MR PHANTOM

Mr Phantom Studios

Privacy Policy

Last updated: 1 October 2026

Who we are

This website, mrphantomstudios.com, is run by the Mr Phantom studio ("we", "us"). Sales, payment processing, delivery, framing and paperwork are handled by London Art Exchange (LAX). We are the data controller for personal data collected through this site. Contact: info@mrphantom.co.uk.

What we collect

Details you give us: name, email, phone number, city or country, budget, interests, questionnaire answers, selfies (The 10 Gates), offers and orders.

Collector access codes: if we give you a personal access code, your use of the private site is linked to your collector profile. This includes when you sign in, the pages you open, how long you stay on each, the paintings you view, the buttons you click and what you add to your basket.

Visitors using the general code or public pages: we record the same activity under a random device identifier stored in your browser. It is not linked to your name unless you later submit a form or sign in with a personal code.

Your profile, favourites and quick questions: if you fill in "My profile", we keep your town or city, birthday (day and month only), interests, gift ideas, contact preference, the paintings you save with the heart, and your answers to the short one-tap questions shown on the site.

We do not use third-party advertising trackers on this site. A session cookie remembers that you have entered an access code for up to 30 days.

How we use it

To respond to enquiries and orders; to manage waiting lists and private sales fairly; to understand which works and pages collectors are interested in so we can offer relevant works, invitations and benefits; to tailor our Privy Circle membership; to prevent fraud and misuse; and to analyse overall trends in how the site is used, including combined and statistical analysis to plan future collections, exhibitions and pricing strategy.

The studio uses an AI tool to write a short private summary of each collector's interests and suggested next steps for the team. It is only seen by studio staff, is checked by a person before anything is acted on, and you can ask us to stop it.

We may build a profile of your interests from your activity. We do not make decisions with legal or similarly significant effects about you based solely on automated processing.

Our legal basis (UK GDPR)

Contract: handling orders, offers and requests you make. Legitimate interests: running private sales, understanding collector interest, improving the site and analytics. Consent: marketing emails and texts, where required; you can withdraw at any time. Legal obligation: sales records and anti-money-laundering checks.

Who we share it with

London Art Exchange (for sales, payment, delivery and paperwork); our website hosting, database, email and text-message providers, who process data on our behalf; and professional advisers or authorities where the law requires. We do not sell your personal data. If the studio or its business is reorganised or sold, data may transfer to the new owner under this policy.

Some providers may process data outside the UK. Where they do, we rely on adequacy regulations or standard contractual safeguards.

How long we keep it

Enquiry and waiting-list details: until you ask us to remove them, or 3 years after our last contact. Sales records: 6 years, as required by law. Site activity: up to 3 years, after which it is deleted or made anonymous. Anonymous, combined statistics may be kept indefinitely.

Your rights

You can ask to see, correct or delete your data, object to profiling or analytics, restrict how we use it, or ask for a copy to take elsewhere. Email info@mrphantom.co.uk. If you are not happy with our answer you can complain to the Information Commissioner's Office (ico.org.uk).

If you do not want your activity linked to your name, ask us to switch off your personal code and we will give you the general one instead.

Security

Personal data is held in a secured database that only authorised studio staff can access with individual logins. Access codes are personal; please do not share yours, because activity using it is recorded against your profile.

Changes

We may update this policy. The date at the top shows the latest version.