Privacy & cookies
Last updated: 19 October 2026
Who looks after your information
I am Karen Anne Tham, trading as Karen Anne Tham Art. I am responsible for personal information collected through this website and my artwork enquiries and sales. Contact me at ktwright29@gmail.com, +44 (0)7780 546 507, or Sylvatica, Hids Copse Road, Oxford, OX2 9JJ, United Kingdom.
What I collect and why
- Enquiries and commissions: your name, contact details, message and the information you choose to share about an artwork or commission. I use these to reply, discuss your requirements and prepare or carry out a contract. For general correspondence, my lawful basis is my legitimate interest in responding to people who contact me.
- Orders and delivery: your name, email, telephone number, billing and delivery addresses, purchased artwork, order notes and payment reference or confirmation. I need these to process your purchase, arrange postage or collection and handle returns. This processing is necessary for our contract. Payment is by bank transfer; this website does not collect card details.
- Records and security: transaction records, correspondence, email delivery logs and technical information such as IP addresses and browser details. I use these to meet legal record-keeping obligations and for my legitimate interests in protecting the website, preventing misuse, resolving disputes and checking that messages are delivered.
- Optional website services: with your consent, analytics helps me understand visits and shopping activity, and third-party services provide fonts and contact-form spam protection. Cookie choices are explained below.
Information requested at checkout is needed to fulfil your order. Without the necessary contact or delivery details, I may be unable to process it. Please do not send sensitive personal information that is unnecessary for your enquiry. I do not use your enquiry or purchase as permission to send unrelated marketing.
Who receives information
Information is shared only as needed with people helping me fulfil orders, delivery providers such as Royal Mail, my website support provider Cotswold Creative and hosting provider eUKhost. Order and contact messages are delivered through SMTP2GO, and I use Google email. Banks process transfer information. Information may also be shared where required by law or needed to obtain professional advice or resolve a dispute.
Google provides Analytics, Tag Manager and reCAPTCHA. Google Fonts and Adobe Fonts supply website fonts when enabled. These services receive technical information, such as an IP address and browser details, when your browser connects to them. If you follow a Facebook or Instagram link, the destination website’s own privacy and cookie choices apply.
Processing outside the UK
Some service providers operate internationally, so information may be processed outside the UK, including in the European Economic Area, the United States and New Zealand. Google describes its use of adequacy decisions, the UK Extension to the EU–US Data Privacy Framework and standard contractual clauses in its data transfer information. SMTP2GO is operated by Sand Dune Mail Ltd in New Zealand; its privacy notice explains its processing and service locations. You can contact me for information about the providers and safeguards relevant to your enquiry or order.
How long information is kept
Order and payment records are kept for applicable tax and accounting requirements and, where necessary, to deal with returns, disputes or legal claims. Enquiry and commission correspondence is kept while it is needed to respond, complete the work or retain an appropriate record of our agreement. The period depends on the purpose, the type of information, legal requirements and whether a matter remains unresolved; records are reviewed when they are no longer needed. The website’s email delivery logs are currently retained for up to two years. Service providers may retain their own operational records for different periods, as explained in their notices.
Cookies and your choices
Cookies are small files stored by your browser. Essential cookies support the basket, checkout, security and your saved choices. Optional categories start switched off. Choose Accept all, Reject optional, or Choose preferences in the banner. Use Cookie preferences at any time to change or withdraw your choices. You can also delete cookies in your browser; doing so may clear your basket and saved preferences.
- Essential: WooCommerce basket cookies such as
woocommerce_cart_hashandwoocommerce_items_in_cartlast for the browsing session;wp_woocommerce_session_*normally lasts two days. Complianzcmplz_*cookies remember your consent choices for up to 365 days, andwp_consent_*cookies communicate those choices to compatible website features for up to 30 days. - Statistics: Google Analytics measures page visits and interactions to help improve the website. Its
_gaand_ga_*cookies normally last up to two years and may be renewed when you return. Google Consent Mode can send limited cookieless measurement signals when analytics storage is declined; declining optional cookies does not mean that no request ever reaches Google. See Google’s privacy notice. - Third-party services: optional fonts and Google reCAPTCHA. reCAPTCHA assesses browser and interaction signals to protect the contact form against spam and may use cookies. If you decline this category, you can still email or telephone me. WooCommerce also uses this consent category for optional order attribution, which records how visitors reached the shop during their visit; its
sbjs_*cookies are session based.
Cookie names can include a site-specific suffix, and durations can restart with a new visit or choice. Details of WooCommerce’s cookies are available in its cookie documentation. Google explains its cookies and technologies here, and Adobe explains its font-service privacy practices here.
Your rights
Depending on the circumstances, you can ask for access to your personal information, correction, deletion, restriction or a portable copy, and you can object to processing based on legitimate interests. You can withdraw consent at any time; this does not affect processing that was lawful before withdrawal. Some records must be kept to meet legal obligations or deal with claims.
Contact me using the details above to exercise your rights or raise a concern. You also have the right to complain to the UK Information Commissioner’s Office: ico.org.uk/make-a-complaint. I will update this notice when the website or its use of information changes.