Privacy Policy

Please read this Privacy Notice carefully as it sets out which personal data Canvas Art Law (“Canvas”, “we”, “our” or “us”) collects, stores, uses and shares (together “processes”) and sets out data protection rights, our contact details and the supervisory authority’s contact details. This Privacy Notice addresses those using, browsing or accessing our website at www.canvasartlaw.co.uk (the “Website”) and/or accessing, interacting or communicating with us via social media (together “Website Users”, “you”, or “your”). By accessing our Website and/or interacting with our social media accounts, you acknowledge and consent to the information collection and use practices described below, otherwise please do not use this Website or our interact with us via social media.

Should we process your personal data in a different context or circumstance (e.g. if you instruct us and become our client or you contact us directly over email to discuss a legal matter) a separate Privacy Notice which details how we process data relating to our clients, potential clients and other third parties we work with will apply to you and which will be made available.

 

1. Who are we?

Canvas is a London based law firm dedicated to the arts, culture and heritage. We are:

  • A limited company registered in England and Wales with registered number 10754531 and our registered office is at Somerset House Strand, London, WC2R 1LA;
  • Authorised and regulated by the Solicitors Regulation Authority with registered number 659934; and
  • Registered with the UK Information Commissioner’s Office with and our ICO reference number is ZA558296.

2. What is personal data?

Personal data includes information relating to natural persons who (i) can be identified or who are identifiable, directly from the information in question; or (ii) who can be indirectly identified from that information in combination with other information. This could include your name, social media handle, IP address, or even a cookie identifier.

3. What personal data do we process about you?

We may process the following personal data:

  • Your identity details (e.g. your social media handle) that you provide social media;
  • Your contact details that you provide social media;
  • Any other information that you send to us over social media; and
  • Information that we collect automatically from your visit to our Website such as your browsing history, IP address, device ID, device type, browser type and other technical data.

4. How do we process your personal data?

We may process the above personal data directly from interactions with you over social media or through your use of our Website. In particular, as a result of you:

  • Corresponding with us over social media;
  • Liking, following or commenting on our social media posts; and
  • Searching and browsing our Website.

5. How and why do we process your personal data?

We will only process your personal data if we have a legal ground for doing so. We rely on the following legal grounds:

  • To satisfy our legitimate business interests provided that our right to do so is not overridden by your own rights and interests (e.g. ensuring network and information security, and carrying out other administrative and operational functions); and
  • If you have given your consent in relation to the use of optional cookies. For information on opting in and out of our cookies, please see our Cookie Policy here.

6. Do we share information with third parties?

We use third party service providers with whom we may share your personal data. We are not responsible for their privacy practices and you are encouraged to read their privacy notices. The third-party platforms that are relevant are set out below, but these might be updated from time to time:

  • Squarespace: A website hosting provider which hosts the Website. Please read Squarespace’s privacy notice here to understand what personal data they store and how.
  • Instagram: Instagram is a photo and video sharing social networking service owned by Facebook. On our Website, by clicking the Instagram icon at the footer or our Instagram handle on the contact us page, you will be redirected to our Instagram account. Please read Instagram’s privacy notice here to understand what personal data they store and how.
  • LinkedIn: LinkedIn is a business and employment-oriented online service used for professional networking. On our Website, by clicking the LinkedIn icon at the footer or our LinkedIn name on the contact us page, you will be redirected to our LinkedIn account. Please read LinkedIn’s privacy notice here to understand what personal data they store and how.

7. What about links to third party websites?

Our Website may, from time to time, contain links to and from third party websites. If you follow a link to any of these websites, please note that these websites have their own privacy notices and that we do not accept any responsibility or liability for them. Please check the individual privacy notices before you submit any information to those websites.

8. Is the personal data stored securely?

We take all necessary technical and organisational measures to protect the confidentiality and security of your personal data. We do not store personal data of Website Users or communications over social media locally nor on our cloud management software. Unfortunately, no transmission of information via the internet is completely secure and we cannot guarantee the security of your personal data transmitted to us and any transmission is at your own risk.

9. How long do we keep your personal data for?

Cookies and visitor data is kept for the time periods set out in the Cookie Policy here and any communications over social media will only be retained for as long as reasonably necessary. To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory or other requirements. We will securely dispose of any communications over social media by permanently deleting them. Personal data shared with third party service providers is stored and deleted according to their privacy notices.

10. Do we transfer your data outside the UK and/or the EEA?

We may transfer your data outside the UK and/or the EEA because some of the third party services we use process data outside the UK. It is our policy to use only third parties that we are satisfied will maintain levels of security and confidentiality that are appropriate for such transfers.

11. Do we use Cookies?

Our Website uses cookies and similar technologies (collectively referred to as cookies). For more information on the cookies we use, please see our Cookie Policy here.

12. What are your rights?

Under the Data Protection Act 2018, you have rights including:

  • Right of Access: To ask for copies of your personal data.
  • Right to Rectification: To ask to rectify inaccurate/incomplete personal data.
  • Right to Erasure: To ask for your personal data to be erased in certain circumstances.
  • Right to Restriction of Processing: To ask to restrict the processing of your personal data in certain circumstances.
  • Your right to object to processing: To object to the processing of your personal data in certain circumstances.
  • Your right to data portability: To ask that your personal data be transferred to another organisation, or to you, in certain circumstances.

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive.

13. How can you contact us?

Please contact us by writing to our registered address at: 35 Berkeley Square, Mayfair, London, W1J 5BF or by email at info@canvasartlaw.art if you have any questions or complaints about this Privacy Notice or the way your personal data is processed by us, or where you would like to exercise one of your rights set out above. We will come back to you within a month of receipt of your request.

14. How can you complain?

We hope that we can resolve any query or concerns you may have and want to raise with us using the contact details provided above. However, you also have the right to lodge a complaint with a supervisory authority in the European Economic Area state where you work, normally live, or where the alleged infringement of data protection laws occurred. The supervisory authority in the UK is the Information Commissioner’s Office (ICO). The ICO can be contacted by the following means:

  • Website form accessible here;
  • Telephone from UK: 0303 123 1113;
  • Telephone outside UK: +44 1625 545 700; or
  • Post: ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

15. When was this policy last updated?

This Privacy Notice was published and last updated on 19 May 2021. This Privacy Notice may be updated from time to time. All amendments will take effect immediately upon posting of the updated Privacy Notice on this Website. If the changes are material, we will post a notice on the Website before the changes go into effect. We encourage you to periodically review this Privacy Notice to stay informed about how we are helping to protect your personal data.