PRIVACY POLICY

Page Updated (effective date): 7 October 2026

Operated by Steven Patrick Sim t/a The Tartan Artisan®

Business based in Scotland | Privacy Framework: UK GDPR, Data Protection Act 2018 & PECR, as amended by the Data (Use and Access) Act 2025

1. Purpose of this Policy

This Privacy Policy explains how The Tartan Artisan® collects, uses, stores, and protects your personal information when you visit or make a purchase from thetartanartisan.com or use our related services. It covers the Declaration of Arbroath Burnished Gold Editions and our other products, including related tartan.love, TARTAN250 and Star-Spangled Banner / Tartan 250 pages where these services are operated by us.

It covers orders produced and packed at our Arbroath studio, together with the relevant services provided by Shopify, Downpay, payment providers and DHL Express / DHL Express Commerce. It also covers data shared where needed for other products with Print Space Studios Limited (trading as theprintspace and CreativeHub), Contrado, approved kilt manufacturers such as Glenisla Kilts Ltd., and specialist framers such as Aizle Framing. Your information is shared with the providers needed for your order or service, rather than with every fulfilment partner.

This Privacy Policy reflects the Data (Use and Access) Act 2025 (DUAA), which amends the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR). The Act’s data protection and PECR provisions are now in force; we keep this policy under review as official guidance evolves.

We are committed to processing your data lawfully, fairly, and transparently, in line with UK data protection law.

2. Who We Are

Data Controller: Steven Patrick Sim t/a The Tartan Artisan®
Studio / Trading Address: 55 Lordburn, Arbroath, Angus, DD11 1JD, Scotland (studio open by appointment only)
Telephone: 07590 566777
Contact Email: enquiries@thetartanartisan.com
VAT Number: GB-312816916

If you have any questions about this policy or how we handle your data, you can contact us using the details above.

3. Information We Collect

We collect and process the following categories of personal data, depending on how you interact with us and the services you use:

Identity & Contact Data: name, billing address, shipping address, email address, telephone number, country of residence.
Account Data: if you choose to use a customer account, Shopify processes the account and sign-in information needed for it. We use relevant account details, saved addresses, preferences and order history; wishlist information is processed if that feature is available and used.
Transaction & Order Data: purchase details, order numbers, products ordered, edition-number requests, certificate or gift details you choose to provide, deposit and balance-payment status, returns, exchanges, refunds and related correspondence.
Payment & Billing Data: billing contact details, payment method and limited payment identifiers, transaction confirmations and payment status. Full card details are handled by the relevant payment service, such as Shopify Payments or PayPal where offered, and are not stored by us in full. For a Downpay deposit order, a payment method may be held securely through Shopify and the payment service for the authorised remaining payment; Downpay supports management of the order and payment status.
Device & Usage Data: IP address, browser type and version, device identifiers, operating system, pages viewed, time spent on pages, interaction with site features, and referring/exit pages. This may be collected through cookies, pixels and similar technologies.
Marketing & Communications Data: newsletter subscriptions, marketing preferences, competition entries, and records of communications where you contact us for support or enquiries.
Additional Order Data: details you provide for custom or made-to-measure items (for example, body measurements, garment specifications and style preferences for kilts and related products).

We collect this information directly from you (for example, when you place an order, use a customer account, sign up for emails or contact us), through your use of our website and Shopify-powered services, and from the payment, deposit, delivery or fulfilment providers handling your order. Cookies and similar technologies are used subject to the consent rules described below.

We need appropriate contact, order, payment and delivery details to accept and fulfil an order, and garment measurements where you order a made-to-measure item. Without the necessary information, we may be unable to complete that service. Newsletter sign-up, an optional account and optional marketing consent are not required to buy a product. If you arrange delivery to someone else, provide only the details needed for that delivery and let the recipient know about this policy.

4. How We Use Your Information

We use your personal data for the following purposes:

