Privacy & Cookies
Last updated: 24 July 2026
Who I am
This website, nathalyellencelia.art, is operated by Nathaly Ellen Bartsch, professionally known as Nathaly Ellen Celia.
For the purposes of UK data-protection law, Nathaly Ellen Bartsch is the data controller responsible for the personal information collected through this website.
Privacy enquiries and requests may be sent to:
About this policy
This Privacy and Cookies Policy explains what personal information may be collected when you visit this website, submit an enquiry or acquire an artwork. It also explains why the information is used, how it is protected, who it may be shared with and the rights available to you under data-protection law.
This website does not currently use personal information submitted through the Enquire form to send newsletters or marketing emails.
Information I collect
Personal information may be collected when you browse this website, submit an enquiry or purchase an original artwork.
Information submitted through the Enquire form
This may include your:
• name;
• email address;
• telephone number, if provided;
• selected enquiry type;
• artwork title; and
• any information included in your enquiry message.
Information connected with a purchase
When you purchase an artwork, information may include your:
• name and contact details;
• billing and delivery address;
• order details;
• payment status; and
• correspondence relating to the purchase, delivery, return or refund.
Payments are processed securely by Stripe. I do not receive or store your complete payment-card details. Stripe may collect transactional, device and identifying information to process payments, authenticate transactions and help prevent fraud.
Information collected automatically
When you visit the website, Squarespace and its associated technologies may automatically collect technical and usage information, including:
• your IP address;
• browser and device information;
• operating system;
• pages viewed and actions taken on the website;
• referring website or traffic source;
• approximate geographical location; and
• information collected through cookies and similar technologies.
Squarespace uses analytics and performance cookies to provide website statistics such as visitor numbers, traffic sources and how visitors interact with the website. The use of non-essential cookies is addressed further in the Cookies section of this policy.
How and why I use your information
I use personal information only when there is a lawful reason to do so.
Responding to enquiries
I use the information supplied through the Enquire form to:
• respond to your message;
• provide information about an artwork, its availability or price;
• discuss gallery, exhibition, interior-design or professional opportunities;
• prepare delivery information or quotations; and
• take steps requested by you before a possible purchase or other agreement.
The lawful basis is taking steps at your request before entering into a contract. Where an enquiry is not connected with a possible contract, I rely on my legitimate interests in responding to genuine enquiries and managing my art practice.
Processing and fulfilling purchases
I use customer and order information to:
• process and confirm a purchase;
• verify payment status;
• package and dispatch the artwork;
• communicate about delivery; and
• administer cancellations, returns, refunds or problems with an order.
The lawful basis is that this processing is necessary to perform the contract between you and me.
Maintaining financial and transaction records
I may retain invoices, payment records and information about completed transactions where necessary to comply with tax, accounting and other legal obligations.
The lawful basis is compliance with a legal obligation.
Operating and protecting the website
I may use technical information to operate the website, maintain its security, prevent misuse or fraud, diagnose technical problems and protect my legal and business interests.
The lawful basis is my legitimate interest in operating a secure and reliable website, provided that this does not override your rights and interests.
Website analytics
I use Squarespace Analytics to understand matters such as visitor numbers, traffic sources, approximate locations, devices used and how visitors navigate the website. This helps me assess and improve the website.
Non-essential analytics cookies will be used only in accordance with the choices you make through the website’s cookie controls.
Marketing
I do not currently use information submitted through the Enquire form to send newsletters or promotional marketing emails. If this changes in the future, this policy will be updated and any consent required by law will be obtained first.
Who I share personal information with
I share personal information only where it is reasonably necessary to operate the website, respond to enquiries, fulfil purchases, deliver artworks, protect the website or comply with legal obligations.
Squarespace
This website is hosted and operated using Squarespace. Squarespace may process visitor, enquiry, order, device and website-usage information to provide website hosting, forms, commerce features, security and analytics.
Stripe
Stripe processes payments made through the website. Stripe may receive personal, transactional and device information to process and authenticate payments, prevent fraud, administer disputes and issue refunds. I do not receive or store complete payment-card details.
Delivery and postal providers
Where an artwork is purchased, I may share the recipient’s name, delivery address, contact details and relevant order information with postal, courier or specialist art-delivery providers so that the artwork can be delivered and tracked.
Professional advisers and service providers
Personal information may be shared where necessary with trusted professional advisers or service providers, such as accountants, insurers, legal advisers or technical-support providers. They receive only the information reasonably required for the relevant purpose.
Public authorities and legal bodies
Personal information may be disclosed to HM Revenue & Customs, regulators, courts, law-enforcement bodies or other public authorities where disclosure is required by law, necessary to establish or defend legal rights, or needed to prevent fraud or unlawful activity.
At your request
I may share information with another person or organisation where you have specifically asked or authorised me to do so.
I do not sell or rent personal information to third parties.
International transfers
Some of the service providers used by this website, including Squarespace and Stripe, operate internationally. Personal information may therefore be transferred to, stored in or accessed from countries outside the United Kingdom, including the United States.
