PRIVACY POLICY

Last updated: 19 October 2026

This policy explains what personal information Slowly Downward Manufactory collects when you visit our website, buy from us or sign up to our newsletter, why we collect it, who we share it with and the rights you have over it. We only collect what we need to sell and deliver prints to you, and we never sell your information to anyone.

WHO WE ARE

The website slowlydownward.co.uk is run by Slowly Downward Manufactory Limited, a company registered in England and Wales with company number 14768080, whose registered office is at c/o L&C LLP, City Bridge House, 57 Southwark Street, London SE1 1RU. We are the "controller" of your personal information under UK data protection law (the UK GDPR and the Data Protection Act 2018).

If you have any questions about this policy or your information, email us at privacy@slowlydownward.co.uk.

WHAT WE COLLECT

• When you order: your name, email address, delivery and billing address, phone number (if you give one), what you bought and the edition numbers, and the order and delivery history. Your card details are entered directly with our payment provider, Stripe; we never see or store your full card number.
• If you create an account: your name, email address, a securely scrambled (hashed) version of your password, your saved addresses and your language preference.
• If you send us a photo of your edition number (from My Collection): the photo and the edition number we read from it.
• If you sign up to our newsletter: your email address and when you gave your consent. We also record whether our newsletters are delivered, opened or clicked, so we can stop emailing addresses that bounce.
• When you contact us or make an artist's proof enquiry: your name, email address and what you tell us.
• When you use the website: your IP address and basic details about your browser and device. We use your approximate location (country) to show prices in your currency and to suggest your shipping country. We keep an anonymous count of visitors and of how many items are in baskets, which does not identify you.

WHY WE USE IT, AND OUR LEGAL BASIS

• To take your payment, deliver your order, keep track of each numbered print and provide your certificate of authenticity: this is necessary to perform our contract with you.
• To run your account and send emails about your orders (confirmations, shipping and tracking, receipts, password resets): necessary to perform our contract with you.
• To keep accounting and tax records: a legal obligation.
• To send our newsletter: your consent. You can unsubscribe at any time using the link in every email, or by contacting us.
• To keep the website secure and stop automated buying, so that limited editions go to real collectors (including bot protection and limits on how many copies can be held at once): our legitimate interests in running a fair and secure shop.
• To show prices in your currency and remember your basket: our legitimate interests in making the website work well for you.

WHO WE SHARE IT WITH

We use trusted service providers who process information on our behalf and only for the purposes above:

• Stripe, to take payments securely.
• Supabase, which hosts our database and image storage (in Ireland, in the EU).
• Vercel, which hosts the website.
• Resend and Mailchimp, to send order emails and newsletters.
• Cloudflare, for bot protection (see Bot protection below).
• Couriers (UPS, Royal Mail and DPD): your name, delivery address, phone number and email address, so they can deliver your parcel and send you delivery updates. For deliveries outside the UK, customs authorities may also receive these details along with a description and value of the goods.
• Xero, our accounting software, which holds your name, email address and invoice details.
• Our professional advisers (such as our accountant), and the police, HMRC or other authorities if the law requires us to share information.

INTERNATIONAL TRANSFERS

Some of these providers (including Stripe, Vercel, Resend, Mailchimp and Cloudflare) are based in, or use systems in, the United States or other countries outside the UK. Where your information is transferred outside the UK, it is protected by the UK government's adequacy regulations (including the UK–US data bridge) or by the UK International Data Transfer Agreement or Addendum, as the law requires.

HOW LONG WE KEEP IT

• Orders and invoices: for six years after the end of the financial year they belong to, as required for tax purposes. Because every print is part of a numbered limited edition, we may keep a record of which edition number went to which buyer for longer, to protect the authenticity of the edition; tell us if you would like to discuss this.
• Accounts: until you ask us to close your account (subject to the order records above).
• Newsletter: until you unsubscribe, after which we keep only enough to make sure we don't email you again.
• Security records: IP addresses used to prevent abuse are deleted within 24 hours, and only a scrambled (hashed) form is kept alongside a print you are holding in your basket.

COOKIES AND SIMILAR TECHNOLOGIES

We only use cookies and browser storage that the website needs to work. We do not use advertising or tracking cookies, and we do not use third-party analytics.

• Sign-in cookie: keeps you signed in to your account.
• Basket hold cookie: lets us recognise that a print you have added to your basket is being held for you.
• Browser storage (stored on your device, not sent to us): your basket, your chosen currency and shipping country, an anonymous visitor ID used for our visitor count, and whether you have dismissed our cookie notice.

You can block or delete cookies in your browser settings, but parts of the website, such as the basket, checkout and your account, may then not work.

BOT PROTECTION

To keep our limited editions available to real collectors, adding a print to your basket and checking out are protected by Cloudflare Turnstile, which checks in the background that the site is being used by a person rather than an automated program. To do this, Cloudflare processes information such as your IP address and details about your browser and device. How Cloudflare uses this information is described in its Turnstile Privacy Addendum.

YOUR RIGHTS

Under UK data protection law you have the right to:

• ask for a copy of the personal information we hold about you;
• ask us to correct information that is wrong or incomplete;
• ask us to delete your information (we may need to keep some records, such as invoices, where the law requires it);
• ask us to restrict how we use your information, or object to how we use it;
• ask us to send your information to you or another organisation in a commonly used format;
• withdraw your consent to marketing at any time.

To use any of these rights, email privacy@slowlydownward.co.uk. We will reply within one month. There is normally no charge.

COMPLAINTS

If you are unhappy with how we have handled your information, please contact us first and we will do our best to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

CHILDREN

Our website is not intended for children under 16, and we do not knowingly collect their personal information.

CHANGES TO THIS POLICY

We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated at the top.