Privacy policy
Last updated: 16 October 2026
This Privacy Policy explains what personal information we collect when you use 2dfigurepainting.com, how we use it, who we share it with, and the rights you have over it.
Please read it alongside our Terms and Conditions and our Cookie Policy.
Who We Are
2D Figure Painting is a trading name of Tomasz Lewandowski, operating as a sole trader in the United Kingdom.
For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the Data Controller is:
Tomasz Lewandowski, trading as 2D Figure Painting 1 Newgate, London, CR0 2FB, United Kingdom info@2dfigurepainting.com
If you have any question about this policy or about how we handle your information, email us at the address above.
Definitions
Personal data means any information relating to an identified or identifiable person.
Processing means anything done with personal data — collecting it, storing it, using it, sharing it, or deleting it.
Data Controller means the person who decides why and how personal data is processed. That is us.
Data Processor means a third party who processes personal data on our behalf, under our instructions.
You means the person visiting our website or placing an order with us.
Service means the website 2dfigurepainting.com and the goods and services offered through it.
What We Collect
Information you give us
When you place an order, contact us, or sign up to our mailing list, you may provide:
- Your name
- Your email address
- Your billing address
- Your shipping address
- Your telephone number
- Reference photographs, images or written instructions you send us for a custom commission
- Any other information contained in messages you send us
Payment information
We do not collect or store your card details.
Payments are processed by the third-party providers shown at checkout, which may include Shopify Payments, Shop Pay, PayPal and supported wallet or instalment providers. Availability varies by location and order.
Your card number, expiry date and security code go directly to the payment provider and are never visible to us.
We receive transaction records and limited payment information made available by the provider, such as payment status, billing details and masked card information, for order matching, accounting and fraud prevention.
Where you choose to pay using Klarna, your agreement for that payment is with Klarna, and Klarna's own privacy policy applies to the information you give them.
Information collected automatically
Our platform and enabled services may process the following technical information when you visit, depending on the service and any required consent:
- Your IP address
- Your browser type and version
- Your device type and operating system
- The pages you visit and the time spent on them
- The website or advertisement that referred you to us
- General location at city or country level, derived from your IP address
This is collected through cookies and similar technologies. Our Cookie Policy explains this in full and tells you how to control it.
Why We Use It, and Our Legal Basis
Under UK GDPR we must have a lawful basis for everything we do with your data. These are ours:
| What we use it for | Lawful basis |
|---|---|
| Processing and fulfilling your order | Performance of a contract |
| Sending order confirmations, proofs and dispatch notices | Performance of a contract |
| Answering your questions and providing support | Performance of a contract |
| Taking payment and preventing fraud | Legal obligation and legitimate interests |
| Keeping records for tax and accounting | Legal obligation |
| Understanding how our website is used, so we can improve it | Consent (via cookies) |
| Sending marketing emails | Consent |
| Defending against chargebacks and disputes | Legitimate interests |
Where we rely on consent, you may withdraw it at any time. Withdrawing consent does not affect anything we did lawfully before you withdrew it.
Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights, and concluded it is not. You may object to this processing — see Your Rights below.
Custom Commission References
If you send us photographs or images for a custom commission, we use them solely to complete your order.
We will not publish, display or share a photograph you send us without your permission. If we would like to show your finished figure on our website or social media, we will ask you first.
Where a reference photograph contains an image of a person, a pet or a private property, you confirm you have the right to send it to us for this purpose.
We retain reference photographs and written instructions for 6 years from completion of your order, in line with our order records. We keep these because they form part of the specification you agreed, and may be needed to resolve a dispute, to answer a query about a past commission, or to fulfil a repeat order.
You may ask us to delete your reference photographs at any time. Where you do, we may retain a written description of the agreed specification in order to establish, exercise or defend a legal claim.
Who We Share It With
We share your personal data only where necessary, and only with the following:
Shopify — our e-commerce platform. Hosts the website and processes orders. Privacy policy: shopify.com/legal/privacy
Payment providers — Shopify Payments, Shop Pay, PayPal, Apple Pay, Google Pay and Klarna, depending on the method you choose. Each receives the information it needs to take your payment, and each operates under its own privacy policy.
Google Analytics and Microsoft Clarity — website measurement and interaction analysis where enabled and subject to any consent required by law. Clarity and its associated integrations are present in the store’s theme configuration. See our Cookie Policy for controls and further information. We do not use this notice as a substitute for consent.
Judge.me — our review platform. Invites reviews after purchase and displays them on our website. It receives your name, email address and order details for this purpose, and operates under its own privacy policy: judge.me/privacy
Our painting studio in Vietnam — receives your name and shipping address where needed to prepare and dispatch your order.
