Privacy Policy

Information We Collect

We collect information you provide directly to us, information collected automatically when you use our website, and information from third parties where applicable.

Information you provide:

• Name, email address, and password when you create an account
• Billing and shipping address when you make a purchase
• Payment card details (processed securely via our payment provider — we do not store raw card data)
• Phone number and country when completing your profile
• Artist application information including portfolio URL, practice description, and price range
• Messages and enquiries you send us through the contact form or email

Information collected automatically:

• IP address and approximate geographic location
• Browser type, device type, and operating system
• Pages visited, time on site, and referring URLs
• Cookie identifiers and session data (see Cookies section)

How We Use Your Data

We use the information we collect for the following purposes:

• To create and manage your account and authenticate your login
• To process and fulfil purchases, including sending order confirmations and shipping updates
• To review and respond to artist or institution applications
• To send transactional emails (receipts, delivery notifications, password resets)
• To send marketing communications where you have opted in — you may opt out at any time
• To improve and personalise the website experience
• To detect, investigate, and prevent fraudulent or illegal activity
• To comply with legal obligations applicable to us as a UK-based business

Our legal basis for processing personal data is primarily the performance of a contract (fulfilling orders), legitimate interests (fraud prevention, site improvement), your consent (marketing emails), and legal obligation (tax and financial record-keeping).

Sharing & Disclosure

We do not sell, rent, or trade your personal data to third parties. We may share your data only in the following limited circumstances:

• Payment processors — to securely handle transactions (e.g. Stripe)
• Shipping and logistics partners — to fulfil and deliver your order
• Email service providers — to send transactional and marketing emails on our behalf
• Analytics providers — to understand how our website is used (anonymised or pseudonymised where possible)
• Legal authorities — where required by law, court order, or to protect the rights and safety of Rasa Collective and its users

All third-party service providers are required to process your data only for specified purposes and in accordance with our instructions and applicable data protection law.

International data transfers

As a US-based business, we and our service providers store and process personal information in the United States. If you are located in the United Kingdom or the European Union, this means your information is transferred outside your home jurisdiction. Where such transfers are subject to UK or EU data protection law, we rely on appropriate safeguards — such as the UK International Data Transfer Agreement, EU Standard Contractual Clauses, or transfers to jurisdictions recognised as providing an adequate level of protection. You may request details of these safeguards using the contact details below.

Cookies

We use cookies and similar tracking technologies to operate and improve our website. Cookies are small text files stored on your device when you visit our site.

• Strictly necessary cookies — required for the website to function (session management, cart persistence, login state). These cannot be disabled.
• Preference cookies — remember your settings such as theme (light/dark mode).
• Analytics cookies — help us understand which pages are most visited and how users navigate the site.
• Marketing cookies — used to show you relevant advertising on third-party platforms, only where you have consented.

You may manage or disable non-essential cookies through your browser settings. Note that disabling cookies may affect the functionality of certain parts of our site.

Data Retention

We retain your personal data for as long as is necessary to fulfil the purposes for which it was collected, including satisfying any legal, accounting, or reporting requirements.

• Account data is retained for the lifetime of your account and for up to 2 years after account closure
• Purchase and financial records are retained for 7 years in accordance with UK tax law
• Artist application data is retained for 3 years from the date of submission
• Marketing consent records are retained until you withdraw consent, plus 1 year for compliance evidence

When your data is no longer required, it is securely deleted or anonymised.

Your Rights

Depending on where you live, you may have some or all of the following rights over your personal information:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate or incomplete data
• Right to erasure — request deletion of your data in certain circumstances
• Right to restrict processing — request that we limit how we use your data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, please contact us at privacy@rasa-collective.com. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO).

Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These include:

• Encrypted data transmission via HTTPS/TLS on all pages
• Passwords stored as bcrypt hashes — never in plain text
• Payment data handled exclusively by PCI-DSS compliant payment providers
• Access to personal data restricted to authorised personnel only
• Regular security reviews and software updates

While we take all reasonable steps to protect your data, no method of electronic transmission or storage is 100% secure. We encourage you to use a strong, unique password for your Rasa Collective account.

Third-Party Links

Our website may contain links to third-party websites, including artist portfolio sites, social media platforms, and partner organisations. This Privacy Policy applies only to our website. We have no control over and accept no responsibility for the privacy practices of third-party sites. We encourage you to review the privacy policy of any site you visit.

Children

Our website and services are not directed at children under the age of 16. We do not knowingly collect personal data from anyone under 16. If you believe we have inadvertently collected data from a child, please contact us immediately at privacy@rasa-collective.com and we will take steps to delete it promptly.

Policy Changes

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, notify registered users by email.

Your continued use of our website following any changes constitutes your acceptance of the revised policy. We encourage you to review this page periodically.

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or our data practices, please get in touch: