Auto Amor Privacy Policy

Last updated 22 October 2026

1 Who we are

Auto Amor Ltd is the controller responsible for the personal information described in this policy. It covers our website, shop, artist portal, exhibitions, New Arrivals, events and communications. It does not replace separate privacy information for staff or job applicants.

You can contact Tom Winstanley about privacy by writing to Auto Amor Ltd, 12 South Park, Sevenoaks, Kent, TN13 1AN, or emailing info@autoamor.co.uk.

2 Information we collect

Depending on how you interact with us, we collect your name, email, telephone number, billing and delivery addresses, orders, payment confirmations, correspondence and marketing preferences.

For artists, we also collect account details, artwork images, titles, descriptions, medium, prices, categories, biography, professional links, submission and exhibition history, artwork locations, sales, bank details for payments, and invoicing or VAT information where needed. Artwork identifiers, including RFID labels where used, link works to our inventory records.

Website and portal records may include IP addresses, device and browser information, pages visited, account activity, security logs and cookie preferences. Our payment providers process payment card information; we receive the transaction information needed to manage your order rather than your full card details.

We collect information you give us directly, including through forms, purchases, messages and events. We also receive payment and delivery updates from providers and, where relevant, artist and artwork information from partner galleries or curators. If a partner supplies your details, we will tell you the source and the information received when we contact you, unless you already have that information or a legal exception applies.

3 How we use information and our lawful bases

Orders and customer service: we use contact, delivery and transaction details to fulfil purchases, arrange shipping, manage returns and answer order queries. Our lawful basis is performance of a contract or taking steps you request before a contract.

Artist participation: we use account, artwork and contact details to administer submissions, exhibitions, New Arrivals, artwork storage and returns, sales and artist payments. Our lawful basis is performance of our agreement with you or taking steps at your request before entering that agreement.

Discovery and selection: we allow authorised curators and partner galleries to review relevant artist and artwork information to identify work for exhibitions and other opportunities. We rely on legitimate interests in connecting artists with exhibition opportunities and running our programme. We consider your expectations and privacy when deciding what to share.

Public artwork listings and exhibition information: we publish artist names and the artwork and professional information needed to exhibit, promote and sell participating work. Where this is necessary to deliver the exhibition or sales service you request, we rely on contract. For a separate optional artist portrait, interview or Meet the Artist feature, we ask for consent.

Events: we use booking and contact details to administer your attendance under our contract with you. For general event photographs showing the atmosphere, we rely on legitimate interests in documenting and promoting our programme, with notices and a way to raise concerns. We ask permission for posed portraits or interviews and use additional safeguards for children.

Newsletters and promotional emails: we use your email and preferences with your consent. Buying a board or submitting work does not automatically subscribe you. Operational messages about an order or submission are sent as part of the relevant service.

Security, enquiries and disputes: we rely on legitimate interests in protecting accounts and artworks, preventing fraud, responding to general enquiries and establishing or defending legal claims. We limit information to what is necessary and consider the effect on your rights.

Accounts and tax: we use transaction, invoice and payment records to meet legal obligations, including accounting and tax requirements.

Optional analytics and advertising technologies: where enabled, we use consent for technologies requiring it. See the cookies section.

4 Your artist account and public information

Your account login, home address, private correspondence, bank details and tax information are not public artist profile information. Authorised staff and service providers can access them where needed for their roles.

Artist names, artwork images, titles, medium, prices and agreed professional biographies or links may appear on our website, gallery labels, exhibition catalogues and social media in connection with participating work. Approved curators or partners may see relevant submissions and professional information through restricted access. They do not receive unrestricted access to your private account details.

Please do not include sensitive personal information or other people's private details in artwork descriptions or biographies. Contact us before supplying information that needs special handling.

You can ask to correct or remove public information. We will explain any effect on an active listing or exhibition and whether a record must be retained. We cannot guarantee removal of printed catalogues already distributed or copies independently made by others.

Moving from 2026 submissions to New Arrivals

During 2026 we brought board-purchase email addresses and artwork submission forms into one database, matching records by email address. Some purchasers have an internal record but no artwork; some artists have submitted work without activating their account; others have logged in and added images, prices and biographies after selection.

