Legal · Gracie Alice
Privacy notice
Who is responsible for your data?
The data controller for personal data collected through this website and the optional mailing list is Gracie Alice (the artist). Technical hosting, the mailing-list software, and day-to-day operation of this site are carried out on her behalf by The Ivy Web as a data processor, acting only on documented instructions compatible with this notice.
What we collect and why
- Mailing list (optional): your email address, the fact that you ticked the consent and privacy boxes, a timestamp, and the IP address your browser sent when you requested sign-up (used for fraud prevention and abuse monitoring). We use this information solely to operate the list and evidence your consent. Lawful basis: your consent (UK GDPR / UK GDPR Article 6(1)(a) and Article 7).
- Double opt-in: we send you a confirmation link by email before your subscription becomes active. Until you confirm, you are not treated as subscribed.
- Unsubscribe: when your subscription is active, we store a secret token so you can withdraw consent in one step from the link we provide. You may also contact us using the details below.
- Normal website use: this static site does not use analytics cookies or advertising trackers as standard. Your browser may still share technical data with our hosting provider as part of delivering the page (standard server logs).
Where data is stored
Mailing-list data is stored on a secure server in the United Kingdom (SQLite database on the studio VPS that also serves related client infrastructure). Email delivery uses your chosen SMTP provider configured on that server; messages are transmitted over TLS where supported.
How long we keep it
Active subscribers: we keep your email and related records while your subscription remains active. Unsubscribed: we record the date you left the list and stop sending marketing messages. We may retain a minimal record for a limited period where the law requires (for example to evidence consent or defend a claim), after which we delete or irreversibly anonymise it. Pending sign-ups that are never confirmed are removed automatically after the expiry period shown on the sign-up form (typically fourteen days).
Sharing
We do not sell your data. We share it only with processors who help us run this site and the list (for example the hosting provider and SMTP relay), under contracts that require them to protect your information.
Your rights (UK)
You have the right to:
- access the personal data we hold about you;
- rectify inaccurate data;
- erase data in certain circumstances;
- restrict or object to processing in certain circumstances;
- withdraw consent at any time (unsubscribe), without affecting the lawfulness of processing before withdrawal;
- lodge a complaint with the ICO (Information Commissioner’s Office) at ico.org.uk.
To exercise your rights, please contact The Ivy Web using the details on theivyweb.uk and mark your message for the attention of Gracie Alice / mailing list privacy.