Your details and photographs
Privacy notice
Last updated: 13 September 2026
This notice explains what personal information I collect when you commission a portrait, buy prints or a gift voucher, contact me, or visit pauldaviesstudio.com, and what I do with it. It covers the studio side of my work. My app, Studio Grid, has its own privacy policy at pauldaviesstudio.com/studio-grid/privacy: the app itself collects nothing.
Who I am
I am Paul Davies, a sole trader trading as Paul Davies Studio, and I decide how your information is used (in data protection terms, I am the "controller").
- Based in: Kinsale, County Cork, Ireland (full postal address on request, and in every quote)
- Email: paul@pauldaviesstudio.com
I am a one person studio. Nobody else has access to your information except the service providers listed below.
What I collect and why
| What | Why I use it | My legal basis | How long I keep it |
|---|---|---|---|
| Your name, email, and messages when you enquire by email or Instagram | To reply and to quote | Taking steps you asked for before a contract | 12 months after our last contact if you do not go ahead |
| Photographs you send to draw from, which show the person to be drawn (sometimes a child, or someone who has died) | Only to make the portrait | To perform our contract | Deleted 12 months after the portrait is delivered, or sooner if you ask |
| Details about the person in the portrait that you choose to tell me (for example their name or what they mean to you) | To make a portrait that feels right | To perform our contract, and my legitimate interest in doing the work well | As for photographs |
| Postal name and address, and phone number if you give it | To post your portrait, prints or voucher | To perform our contract | With the order record (below) |
| Order record: what you ordered, prices, dates, payment references, invoices, voucher numbers and key emails | To run the order, handle any problem, and keep tax records | Legal obligation (Revenue record keeping) and my legitimate interest in dealing with any claim | 6 years after the end of the tax year in which the order is completed. Voucher records: until the voucher expires, then 6 years |
| Photographs and scans of the finished drawing, including work in progress | My portfolio, website and Instagram, and to make prints you order | Your consent, asked for once the portrait has been given, which you can withdraw at any time (see below) | For as long as I keep my archive, but taken down from public view within 7 days if you ask |
| Your email address for news (for example a Christmas voucher reminder) | To tell past clients about similar work | The ePrivacy rules allow this for past clients, for up to 12 months after a sale, as long as you can opt out in every email | Until you opt out |
| Website visit statistics | To see which pages are useful | My legitimate interest in running the website | See "Website and cookies" |
I do not use your information for automated decisions, I do not sell it, and I do not use your photographs to train or feed any AI tool.
Where information comes from
Mostly from you. If you are the person in a portrait, your photograph and details probably came from the person who commissioned it, often as a gift. I use them only to make the portrait. If you are that person and have a question, contact me.
Children and people who have died
Photographs of children are welcome when sent by a parent, guardian or someone with their permission. Data protection law does not apply to people who have died, but I treat their photographs with the same care.
Sharing your portrait online
I do not post anything from a commission until the portrait has been given. After that, I only share it on Instagram, my website or in my portfolio if you have said yes. You can withdraw that at any time, and I will remove what I have posted. I will never post your original photograph without asking. Once something is posted on Instagram, Meta also processes it under its own privacy policy.
Who I share it with
I only share what each provider needs.
| Who | What for | Their role |
|---|---|---|
| Google (Google Workspace) | My email and file storage | Processor, working on my instructions |
| Cloudflare | Hosting the website and counting visits | Processor |
| Prodigi | Printing and posting prints you order (your name, address and the image of your portrait) | Processor |
| An Post or another postal service | Delivering your parcel (name and address) | Independent controller |
| Revolut and my bank | Receiving your payment | Independent controllers, under their own privacy policies |
| Meta (Instagram) | Messages you send me on Instagram, and posts of my work | Independent controller for its platform. Meta and I share responsibility for the page statistics Instagram gives me |
| Etsy | If you buy through my Etsy shop, Etsy shares your order details with me | Independent controller. Etsy's privacy policy also applies |
| My accountant, if I use one | Preparing my tax returns | Independent controller |
| Revenue or others where the law requires | Legal obligations | Independent controllers |
Information sent outside the EU
Some providers are based in, or use systems in, other countries:
- United States (Google, Cloudflare, Meta): these companies take part in the EU US Data Privacy Framework, which the European Commission has decided gives adequate protection, and they also use the Commission's standard contractual clauses.
- United Kingdom (Prodigi is a UK company): the European Commission has decided that the UK gives adequate protection. Prodigi routes orders to print labs in several countries, usually one close to the delivery address, under its data processing terms.
Website and cookies
My website does not use cookies, advertising or tracking. I use Cloudflare Web Analytics, which counts page visits without cookies and without identifying or following individual visitors. Like any website host, Cloudflare processes technical data such as your IP address to deliver the pages and keep them secure.
There is no contact form on the website. If you click an email or Instagram link, the message goes through your own email app or Instagram.
Keeping it safe
I use strong passwords and two step verification on my accounts, keep photographs in my own Google account rather than on shared devices, and delete them on the schedule above. If a breach ever put your information at risk, I would tell the Data Protection Commission and, where needed, you.
Your rights
You can ask me to:
- give you a copy of the information I hold about you
- correct it
- delete it (subject to the records I must keep for Revenue)
- restrict how I use it, or object to my using it (including for my portfolio and Instagram, or for news emails)
- give it to you in a portable format
Email paul@pauldaviesstudio.com. I will reply within one month, free of charge.
You can also complain to the Data Protection Commission: dataprotection.ie, or by post to Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963. I would appreciate the chance to put things right first.
Changes
If I change this notice, I will update the date at the top.