We plan to use the portal for New Arrivals in 2027. Before using existing information for a new purpose, we will explain the change to affected artists and establish the appropriate lawful basis. Existing submissions remain private during that review. We will give artists a way to activate or update their account and choose to carry relevant work into ongoing discovery. Purchasing a board or submitting work in 2026 does not automatically enrol an artist in New Arrivals.

We will not automatically publish old submissions or make them available to new partner galleries simply because they were submitted in 2026. We will explain the intended sharing and obtain any permission required before it begins. Account activation and privacy choices are separate from permission to receive marketing emails.

5 Who we share information with

We share information only where needed for the purposes in this policy. Recipients include website and shop providers such as Squarespace; payment providers such as Stripe and PayPal; banks; Royal Mail and other delivery providers; our artist portal hosting, database, email and IT support providers; accounting systems such as Xero and integration providers where used; accountants, including Collards; and professional advisers. We use Fly.io for the artist portal and database hosting, and Google Workspace Drive for incremental database backups.

We share relevant artist and artwork information with guest curators and partner galleries for selection, exhibitions and sales. We normally handle buyer and artist communications ourselves and only pass contact information between them where necessary for the agreed transaction or with permission.

Social platforms such as Instagram receive information when we publish agreed features or when you interact with our social pages. They operate under their own privacy policies. Partners and payment providers may also act as independent controllers for their own processing; we identify the relevant partner when you take part in a programme. When you permit advertising tracking, Meta also receives website event information through Meta Pixel for advertising measurement and relevant advertising. We and Meta may act as joint controllers for the collection and transmission of that event data under Meta’s applicable Business Tools terms. Meta handles subsequent processing under its own privacy information. You can contact us about your rights relating to our use of Meta Pixel.

We may disclose necessary information to authorities where legally required or to advisers and insurers when dealing with a claim. We do not sell personal information or give partners our mailing list for their own marketing without your permission.

6 International transfers

We use international service providers, including Fly.io, Google, Squarespace, Meta, Stripe and PayPal. Their provision of hosting, backups, payments, advertising and support may involve processing in the United States, the European Economic Area and other countries in which they or their service providers operate.

Our main artist portal database is hosted by Fly.io in London. We make incremental backups to a company-controlled Google Workspace Drive account. Our team currently accesses the portal only from within the UK. Google backups and other providers’ processing are not restricted to the UK merely because the main database is hosted in London.

Where information is transferred outside the UK, the applicable protection depends on the provider, recipient and destination. Transfer arrangements may rely on UK adequacy regulations, including the UK Extension to the EU–US Data Privacy Framework where the recipient and transfer are covered, or approved contractual safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission’s Standard Contractual Clauses. Contact info@autoamor.co.uk for details of the arrangement applicable to a particular provider and to request a copy of relevant safeguards, with confidential information removed where necessary.

7 How long we keep information

We keep information only for as long as needed for the purpose for which it was collected. The following periods form our retention policy, subject to a legal requirement or an active dispute requiring longer retention.

Orders, artist sales, invoices and accounting records: normally six years from the end of the financial year to which they relate, or longer where tax law requires it.

Active artist accounts: we retain relevant profile and artwork information while you actively use our services or while we hold, exhibit, market or sell your work. Meaningful activity includes logging in, updating your profile, submitting work or an ongoing exhibition or sales relationship. After three years without meaningful activity, we review the account, contact you where appropriate and remove information that is no longer needed. We retain necessary financial or claims records separately for the applicable period.

Previous submissions and inactive accounts: the periods below apply to private operational records. Non-selection for an exhibition does not itself require deletion of an artist’s account or artwork record.

Board purchasers who have not submitted work: we keep purchase records separately for accounting and customer service. An internal portal record created from a purchase email does not mean the purchaser has activated an artist account. We review unused portal records after three years from purchase and delete unnecessary portal copies, unless there is another documented reason to retain them.

Artists who submitted but did not activate their account: we retain private submission records for up to three years from submission for submission administration and related queries, reviewing and deleting them sooner if no longer necessary. If the artist activates an ongoing account, the active-account rule applies to relevant retained information. This retention period does not itself authorise using old work for new exhibitions or discovery.

General enquiries and event administration: normally up to two years after the matter or event ends, unless linked to a transaction, complaint or claim.