To fulfil orders and deliver products.
- Burnished Gold Editions: Black Onyx, Pewter and Pearl prints are produced, numbered, certified and packed by The Tartan Artisan® in Arbroath. These studio orders are separate from theprintspace and Contrado fulfilment routes.
- Other studio products and kilts: studio orders are managed in-house; necessary measurements, garment specifications and order details are provided to Glenisla Kilts or the approved tailor producing your garment.
- Selected partner-fulfilled fine-art prints: other print editions still offered on the website may be fulfilled by theprintspace through its relevant UK, EU or US lab. Specialist framed artworks may involve Aizle Framing or another agreed framer for preparation, collection or delivery.
- Print-on-demand products: relevant items are produced and shipped by Contrado Imaging Ltd (London).
- Payments and deposits: Shopify, Downpay where a deposit option is selected, and the relevant payment provider process the information needed to manage payments, payment requests, refunds and order status. A deposit is part-payment for one order, not a recurring subscription; any authorised balance payment is governed by the purchase terms shown to you.
- DHL delivery: destination and parcel information is used to calculate delivery quotes, including applicable remote-area charges. Recipient contact details and relevant order, parcel and customs information are used as needed to prepare shipment documents, arrange collection and delivery, and provide tracking. Other order types may use a different agreed courier or collection arrangement.
To provide, tailor and improve our services.
- Operating our website and checkout, remembering your preferences, and displaying content in a way that works on your device.
- Understanding how visitors use the site so we can improve layout, navigation, product ranges and performance.
- Recommending products that may interest you based on your browsing or purchase history, where this is appropriate and lawful.
To communicate with you.
- Responding to enquiries and support requests.
- Sending order confirmations, deposit or balance-payment messages, shipping updates, issue resolution messages and service notifications. These messages relate to your order or service and do not depend on newsletter consent.
To maintain legal and financial records.
- Keeping accounting, tax and transaction records required by law (for example, HMRC record-keeping obligations).
- Maintaining documentation relating to orders, refunds, complaints or disputes.
To keep our services secure and prevent fraud.
- Protecting our website, systems and customers from unauthorised access, abuse, spam and fraudulent transactions.
- Using limited data for security monitoring, chargeback investigation and abuse prevention.
To send marketing updates (where you consent).
- Sending newsletters, launch announcements and offers by email, only where you have actively opted in.
- You can unsubscribe at any time using the link in our emails or by contacting us.

5. Our Legal Bases for Processing

We process your personal data on the following lawful bases under UK GDPR:

Performance of a contract: to process and fulfil your orders, take payment, provide customer service, manage returns and operate your online account.
Legal obligation: to meet our obligations under tax, accounting and consumer protection laws, and to respond to lawful requests from authorities.
Legitimate interests: to operate and protect our business (for example, website security and fraud prevention), manage enquiries, and improve our products and services where this does not override your rights. Where we rely on this basis, we balance our interests against your rights and expectations. It does not replace consent where consent is required for cookies, tracking or electronic marketing.
Consent: for our opt-in email marketing and for optional analytics, advertising cookies and similar technologies where consent is required. You can withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

Purpose	Lawful basis (UK GDPR Art. 6)
Order processing & delivery (including managing your online account and customer support)	Performance of a contract
Accounting, tax records & legal compliance	Legal obligation
Website operation & service improvement, excluding consent-based tracking	Legitimate interests (to operate, protect and improve our business and services, subject to your rights)
Marketing communications (email newsletters, launch announcements and offers)	Consent (our opt-in email approach)
Optional analytics, advertising cookies & related tracking where consent is required	Consent
Security, fraud prevention & abuse monitoring	Legitimate interests (to protect our business, our customers and the public)

The Data (Use and Access) Act 2025 introduces a concept of recognised legitimate interests for specific activities in the wider public interest (for example, serious crime and public security). These provisions sit alongside the lawful bases above. For the ordinary running of this store we generally rely on contract, legal obligation, legitimate interests and consent as described, and we will update this policy if our use of recognised legitimate interests changes.

6. Sharing Your Information

We share only the minimum necessary information with trusted third parties for the purposes described in this policy:

Shopify and its relevant affiliates – our ecommerce platform provider, which hosts the store, supports checkout and payments, provides analytics and security services, and helps us manage orders and customer accounts. Shopify’s different roles are explained in Section 7.
Downpay (Hypehound Inc.) – where you use a deposit purchase option, for the customer and order information, deposit amount, remaining balance and payment status needed to manage that option through Shopify.
DHL Express and DHL Express Commerce – for delivery quotes and shipment management, including the destination, recipient name, delivery address, relevant contact details, parcel details and customs information needed for the service. Information may also pass to the connected shipping provider and relevant customs authorities.
Print Space Studios Limited – for the selected partner-fulfilled fine-art prints and framing services produced through its relevant regional lab; this is not the production route for Burnished Gold Editions.
Aizle Framing / other agreed specialist framers – necessary order and contact details for specialist framed-artwork preparation, collection or agreed delivery.
Contrado Imaging Ltd. – for on-demand production and logistics of certain printed products from its London operations.
Glenisla Kilts Ltd. / approved tailors – to manufacture, alter and quality-check made-to-measure kilts and related garments using measurements and order details you provide.
Service providers and professional advisers – such as couriers, payment processors, IT and hosting providers, accountants and legal advisers who support our business.
Marketing and advertising partners – where tools such as Meta Pixel or Google services are enabled, and subject to your choices and applicable consent requirements, to understand campaign performance and show relevant adverts. These providers may also process data for their own purposes as explained in their privacy policies.
Public authorities and law enforcement – where we are legally required to disclose information, or where disclosure is necessary to protect our rights, customers or the public.