Where UK data-protection law treats this as a restricted international transfer, the relevant service provider is required to use a lawful transfer mechanism. Depending on the circumstances, this may include:
• UK adequacy regulations;
• the UK International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses;
• the UK International Data Transfer Agreement;
• the UK Extension to the EU–US Data Privacy Framework, where applicable; or
• another safeguard permitted by UK data-protection law.
Squarespace states that it uses the UK International Data Transfer Addendum and Standard Contractual Clauses for transfers to countries including the United States. Stripe also describes using recognised international-transfer safeguards within its contractual and privacy arrangements.
Further information about the safeguards applied to your personal information may be requested by emailing NECarts@outlook.com.
How long I keep personal information
I keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including satisfying legal, accounting and reporting requirements and dealing with complaints or legal claims.
Enquiries that do not result in a purchase
Enquiry forms, related emails and correspondence will normally be retained for up to 24 months after the last meaningful contact. They may be deleted sooner where they are no longer needed.
Information may be kept for longer where an enquiry develops into an ongoing professional relationship, exhibition opportunity, commission, purchase, complaint or dispute.
Purchases and financial records
Order information, invoices, payment records and related correspondence will be retained for the period required by applicable tax, accounting and legal obligations.
As a self-employed individual, I will generally keep relevant financial records for at least five years after the 31 January Self Assessment submission deadline for the relevant tax year. Some information may be retained for longer where reasonably necessary to deal with a complaint, payment dispute, refund, insurance matter or legal claim.
I do not receive or retain complete payment-card details. Stripe retains payment information in accordance with its own legal obligations, contractual arrangements and privacy policy.
Website analytics and technical information
Technical, security and website-usage information is retained for the period made available through Squarespace or for as long as reasonably necessary to operate, analyse and protect the website.
Where no fixed retention period applies, I consider the nature of the information, why it was collected, whether it remains necessary and any legal, security or business requirements. Information that is no longer required will be deleted or anonymised where reasonably practicable.
Requests relating to your data
Records of privacy requests, objections, consent choices or complaints may be retained where necessary to demonstrate compliance with data-protection law and to respond appropriately to future correspondence.
How I protect personal information
I take reasonable and proportionate technical and organisational measures to protect personal information against unauthorised access, alteration, disclosure, accidental loss, misuse or destruction.
These measures include:
• using established website-hosting and payment-processing providers;
• protecting website, payment and email accounts with access controls and available security features;
• limiting access to personal information to those who genuinely require it;
• keeping devices, software and account-security settings under review;
• sharing only the information necessary for a particular service or purpose; and
• securely deleting or anonymising information when it is no longer required, where reasonably practicable.
Information submitted through this website is processed using systems provided by Squarespace and, for payments, Stripe. Each provider is responsible for maintaining the security of the services it operates.
Although reasonable precautions are taken, no method of transmitting or storing information electronically can be guaranteed to be completely secure. Visitors should therefore avoid including unnecessary sensitive personal information in an enquiry.
If I become aware of a personal-data breach, I will assess the circumstances and take appropriate action. This may include securing the affected information and notifying the individuals concerned or the Information Commissioner’s Office where required by law.
If you believe that personal information supplied through this website has been accessed, used or disclosed improperly, please contact NECarts@outlook.com.
Cookies
Cookies are small text files and similar technologies that may be stored on your computer, tablet or mobile device when you visit a website. They help websites function, remember choices, process transactions and provide information about how the website is used.
Essential cookies
Essential cookies are required for the secure and effective operation of this website. They may support functions such as:
• website security and fraud prevention;
• navigation and page functionality;
• shopping baskets and checkout;
• payment processing;
• remembering cookie choices; and
• maintaining website and account sessions.
These cookies cannot normally be disabled through the website’s cookie controls because the website may not function properly without them.
Analytics and performance cookies
Squarespace may use analytics and performance cookies to help measure visitor numbers, visits, page views, traffic sources, approximate locations, devices used and interactions with the website.
These cookies help me understand how the website performs and how it may be improved. Non-essential analytics and performance cookies will be restricted until they are accepted through the website’s cookie controls.
Payment and commerce cookies
Squarespace and Stripe may use cookies or similar technologies when a visitor browses the online shop, adds an artwork to a basket, proceeds through checkout or completes a payment. These technologies may be used to maintain the checkout session, authenticate transactions, prevent fraud and confirm payment status.
Embedded and third-party content
Pages on this website may contain embedded videos, social-media features or other content supplied by third parties. Those providers may place cookies or use similar technologies when the content is displayed or used.
Where supported by Squarespace, non-essential third-party technologies will be restricted in accordance with the visitor’s cookie choices. Some third-party services may operate their own privacy and cookie controls.
Managing your cookie choices
When you first visit the website, the cookie banner allows you to:
• accept all cookies;
• decline non-essential cookies; or
• manage your cookie preferences.
You may change your choices using the cookie-preferences control displayed on the website. You can also delete or block cookies through your browser settings. Blocking certain cookies may affect the way some parts of the website function.
Consent may be withdrawn at any time by changing your cookie preferences. Withdrawing consent does not affect the lawfulness of processing that took place before consent was withdrawn.
