Privacy Policy

Last updated: 2 August 2026

This Privacy Policy explains how The Race Canvas Co., operated by sole trader Rob Harris, collects, uses, stores and shares your personal information when you visit theracecanvasco.com, contact us or place an order.

The Race Canvas Co. is the data controller responsible for the personal information described in this policy.

Contact details

The Race Canvas Co.
Broadhurst Drive
Ashford
Kent
TN24 9RQ
Email: rob@theracecanvasco.com

UK data protection is governed by the UK GDPR and the Data Protection Act 2018. Privacy notices should explain what information is collected, why it is used, how long it is retained, who receives it and the rights available to individuals.

1. Information we collect

We may collect:

• Your name
• Email address
• Telephone number
• Billing and delivery addresses
• Order and transaction details
• The race photographs you upload
• AI-generated artwork previews and finished artwork
• Messages, enquiries and customer-service correspondence
• Information about your device, browser and use of our website
• Cookie and analytics information
• Records of artwork approval, requested amendments and delivery

We do not directly store your complete payment-card details. Payments are processed through third-party payment providers such as Stripe.

2. How we collect your information

We collect information when you:

• Place an order
• Upload a race photograph
• Generate an artwork preview
• Complete checkout
• Contact us by email or through the website
• Approve artwork or request changes
• Subscribe to marketing communications
• Browse or interact with the website

We may also receive limited information from service providers involved in processing payments, fulfilling orders, hosting the website or delivering canvases.

3. How we use your information

We use your personal information to:

• Process and manage your order
• Transform your uploaded photograph into artwork
• Generate an AI artwork preview
• Send proofs for approval
• Produce and deliver your canvas
• Take and reconcile payments
• Communicate about your order
• Handle questions, complaints, refunds or damaged products
• Prevent fraud, misuse and excessive preview generation
• Maintain accounting and tax records
• Improve the website, products and customer experience
• Send marketing communications where you have consented or where otherwise permitted by law
• Meet our legal and regulatory obligations

4. Our lawful bases

Depending on the circumstances, we process your information under the following lawful bases:

Contract: Processing is necessary to provide the product you ordered, generate your artwork, collect payment and arrange delivery.

Legitimate interests: We may process information to operate and improve the business, prevent fraud, protect our website, answer enquiries and maintain appropriate business records. We only rely on legitimate interests where those interests are not overridden by your rights.

Legal obligation: We may retain and use information where required for tax, accounting, consumer-protection or other legal purposes.

Consent: We rely on consent for optional marketing and certain non-essential cookies. You may withdraw consent at any time.

5. Uploaded photographs and AI artwork previews

When you upload a race photograph, it may contain identifiable people, race numbers, location details or other personal information.

You must only upload a photograph that you own or have permission to use. Where other identifiable people appear in the photograph, you are responsible for ensuring that you have an appropriate right or permission to provide it to us.

Your uploaded photograph may be sent securely to an artificial-intelligence service operated by OpenAI to create an artwork preview. OpenAI states that business and API data is not used to train its models by default.

The generated preview is an automated interpretation and may differ from the final manually reviewed artwork. We retain human oversight and may refine the image before it is approved for printing.

6. Payments

Payments may be processed by Stripe.

Stripe may receive information needed to process and protect the payment, including your name, billing details, payment information, device information and transaction details. Stripe explains that businesses using its services remain responsible for the customer information they process through Stripe, and Stripe maintains its own privacy and data-processing terms.

We do not receive or store your complete card number.

7. Who we share information with

We may share necessary information with:

• WooCommerce and WordPress service providers
• Our website host and technical-support providers
• Stripe and other payment processors
• OpenAI for generating artwork previews
• Canvas printing and fulfilment suppliers
• Royal Mail, couriers and delivery providers
• Email and customer-communication providers
• Analytics, security and fraud-prevention providers
• Accountants, insurers, professional advisers or legal representatives
• Government bodies, regulators or law-enforcement organisations where legally required

We only provide information that is reasonably required for the relevant service.

We do not sell your personal information.

8. International transfers

Some providers may process information outside the United Kingdom, including in the United States or other countries.

Where personal information is transferred internationally, we expect the relevant provider to use an appropriate lawful safeguard, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses or another legally recognised transfer mechanism.

OpenAI offers European data-residency options for eligible API services, while Stripe’s terms and privacy materials address international processing and transfer safeguards.

9. How long we keep information

We keep information only for as long as reasonably necessary for the purpose for which it was collected.

Our usual retention periods are:

• Order, payment and accounting records: up to seven years after the relevant financial year or transaction
• Customer correspondence: up to three years after the matter is resolved
• Uploaded original photographs: normally deleted within 90 days after the order is completed, unless needed to resolve an issue or you ask us to retain them
• Generated previews and finished artwork files: normally retained for up to 12 months after delivery to support replacements, complaints or reorders
• Abandoned preview uploads: normally deleted within 30 days
• Marketing records: until you unsubscribe or we determine that the information is no longer required
• Technical and security logs: for the period reasonably needed to maintain security and investigate misuse

We may keep information for longer where required by law, to deal with a dispute or to establish, exercise or defend legal claims.

10. Cookies

Our website may use:

• Essential cookies needed for baskets, checkout, security and payment processing
• Preference cookies
• Analytics cookies
• Marketing cookies, where used

Non-essential cookies should only be used in accordance with your choices through the cookie banner. The ICO advises businesses to clearly explain why personal information is processed, how long it is kept and who it is shared with.

More detailed information will be provided in our separate Cookie Policy.

11. Marketing

We may send marketing emails where:

• You have actively consented; or
• We are otherwise legally permitted to contact an existing customer about similar products

You can unsubscribe at any time by using the unsubscribe link in an email or contacting rob@theracecanvasco.com.

Unsubscribing from marketing will not stop essential emails concerning an existing order.

12. Security

We use reasonable technical and organisational measures intended to protect your information, including:

• Secure website connections
• Access controls
• Server-side handling of API credentials
• Limited staff and supplier access
• Watermarked, reduced-resolution previews
• Security and abuse-prevention measures
• Reputable payment and hosting providers

No internet-based service is completely secure, but we review our safeguards and limit the information collected where reasonably possible.

13. Your rights

Under UK data-protection law, you may have the right to:

• Be informed about how your information is used
• Request access to your personal information
• Ask us to correct inaccurate or incomplete information
• Ask us to delete information in certain circumstances
• Ask us to restrict processing
• Object to certain processing
• Request transfer of information in a portable format
• Withdraw consent where processing relies on consent
• Raise concerns about automated decision-making

Some rights are subject to legal exceptions. We may need to verify your identity before acting on a request.

To exercise your rights, email rob@theracecanvasco.com.

14. Complaints

Please contact us first so we can try to resolve your concern.

You also have the right to complain to the Information Commissioner’s Office, the UK regulator responsible for data protection.

15. Children

Our products and website are not directed at children, and customers must be at least 18 years old to place an order.

A photograph may contain a child, but it should only be uploaded by a parent, guardian or another person who has appropriate permission to provide it.

16. Third-party links

Our website may contain links to third-party websites. We are not responsible for their privacy practices, and you should review their privacy information separately.

17. Changes to this policy

We may update this Privacy Policy when our services, suppliers or legal obligations change.

The latest version will always appear on this page with the revised date.