Shipping carriers — UPS, DHL, FedEx and their partners. Receive your name, shipping address and telephone number to deliver your parcel, and where required may pass these to customs authorities.
Email providers — used to send order updates and, where you have subscribed, marketing emails.
Professional advisers — accountants and, if ever necessary, legal advisers.
We do not sell customer mailing lists. Enabled analytics, embedded media, social integrations or advertising services may process technical information for their stated purposes, subject to applicable privacy choices. This notice does not mean that no information is ever processed by a third-party integration.
We may disclose personal data where we are legally required to do so, or where it is necessary to establish, exercise or defend a legal claim.
International Transfers
Our painting studio is in Vietnam. Where needed for fulfilment, limited information such as your name, delivery address and telephone number is shared with the studio and delivery partners so your order can be prepared and dispatched.
Shopify and other providers may process information outside the United Kingdom. Where a restricted international transfer occurs, UK data-protection law requires a valid transfer mechanism, such as applicable adequacy regulations, appropriate contractual safeguards, or a specific exception where its conditions are met. The mechanism depends on the recipient and transfer.
We do not state that a particular contract or exception covers every transfer without checking the arrangement. Contact info@2dfigurepainting.com for information about recipients and the safeguards applicable to your order.
How Long We Keep It
| Data | Retention period |
|---|---|
| Order records, invoices and transaction data | 6 years from the end of the tax year, as required by HMRC |
| Customer support correspondence | 2 years from the last contact |
| Commission reference photographs and written briefs | 6 years from completion of the order, aligned with order records |
| Marketing subscriber data | Until you unsubscribe, with a minimal suppression record retained where needed to honour that choice |
| Website analytics data | According to the relevant provider’s configured retention settings; contact us for details |
When a retention period ends, we delete the data or anonymise it so it can no longer identify you.
Your Rights
Under UK GDPR you have the following rights over your personal data:
Right of access — you may ask for a copy of the personal data we hold about you.
Right to rectification — you may ask us to correct data that is inaccurate or incomplete.
Right to erasure — you may ask us to delete your data. This right is not absolute: we may need to keep order and transaction records to meet our legal obligations.
Right to restriction — you may ask us to pause our use of your data while a concern is resolved.
Right to data portability — you may ask for the data you gave us in a structured, machine-readable format.
Right to object — you may object to processing we carry out on the basis of legitimate interests, and you may object to direct marketing at any time.
Right to withdraw consent — where we rely on consent, you may withdraw it at any time.
Rights relating to automated decision-making — Shopify and payment providers may use automated fraud and risk tools. Contact us if an automated restriction affects an order so we can review the issue and explain the options available.
To exercise any of these rights, email info@2dfigurepainting.com. We will respond within one month. If your request is complex we may extend this by a further two months, and we will tell you if we do.
We may ask you to confirm your identity before we act on a request. There is no charge, unless a request is manifestly unfounded or excessive.
Complaints
If you are unhappy with how we have handled your personal data, please contact us first so we can try to put it right.
You also have the right to complain to the UK's supervisory authority:
Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF Telephone: 0303 123 1113 Website: ico.org.uk
If you are in the European Economic Area, you may instead complain to the supervisory authority in your country of residence.
Marketing
We will send you marketing emails only where you have asked us to.
Every marketing email carries an unsubscribe link. You may also email us at any time and ask to be removed. We will act without undue delay. We may retain a minimal suppression record so that we do not accidentally send you marketing again.
Unsubscribing from marketing does not stop transactional emails about an order you have placed — order confirmations, proofs, dispatch notices and invoices. These form part of our contract with you.
Cookies
We use cookies and similar technologies on this website, including Google Analytics.
Our Cookie Policy explains what we use, why, and how you can control them.
Children
Our Service is not directed at children. We do not knowingly collect personal data from anyone under 18.
If you believe a child has provided us with personal data, email us and we will delete it.
Security
We take reasonable technical and organisational measures to protect your personal data.
Our website runs over an encrypted connection (HTTPS). Payment data is handled by PCI-compliant providers and never reaches our systems. Access to order data is limited to those who need it to fulfil your order.
No method of transmission over the internet is completely secure, and we cannot guarantee absolute security. If a data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where the risk is high, notify you directly.
Links to Other Websites
Our website may contain links to other sites. We are not responsible for their content or their privacy practices. We encourage you to read the privacy policy of any site you visit.
Changes to This Policy
We may update this policy from time to time. The date at the top shows when it was last changed.
Where a change materially affects how we use your personal data, we will take reasonable steps to notify you.
Contact Us
Tomasz Lewandowski, trading as 2D Figure Painting 1 Newgate, London, CR0 2FB, United Kingdom
Email: info@2dfigurepainting.com Website: 2dfigurepainting.com/pages/contact
