviser

  • a court or legal authority, if required by law

  • an appointed executor if I die or become unable to contact customers myself

  • trusted digital service providers who process data on my behalf

Where I share information, I aim to share only what is relevant and necessary for that purpose. If I or one of my providers transfers personal information outside the UK to a separate organisation, I will only do so where the law allows it and an appropriate transfer mechanism or other safeguard is in place where required.

Third parties
I do not directly pass any information on to third parties. This website however does use third party services which are subject to their own privacy and cookies policies. Currently these are: Instagram, Facebook, Substack

Your rights

Under UK data protection law, you have rights over your personal information. These may include the right to:

  • be informed about how your data is used

  • access a copy of your personal information

  • ask for inaccurate information to be corrected

  • ask for information to be deleted in some circumstances

  • restrict or object to certain processing

  • complain about how your information has been handled

Some rights are not absolute and may depend on the circumstances. For example, I may need to keep some information for legal, professional, insurance or complaint-related reasons, and there may be limits on what can be disclosed where information includes third-party data or where a relevant exemption applies.

If you would like to exercise your rights, please contact me using the details above. I will respond to a request about your rights within one month. If a request is particularly complex, or if I need to consider whether any restriction or exemption applies, I may need longer, in which case I will let you know.

Right to amend or delete information
If you wish to unsubscribe from my newsletter you can find a link at the bottom of a newsletter from me. Should you have any problems doing that please contact me here so I can manually amend or delete your information within 30 days from your initial request.

Should you, having contacted me via the forms on this website or purchased an item, wish for me to amend or delete your information please contact us and we will deal with your request within 30 days. 

Data Protection Concerns and Complaints

If you have a concern about how I have handled your personal information, you can make a data protection complaint by contacting me using the details in this notice. I will acknowledge your complaint within 30 days and take appropriate steps to look into it without undue delay.

Please include:

  • your name

  • what your concern is about

  • what you would like me to look into

  • how you would prefer me to respond

I will investigate your complaint as appropriate, keep you informed where necessary, and tell you the outcome without undue delay.

If you are not satisfied with my response, or if you would prefer to contact the UK regulator directly, you can contact the Information Commissioner’s Office:

Information Commissioner’s Office

Website: www.ico.org.uk

Telephone: 0303 123 1113

Changes to this Privacy Notice

I may update this privacy notice from time to time to reflect changes in my practice, legal requirements, professional guidance or the systems I use.

The latest version will be available on my website.