Providers acting as data processors for us are required to handle information securely and lawfully under appropriate data-processing terms. Some providers, including payment services, couriers or Shopify for certain services, may act as independent data controllers for their own activities and legal obligations.

We do not sell your personal data for money or rent customer lists. Some advertising-related disclosures may nevertheless be treated as “sale”, “sharing” or “targeted advertising” under certain US privacy laws. Where applicable, your choices and rights are explained in Section 7 and Section 11.

7. Relationship with Shopify & Shopify Network Intelligence

Our store is built on and hosted by Shopify. When you use this website or place an order, some of your personal information is collected and processed through Shopify’s systems so that the Services can function (for example, to power checkout, process payments, prevent fraud and provide analytics).

In many cases, Shopify acts as our data processor, processing personal data on our behalf to help us run this store. For certain services, including its Enhanced Services when Shopify Network Intelligence is enabled, Shopify acts as an independent data controller. Those services can use information from your interactions with this store, other merchants and Shopify to improve shopping, analytics, security and advertising services. Shopify and its relevant service providers may process that information in other countries, as described in its privacy information.

Where Shopify processes your personal information as an independent controller, Shopify is responsible for that processing and the associated rights requests. This does not remove our responsibility for the information we control. Consent is required for personalised advertising under the applicable UK, EEA and Swiss rules; you can withdraw that consent or object to relevant Shopify processing through the Shopify privacy portal. Where applicable, the portal also provides advertising-sharing opt-outs.

To understand how Shopify uses personal information, and to exercise your rights in relation to data that Shopify controls, you can visit:

Shopify Consumer Privacy Policy: https://www.shopify.com/legal/privacy/consumers
Shopify Privacy Portal (rights requests and opt-outs): https://privacy.shopify.com/

When you make a rights request to us (for example, for deletion) we will, where appropriate, also work with Shopify so that data processed on our behalf in connection with this store is updated or erased as required.

8. International Transfers

Some service providers, including Shopify, Downpay and relevant payment or fulfilment providers, operate internationally or use systems outside the UK. Overseas delivery may also require information to be passed to DHL, its delivery partners and customs authorities in the destination country. This means relevant personal data may be processed outside the UK.

Where such transfers occur, we rely on appropriate safeguards, which may include:

UK adequacy regulations where the destination or relevant recipient is covered; or
Appropriate safeguards such as the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, together with any required assessment and additional measures.

The mechanism depends on the provider, destination and processing involved. Where another lawful transfer route is applicable, such as a necessary transfer to carry out an overseas delivery contract, we apply its conditions. You can contact us for information about the safeguards relevant to your data, including a copy where available, subject to necessary redactions.

9. Data Retention

Order records & invoices, including relevant deposit, balance-payment, refund and delivery records, are generally kept for 6 years for VAT, accounting and other applicable record-keeping obligations.
Customer accounts and routine correspondence are usually retained for up to 3 years after your last meaningful interaction with us, then securely deleted or anonymised, unless a longer period is required (for example, in connection with a dispute).
Analytics data is typically kept for up to 14 months, depending on the tools in use and their settings. Individual cookie expiry periods vary by purpose and provider; cookie and consent information is described in our Cookie Policy.

We may keep relevant information for longer where we have an unresolved order, need to establish or defend legal claims, or are required to do so by law. We may retain a minimal suppression record to respect an unsubscribe request. Payment services, couriers and other independent controllers may retain their own records under their separate obligations and privacy policies. When information we control is no longer needed, we delete it or anonymise it so it can no longer be linked to you.

10. Cookies & Tracking

We use cookies and similar technologies to operate our Shopify store and, where enabled and authorised, to understand site use or measure and deliver advertising. This may involve tools such as Shopify analytics, Google Analytics 4 and Meta Pixel. Strictly necessary technologies support functions such as the basket, checkout and security. Optional analytics and marketing technologies are subject to the consent arrangements described in our Cookie Policy; advertising tracking requires consent where applicable.

Full details are set out in our Cookie Policy.

