Privacy policy
Last updated: 5 September 2026
Privacy Policy
GalleryThane is a trading name of LucasAbstract, a sole trader established in the United Kingdom. LucasAbstract is the data controller responsible for the personal information described in this Privacy Policy.
This Privacy Policy explains how we collect, use, disclose and protect personal information when you visit gallerythane.com, purchase or attempt to purchase from us, create or use a customer account, contact us, subscribe to marketing, or otherwise interact with GalleryThane (together, the “Services”).
Our online store is powered by Shopify. Shopify provides the ecommerce platform and associated services that enable us to operate GalleryThane. Shopify processes personal information on our behalf for many core ecommerce functions and may also act as a separate controller for certain Shopify services, as explained below.
1. Who We Are and How to Contact Us
The data controller is:
LucasAbstract, trading as GalleryThane
Sole trader
15 Campion Way
Bingham, Nottinghamshire
NG13 8TR
United Kingdom
Email: jameslucasart@gmail.com
If you have a question about this Privacy Policy, wish to exercise a privacy right, or wish to make a data protection complaint, please contact us using the details above.
2. Personal Information We Collect
The personal information we collect depends on how you interact with GalleryThane. It may include:
- Identity and contact information, including your name, billing address, delivery address, email address and telephone number.
- Order and transaction information, including products purchased, order value, discounts, delivery details, returns, refunds and transaction history.
- Payment information. Payments are processed through Shopify and the payment providers made available at checkout. We generally do not receive or store your complete payment-card number.
- Account information, where you create or use a customer account.
- Customer-service information, including messages, enquiries, complaints and other communications you send to us.
- Marketing information, including whether you have asked to receive marketing communications and your communication preferences.
- Device and technical information, such as IP address, browser type, device type, operating system, network information and identifiers associated with cookies or similar technologies.
- Website activity, including pages viewed, products viewed, referring pages, search activity, cart activity, checkout activity and interactions with the Services, where permitted by applicable law and your privacy choices.
- Fraud, security and risk information used to protect customers, transactions and the Services.
- Information received from third parties, such as Shopify, payment providers, delivery providers, analytics providers, advertising platforms and other service providers where permitted by law.
3. How We Use Personal Information and Our Lawful Bases
Where UK data protection law requires us to identify a lawful basis, we rely on the following bases depending on the purpose of the processing.
Providing and fulfilling your order
We use personal information to process payments, confirm orders, manufacture or prepare products, arrange delivery, provide order updates, deal with returns and refunds, and provide related customer service.
Lawful basis: performance of a contract with you, or taking steps at your request before entering into a contract.
Customer accounts and customer service
We use personal information to administer customer accounts, respond to enquiries, resolve problems and provide support.
Lawful basis: performance of our contract with you where the processing relates to an order or account, and our legitimate interests in operating our business and providing effective customer service where appropriate.
Legal, accounting and regulatory requirements
We may process and retain information where necessary to comply with tax, accounting, consumer protection, customs, court, regulatory or other legal requirements.
Lawful basis: compliance with a legal obligation.
Security and fraud prevention
We use information where necessary to secure the Services, verify transactions, detect or prevent fraud, misuse and other harmful activity, protect customers and enforce our legal rights.
Lawful basis: our legitimate interests in protecting GalleryThane, our customers and our Services, and compliance with legal obligations where applicable.
Operating and improving GalleryThane
We may use information to maintain the website, understand how the Services are performing, diagnose technical issues and improve the customer experience.
Lawful basis: our legitimate interests in operating and improving our business for processing that does not require consent. Where non-essential analytics cookies or similar technologies are used, we rely on your consent where required.
Marketing communications
If you choose to receive marketing from GalleryThane, we may use your contact details to send information about products, collections, offers or other GalleryThane news. You can unsubscribe at any time using the unsubscribe facility in a marketing message or by contacting us.
Lawful basis: consent where consent is required. Where applicable law permits limited marketing to existing customers without prior consent, we may rely on our legitimate interests, subject to your right to opt out at any time.
Personalisation, advertising and non-essential tracking
Where you have given permission, we and our partners may use cookies or similar technologies to personalise content, measure advertising, understand campaign performance or show advertising that may be more relevant to you.
Lawful basis: consent where required by applicable law. You can refuse or withdraw consent through our cookie and privacy preference controls.
