Privacy Notice

Who is responsible for personal information

The final notice must name the legal operator of The Sole Gallery as data controller and provide its postal address, privacy email and any required Data Protection Officer or UK representative details. Those details have not yet been chosen and must not be invented.

Information the directory may collect

• Seller application details such as contact email, public display name and country.
• The seller’s established external-platform profile link and the result of a manual review.
• Approved profile wording and watermarked preview images.
• Reports, supporting evidence, appeals, enquiries and moderation decisions.
• Limited technical and security information needed to operate and protect the website.

Why information is used

Each use requires a documented lawful basis. Likely purposes include reviewing and publishing seller listings, enforcing feet-only rules, responding to reports, preventing misuse, maintaining website security and protecting legal claims.

Optional marketing should use a separate, freely given choice where consent is required. People must be able to withdraw that consent without losing ordinary directory access.

Who may receive information

Necessary information may be shared with carefully selected website-hosting, support, security and professional-advice providers. The final notice must name or clearly describe them after the service arrangements are confirmed.

An approved external selling platform handles its own accounts, payments and subscriptions under its own privacy notice. The Sole Gallery should not sell personal information. Information may be disclosed to authorities where legally required.

How long information is kept and protected

A final retention schedule must cover unsuccessful applications, active and removed listings, reports, safety evidence, legal claims and support enquiries. Information should not be kept indefinitely without a documented reason.

Protections should include access controls, secure hosting, appropriate encryption, supplier agreements, incident response and access limited to genuine need.

Your data-protection rights

Depending on the circumstances, people may ask for access, correction, deletion, restriction, portability or object to certain uses. They may withdraw consent where it is relied upon and complain to the UK Information Commissioner’s Office.

Some information may need to be retained despite a deletion request—for example for safety evidence or a legal claim. The directory must explain any refusal and the available complaint route.