This policy explains how to exercise your rights over the personal information Art by Innovation holds about you, and what we do once you ask. It supplements our Privacy Policy, which describes what we collect and why.
Who this applies to
We handle every request we receive under this policy, wherever you live. Some of the rights below are guaranteed to you by law only in certain places — the GDPR if you are in the EU or UK, the CCPA as amended by the CPRA if you are a California resident — but we do not make you prove where you live before we help you.
What you can ask for
- Access — a copy of the personal information we hold about you, and an explanation of the categories, sources, and purposes.
- Correction — have inaccurate or incomplete information corrected.
- Deletion — have your personal information erased, subject to the limits below.
- Restriction or objection — ask us to stop or limit a particular use, including direct marketing, which we will always honour.
- Portability — receive your information in a structured, machine-readable format.
- Opt out of sale or sharing — we do not sell or share personal information, so there is nothing to opt out of; we confirm this in writing on request.
How to make a request
Email jeff@artbyinnovation.com with the subject line Data Subject Request. Tell us which right you are exercising and, if you hold an account, the email address on it. You may use an authorised agent; we will ask for written proof of their authority.
How we verify you
We have to be sure we are not disclosing your information to someone else. For account holders, we verify by confirming control of the registered email address. If a request is high-risk — deletion, or access to a large volume of data — we may ask for one additional matching detail. We will never ask you for a password, and we will not ask for a government ID for a routine request.
How long it takes
We acknowledge within 10 days and respond substantively within 30 days. If a request is complex we may extend once, by up to 60 days, and we will tell you why before the first 30 days are up. There is no charge, unless a request is manifestly unfounded or repetitive, in which case we will tell you the cost before doing the work.
When we may not be able to comply in full
We may need to keep some information despite a deletion request — for example, transaction and tax records we are legally required to retain, and records needed to establish or defend a legal claim or to prevent fraud. If we refuse any part of a request we will say which part, and why.
Note that deleting your account also ends access to any members-tier downloads. The license terms attached to files you have already downloaded continue to apply — see the Members Gallery Images license.
If you are unhappy with the outcome
Reply to our response and ask for it to be reconsidered; we will look again. You also have the right to complain to your data protection authority — your national supervisory authority in the EU, the Information Commissioner’s Office in the UK, or the California Privacy Protection Agency or Attorney General in California. We will not retaliate against you for exercising any right in this policy.