Business administration and legal claims
We may use information for internal administration, record keeping, business planning, establishing or defending legal claims, and protecting our legal and commercial interests.
Lawful basis: our legitimate interests in properly managing and protecting our business, except where those interests are overridden by your rights and freedoms.
4. Our Legitimate Interests
Where we rely on legitimate interests, those interests may include:
- operating and administering GalleryThane;
- providing effective customer service;
- protecting the security and integrity of our website, systems and transactions;
- detecting and preventing fraud and misuse;
- improving our products, website and customer experience;
- maintaining appropriate business and transaction records;
- protecting, exercising or defending our legal rights; and
- communicating with existing customers where the law permits us to do so.
When relying on legitimate interests, we consider whether the processing is necessary and balance our interests against the interests, rights and freedoms of the people whose information is involved.
5. Cookies and Similar Technologies
GalleryThane uses cookies and similar technologies. Some are necessary for the website and checkout to function. Others are used only where permitted by applicable law and your privacy choices.
Our cookie controls group technologies into the following categories:
- Required – necessary for functions such as security, customer accounts, shopping carts and checkout.
- Personalisation – used to remember information or actions so that your experience can be personalised.
- Marketing – used by us and our partners to measure marketing and, where permitted, to provide or optimise advertising.
- Analytics – used to help us understand how visitors interact with the website and identify areas for improvement.
Where our cookie banner is displayed, non-essential Personalisation, Marketing and Analytics technologies are not used for those purposes unless you give the relevant permission.
You can accept, decline or manage non-essential cookies using the Cookie and privacy preferences controls available on our website. You can change or withdraw your choices later using those controls.
Blocking cookies through your browser may also affect certain website functions.
6. Shopify and Shopify Network Intelligence
GalleryThane is hosted by Shopify. Shopify processes personal information to provide ecommerce services including website hosting, checkout, payments-related functionality, security, fraud prevention, customer accounts and other platform services.
We have enabled Shopify Network Intelligence. This allows Shopify to securely use information from customer interactions with GalleryThane together with information from interactions with Shopify and other Shopify merchants to provide certain enhanced services. These may include advanced analytics, fraud and security services, product and store personalisation and advertising-related services.
For certain Enhanced Services, Shopify may act as a separate data controller or business under applicable privacy laws.
Where consent is required for advertising, personalisation, analytics or other non-essential technologies, Shopify respects choices made through our Shopify-integrated cookie and privacy controls.
You can learn more about Shopify's handling of customer information in the Shopify Consumer Privacy Policy.
You can also use the Shopify Privacy Portal to exercise certain rights directly with Shopify, including requesting access or deletion of information held by Shopify or limiting Shopify's use of personal information for advertising purposes.
7. Service Providers and Other Recipients
We disclose personal information only where reasonably necessary for the purposes described in this Privacy Policy, where you ask us to do so, or where required by law.
Recipients may include:
- Shopify and companies within the Shopify group;
- payment processors and financial-service providers;
- delivery, postal and fulfilment providers;
- IT, website hosting, security and fraud-prevention providers;
- customer-service and communications providers;
- analytics and measurement providers;
- marketing and advertising partners where you have given the required permissions, which may include Google, Meta, Microsoft, Pinterest, TikTok and Snapchat;
- review and ecommerce-support providers, where relevant;
- professional advisers including accountants, insurers, legal advisers and other professional service providers;
- government bodies, regulators, courts, law-enforcement agencies or other parties where disclosure is required or permitted by law; and
- a purchaser, successor or other relevant party if all or part of the business is sold, transferred or reorganised.
Third-party services have their own privacy practices and may process personal information as independent controllers. We encourage you to review their privacy notices where appropriate.
8. International Transfers
Some of our service providers, including Shopify and providers supporting payments, analytics, advertising, communications and technology, operate internationally. As a result, personal information may be transferred to, stored in or processed in countries outside the United Kingdom.
Where UK data protection law requires safeguards for an international transfer, we or our service providers use an appropriate transfer mechanism. Depending on the circumstances, this may include UK adequacy regulations, approved contractual protections such as the UK International Data Transfer Agreement or the UK Addendum to approved Standard Contractual Clauses, or another lawful transfer mechanism.
Further information about Shopify's international data processing is available in Shopify's privacy documentation and Data Processing Addendum.