Marketing details: until you unsubscribe or withdraw consent. We retain a minimal suppression record to respect your preference. Consent records are kept as needed to demonstrate how permission was obtained.

Public exhibition archives: we review these periodically and retain names, artwork images and exhibition details where there is a continuing reason to document the programme. We consider removal requests and do not retain unrelated private account information as part of the public archive.

Technical logs: we retain routine portal technical logs for 30 days. We may retain relevant extracts longer when necessary to investigate a security incident or resolve a dispute. Database backups: we retain rolling incremental backups on Google Drive for up to 90 days. Information deleted from the live database may remain in protected backups until the applicable backup expires. If a backup is restored, we reapply relevant deletion requests before returning the data to ordinary use.

8 Cookies and similar technologies

We use necessary cookies for functions such as checkout, security and remembering cookie choices. We use Squarespace Analytics to understand visits and website performance, and Meta Pixel to measure advertising results and support relevant advertising on Facebook and Instagram. These tools may process device identifiers, IP addresses, page visits and actions on the website. Optional analytics and advertising cookies are controlled by your choices in our cookie banner. You can leave both categories off and select Save preferences, or choose the categories you accept.

You can change your choices through Manage cookies in our website’s cookie settings. Withdrawing permission stops future use of the relevant optional tracking; it does not undo processing that took place before withdrawal. Browser settings can also be used to remove stored cookies. Necessary cookies support the service or remember your choices; optional cookie lifetimes vary by provider and settings. Contact us for details of the cookies used on the website.

9 Your choices and rights

You can ask for access to your personal information, correction of inaccurate information, deletion or restriction of use in certain circumstances. Where processing is automated and based on consent or contract, you may have a right to receive information you supplied in a portable format and have it transmitted to another organisation where technically feasible.

Your right to object

You can object at any time to use of your information for direct marketing, including related profiling. We will stop that use. You can also object, for reasons relating to your situation, to processing based on legitimate interests. We will stop unless we have compelling overriding grounds or need the information for legal claims.

Where we rely on consent, you can withdraw it at any time by contacting us. For marketing emails you can also use the unsubscribe link. Withdrawal does not affect the lawfulness of earlier processing.

Contact us using the details in section 1 to exercise your rights. These rights depend on the circumstances and may be subject to legal exceptions. We normally respond within one month, subject to lawful extensions or pauses, and will explain if more time is needed. Requests are normally free. We may ask for reasonable information to confirm your identity.

10 Information you need to provide

We need sufficient contact, delivery and payment information to fulfil orders. For artist participation, we need the account, artwork, contact and payment information required to administer your chosen service. Without required details we may be unable to accept a submission, fulfil an order, arrange a return or pay you. We identify required fields when collecting information. Marketing subscriptions and optional promotional features are voluntary. We may also need information to comply with accounting or tax law.

11 Automated decisions

We do not make decisions with legal or similarly significant effects on you based solely on automated processing. Exhibition selections are made by people. Database filters, artwork categories and administrative automation help us manage work but do not replace those selection decisions.

12 Young artists

Where a programme is open to under 18s, we provide programme-specific privacy information in clear language and explain any parent, guardian or school involvement. We collect only the information needed to run the programme, restrict access and avoid publishing private contact details. Identifiable promotional photographs and interviews are handled with appropriate permissions for the young person's age and circumstances.

13 Keeping information secure

We use appropriate technical and organisational measures to protect personal information, limit access to people who need it and require providers handling information on our behalf to protect it. No online service can guarantee complete security. Please keep your account credentials private and tell us if you suspect unauthorised access.

14 Questions and complaints

If you are concerned about how we handle your information, contact Tom Winstanley using the email or postal address in section 1. Tell us what happened and how you would like us to respond. We will acknowledge a data protection complaint within 30 days, investigate without undue delay, keep you informed and explain the outcome.

You also have the right to complain to the Information Commissioner's Office, the UK data protection regulator, at https://ico.org.uk/make-a-complaint/ or on 0303 123 1113.

15 Changes to this policy

We review this policy when our services or data practices change and update the date above. If we intend to use information for a new purpose, we will provide the relevant information before that use begins and obtain consent where required.