Privacy Policy

Last updated 12 September 2026

This site is deliberately quiet. It sets no cookies on your browser, loads nothing from anybody else, and uses no analytics company. The personal information I hold is what you give me — when you buy a piece, when you write to me, or when you ask to hear about new work — and I hold it for those purposes and no others.

Who I am

Gary Nicholls Imaginarium Limited, a company registered in England and Wales, company number 10647328, registered office Bishops Court, Hatfield, Hertfordshire, AL9 5HZ, United Kingdom. The company is the data controller for this website.

Correspondence and returns: 42a Church Street, Old Hatfield, Hertfordshire, AL9 5AW.

For anything on this page, email gary@g-n-p.co.uk.

What I collect, and why

When you buy something

The checkout asks for your name, email address and delivery address, and optionally a phone number and any notes about the order. I use these to take the order, send you the work, and contact you about it — nothing else.

The lawful basis is performance of a contract: I cannot deliver a piece without knowing where to send it.

When you write to me

The enquiry form asks for your name and email address, and optionally a telephone number, so that I can reply. Your message and those details are stored on my own server and emailed to me. Nothing is passed to anyone else, and there is no automated follow-up.

The lawful basis is legitimate interests: you have asked me a question and would like an answer.

When you join the mailing list

If you ask to hear about new work and exhibitions, I keep your email address and the date you asked. Nothing else — no name, no history of what you looked at. It is used only to send occasional news, a few times a year, and it is never passed on, sold or used for advertising.

The lawful basis is consent, which you give by ticking the box or using the sign-up form, and can withdraw at any time. Every message includes how to stop, and emailing me works just as well.

Payment

I do not see, handle or store your card details. Payment is taken by SumUp on their own payment page. They are a separate data controller for that transaction and their privacy notice applies to it: sumup.com/en-gb/privacy. What comes back to me is confirmation that the payment succeeded and a transaction reference — never a card number.

When you just visit

My host keeps standard server logs, which include your IP address, the pages requested and the time. These are used to keep the site running and secure.

I also keep a simple count of which pages are looked at, so I know which work people are interested in. It records the page, the date, and the website you arrived from if there was one. It does not record your IP address. To tell one visitor from another without identifying anybody, your address is turned into a short code using a one-way calculation that includes the current date — so the code recognises you for the rest of the day and then stops working, and it cannot be turned back into an address. There is no cookie involved, nothing is stored on your device, and nothing is sent anywhere: the count lives on my own server and is read only by me.

There is still no analytics company, no advertising, no tracking pixels, and no profiling of any kind.

Cookies

This site sets no cookies on visitors’ browsers. There is no cookie banner because there is nothing to consent to.

One cookie exists on the site, named gnpadmin. It is set only when I log in to manage the artwork, applies only to the private admin area, and is never sent to visitors.

Other services

This site makes no third-party requests. The typefaces are served from this site rather than from Google, so no other company sees that you visited. The Instagram and Facebook links in the footer are ordinary links — nothing is embedded, so those companies learn nothing unless you click through.

Who I share your information with

I do not sell, rent or trade personal information, and I do not share it for marketing. It is passed on only where that is needed to complete your order:

• SumUp — to take the payment.
• Hostinger — my web host, who necessarily store the site and its data on their servers.
• The courier handling your delivery, who receives your name and address in order to deliver. Work is shipped to the UK and internationally.
• My accountant and HMRC, as part of ordinary business records.

How long I keep it

Order records are kept for six years after the end of the financial year in which the sale took place, which is the period UK company and tax law requires.

Enquiries that do not lead to a sale are deleted once the conversation has run its course. Mailing list addresses are kept until you ask to come off, and I remove anyone who has not opened anything for two years. The page-view count is kept for up to two years and contains nothing that identifies anybody.

How it is kept safe

The site runs over HTTPS. Order details are stored on the server in a folder that cannot be reached from the web, and the admin area is protected by a password, a session that expires, and a lockout after repeated failed logins. Card details never reach this server at all.

Your rights

Under UK data protection law you can ask me to:

• give you a copy of the information I hold about you;
• correct anything that is wrong;
• delete it, where I am not required to keep it for tax or legal reasons;
• take you off the mailing list, immediately and without explanation;
• restrict or object to how I use it;
• provide it in a portable form.

Email me and I will respond within one month. There is no charge.

If you are unhappy with how I have handled your information you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. I would rather you came to me first so I can put it right.

Children

This site is not aimed at children and I do not knowingly collect information from anyone under 16.

Changes

If this notice changes, the date at the top changes with it. Material changes affecting an existing order will be emailed to the people concerned.