Changes to the cookies used
The cookies and technologies used by this website may change when website features, payment services or third-party integrations are added, removed or updated. This policy will be reviewed and updated where necessary.
Your data-protection rights
Under data-protection law, you may have the following rights in relation to your personal information:
The right to be informed
You have the right to receive clear information about how your personal information is collected and used. This policy is intended to provide that information.
The right of access
You may ask whether I hold personal information about you and request a copy of that information.
The right to rectification
You may ask me to correct personal information that is inaccurate or complete information that is incomplete.
The right to erasure
You may ask me to delete your personal information in certain circumstances. This right does not always apply, including where information must be retained to meet a legal obligation or establish, exercise or defend a legal claim.
The right to restrict processing
You may ask me to limit the way your personal information is used in certain circumstances, including while its accuracy or lawful use is being considered.
The right to data portability
In certain circumstances, you may ask to receive personal information that you supplied in a structured, commonly used and machine-readable format, or ask for it to be transferred to another organisation. This generally applies where processing is automated and based on consent or a contract.
The right to object
You may object to certain uses of your personal information, including processing based on legitimate interests. I will consider the circumstances and stop the processing unless there are compelling lawful grounds for continuing.
The right to withdraw consent
Where processing relies on your consent, including consent to non-essential cookies, you may withdraw that consent at any time. This will not affect processing that lawfully took place before consent was withdrawn.
These rights are subject to conditions and exceptions under data-protection law.
To exercise a right, email NECarts@outlook.com and explain your request. No particular wording is required, but sufficient information should be provided to identify you and the information concerned.
I may request reasonable evidence of identity where necessary to protect personal information from unauthorised disclosure.
I will respond without undue delay and normally within one calendar month after receiving the request and any information reasonably required to confirm identity. Where the law permits additional time because a request is complex, I will explain the reason for the extension.
A fee will not normally be charged. However, data-protection law may permit a reasonable fee or refusal where a request is manifestly unfounded or excessive.
Data-protection complaints
If you are concerned about how I have collected, used, stored, shared or protected your personal information, you may raise a data-protection complaint by emailing:
Please state that your message is a data-protection complaint and provide:
• your name and preferred contact details;
• a clear description of your concern;
• any relevant dates, communications or order details; and
• the outcome you would like me to consider.
You do not need to use legal terminology or follow a particular form of words.
I will:
• acknowledge receipt of your complaint within 30 days;
• take appropriate steps to investigate it fairly and accurately;
• request further information where reasonably necessary;
• keep you appropriately informed about its progress; and
• communicate the outcome without undue delay, including any action taken where appropriate.
A record of the complaint, investigation, response and any resulting action may be retained where necessary to demonstrate compliance with data-protection law.
I welcome the opportunity to investigate and resolve concerns directly. However, you also have the right to complain to the Information Commissioner’s Office at any time. The Information Commissioner’s Office recommends allowing an organisation an opportunity to complete its complaints process first where appropriate, but this is not compulsory.
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow Cheshire SK9 5AF
Telephone: 0303 123 1113
Complaints may also be submitted using the Information Commissioner’s Office online complaint service.
Children’s information
This website is intended for a general audience and is not designed to offer services directly to children.
I do not knowingly request or collect personal information from children. A person under the age of 18 should not submit an enquiry, create an order or purchase an artwork without the involvement and permission of a parent or legal guardian.
If a parent or legal guardian believes that a child has submitted personal information through this website without appropriate involvement or permission, they should contact NECarts@outlook.com.
Where I become aware that personal information belonging to a child has been collected inappropriately, I will take reasonable steps to delete it unless there is a lawful reason why it must be retained.
Where children’s personal information is processed, their best interests, circumstances and data-protection rights will be given appropriate consideration.
Links and third-party websites
This website may contain links to external websites and services, including social-media platforms, video platforms, payment services and other third-party resources.
When you follow an external link, you leave this website. The external provider may collect and use personal information in accordance with its own privacy policy, cookie policy and terms.
I am not responsible for the privacy practices, security, availability or content of websites operated independently by third parties. You should review the privacy information provided by the relevant organisation before supplying personal information or changing its cookie settings.
This section applies to links that take you to another website. Where third-party content is embedded directly within a page of this website, the relevant use of cookies and similar technologies is addressed in the Cookies section of this policy.
Changes to this policy
I may update this Privacy and Cookies Policy from time to time to reflect changes in data-protection law, website features, service providers, payment arrangements or the way personal information is collected and used.
When this policy is revised, the “Last updated” date at the top of the page will be changed and the updated version will be published on this website.
Where a change materially affects how personal information is used, I will take reasonable steps to draw attention to it and provide any additional information or choices required by law.
Visitors are encouraged to review this policy periodically.
Contact information
Questions about this policy, requests concerning your personal information and data-protection complaints should be directed to:
Data controller: Nathaly Ellen Bartsch
Professional name: Nathaly Ellen Celia
Website: nathalyellencelia.art
Email: NECarts@outlook.com
When contacting me, please provide enough information for me to understand and respond to your request. Please do not send complete payment-card details or unnecessary sensitive personal information by email.