Use the cookie or privacy controls provided on the site to manage your preferences where available. Browser settings can also block or delete cookies, although deleting cookies alone does not withdraw every form of server-side consent or data sharing. For information Shopify controls, you can use the Shopify privacy portal. Where recognised by the relevant service, browser-based signals such as Global Privacy Control can express an opt-out from certain advertising-related data sharing. Contact us if you need help exercising a choice or withdrawing consent.

11. Your Data Protection Rights

Under UK data protection law, you have the following rights in relation to your personal data:

Access – to request a copy of the personal data we hold about you.
Rectification – to ask us to correct inaccurate or incomplete information.
Erasure (“Right to be Forgotten”) – to request deletion of your data where there is no longer a good reason for us to keep it.
Restriction – to ask us to limit how we use your data in certain circumstances.
Portability – to receive your data in a structured, commonly used, machine-readable format and, where technically feasible, to have it transmitted to another controller.
Objection – to object to processing based on legitimate interests, subject to the applicable rules, and to object to direct marketing at any time.
Withdrawal of consent – to withdraw consent at any time, including by unsubscribing from marketing emails, without affecting the lawfulness of processing before withdrawal.
Complaint – to raise a data protection concern with us and to lodge a complaint with the Information Commissioner’s Office (ICO) if you are unhappy with how your data is handled.

ICO Contact: www.ico.org.uk | Make a complaint

Requests can be made to enquiries@thetartanartisan.com. We may need proportionate information to verify your identity or clarify the request. We normally respond within one calendar month, subject to the applicable rules on when that period starts, lawful pauses, extensions and exemptions. These rights are not all absolute; where a request cannot be met in full, we will explain the relevant reason. Requests are normally free of charge.

Depending on where you live and which laws apply, you may have additional rights, including certain rights to opt out of “sale”, “sharing” or targeted advertising. Contact us to exercise rights concerning information we control; use the Shopify privacy portal for information Shopify controls. Available on-site privacy controls or recognised browser signals may also support those choices. Your applicable statutory rights are not reduced because our business is based in Scotland.

12. Data Security

We use appropriate technical and organisational measures to protect personal data, including encrypted connections to our Shopify store, payment processing through the relevant payment service, and access limited to those who need it for the purposes described in this policy.

Offline records, such as garment measurements and paper order documents, are handled securely with access limited to those who need them.

No system can be guaranteed 100% secure, but we take care to select reputable service providers and to review our security arrangements periodically.

13. Minors

Our website and services are not intended for individuals under the age of 16. We do not knowingly collect personal information from children.

If you believe a child has provided us with personal information, please contact us so we can investigate and take appropriate action.

14. Automated Decision Making & Profiling

We do not make decisions about you that are based solely on automated processing and that produce legal or similarly significant effects.

Where enabled and lawful, analytics and advertising tools may use browsing or purchase information to understand product interest, measure campaigns or personalise recommendations. Cookies and advertising tracking remain subject to the choices and consent requirements described above. Shopify and payment providers may also use automated fraud or security screening. If an assessment affects your order, contact us to request human consideration of our handling of it. A decision made by your bank or another independent provider may need to be raised with that provider.

15. Links to Other Websites

Our site may contain links to external websites or services that are not operated by us. We are not responsible for the privacy practices, content or security of those third-party sites.

We encourage you to review the privacy policies of any external sites you visit.

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect legal changes, operational updates or improvements to our services.

The latest version will always be dated at the top of this page. Where changes are material, we will take reasonable steps to notify you, for example by email or a prominent notice on the website.

17. Questions or Complaints

If you have any questions, concerns or complaints about this policy or how your data is handled, please contact:

Steven Patrick Sim
The Tartan Artisan®
Public Studio:
55 Lordburn, Arbroath, Angus, DD11 1JD, Scotland
(Open by appointment only)
📞 Telephone: 07590 566777
✉ enquiries@thetartanartisan.com

You can make a data protection complaint using the email, postal address or telephone number above. We will acknowledge it within 30 days, investigate and respond without undue delay, keep you informed of progress, and explain the outcome and any action taken.

If you are not satisfied with our response, you have the right to raise the matter with the Information Commissioner’s Office using the complaint link in Section 11. This complaints process is separate from an access or other data-rights request, whose usual response period is described in Section 11.

End of Policy

(This Privacy Policy replaces earlier versions of our privacy notice for the activities it covers, including the Burnished Gold Editions and other services described above. It is published both on our website privacy page and in Shopify’s checkout privacy policy. It does not replace the independent privacy policies of Shopify or other service providers.)