9. European Economic Area
GalleryThane is a United Kingdom business and does not currently offer goods for delivery to countries in the European Economic Area (“EEA”). EEA countries are not enabled as active sales or delivery destinations in our online store, and we do not direct advertising campaigns specifically at EEA customers.
The GalleryThane website may nevertheless be technically accessible from the EEA. Accessibility of the website does not mean that GalleryThane offers delivery or checkout to an EEA destination.
For visitors accessing the website from the EEA, our cookie and privacy preference controls are configured so that non-essential Personalisation, Marketing and Analytics technologies require the relevant permission before being used for those purposes.
10. Data Retention
We retain personal information only for as long as reasonably necessary for the purposes for which it was collected and to satisfy legal, accounting, tax, fraud-prevention, dispute-resolution and regulatory requirements.
The appropriate retention period depends on factors including the type of information, why it was collected, whether you have an ongoing account or relationship with us, applicable limitation periods, and any legal or regulatory retention requirement.
When information is no longer required, we take reasonable steps to delete it, anonymise it or ensure it is no longer used except where continued retention is permitted or required by law.
11. Security
We use reasonable technical and organisational safeguards intended to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.
Our store is hosted on Shopify, which provides security measures for the Shopify platform and processes payment information in accordance with applicable payment-security standards.
No method of transmission or storage is completely secure. You should therefore take appropriate steps to protect your own passwords, devices and account information.
12. Your Privacy Rights
Depending on the law that applies to you and the circumstances of our processing, you may have rights including:
- the right to request access to personal information we hold about you;
- the right to request correction of inaccurate or incomplete information;
- the right to request deletion of personal information in certain circumstances;
- the right to request restriction of processing in certain circumstances;
- the right to receive certain information in a portable format;
- the right to object to processing based on legitimate interests;
- the right to object to direct marketing at any time; and
- where processing is based on consent, the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.
These rights are not absolute and may be subject to exemptions or limitations under applicable law.
To exercise a right, contact us at jameslucasart@gmail.com. We may need to verify your identity before completing a request.
13. United States Privacy Rights and Data Sharing Opt-Out
Residents of certain US states may have additional rights under state privacy laws. Depending on your state and the applicable law, these may include rights to access, correct or delete personal information, receive a copy of certain information, and opt out of certain uses of personal information for targeted advertising, sale or sharing.
Where required, GalleryThane provides a Data sharing opt-out facility through the privacy link in our website footer.
Where supported and required by applicable law, Shopify may also recognise a valid Global Privacy Control (GPC) signal as an opt-out request.
Because Shopify Network Intelligence is enabled, certain Shopify advertising-related Enhanced Services may constitute “sharing”, “sale” or “targeted advertising” under the laws of some US states. Applicable customers can exercise the available opt-out choices through our data-sharing opt-out page or through Shopify's privacy controls.
14. Marketing Choices
You may unsubscribe from GalleryThane marketing emails at any time by using the unsubscribe link included in the message or by contacting us.
Unsubscribing from marketing does not prevent us from sending non-marketing communications that are necessary to administer an order, account, transaction, legal notice or customer-service matter.
15. Children's Privacy
The Services are intended for a general adult audience and are not directed at children. We do not knowingly use children's personal information for targeted advertising.
If you believe a child has provided us with personal information in circumstances where it should not have been collected, please contact us.
16. External Links
The Services may contain links to websites or services operated by third parties. We are not responsible for the privacy, security or content of external websites. Please review the privacy information provided by those third parties before providing personal information to them.
17. Data Protection Complaints
If you have a concern about how GalleryThane has handled your personal information, please contact us first so that we can investigate and respond.
Email: jameslucasart@gmail.com
You also have the right to complain to the UK supervisory authority:
Information Commissioner's Office (ICO)
Website: https://ico.org.uk/make-a-complaint/
Telephone: 0303 123 1113
18. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to our Services, technology, service providers, business practices or legal requirements.
When we update the policy, we will revise the “Last updated” date at the top of this page. Where required by law, we will provide additional notice of a material change.
19. Contact
For questions about privacy, requests to exercise your rights, or data protection complaints, contact:
LucasAbstract, trading as GalleryThane
15 Campion Way
Bingham, Nottinghamshire
NG13 8TR
United Kingdom
Email: jameslucasart@gmail.com