Privacy Policy

Last updated 10 October 2026

This policy explains what personal data OSMA handles, why, for how long, and the rights you have. It follows the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.

In short

Online ordering is not open yet, so today this site does not collect your name, address or payment details.
Your cart is kept in your own browser. We cannot see it.
No advertising or analytics cookies, no tracking pixels, no third-party scripts.
We never sell your data, and we never send you marketing without your consent.

Who is responsible for your data

The controller of your personal data is Skolt Art LLC, a Wyoming limited liability company, which operates OSMA. Our address is 30 N Gould St Ste R, Sheridan, WY 82801, United States.

For any question about your data, or to use your rights, email skoltartllc@outlook.com with "Data protection" in the subject line. We are established outside the UK, and you can contact us directly by email about any data protection matter.

What we process, why, and on what lawful basis

When you visit the site

What: technical logs kept by our hosting provider: your IP address, browser type, the page requested, the date and time, and any error.
Why: to deliver the pages, keep the site secure and fix problems. We do not use these logs to profile you.
Lawful basis: our legitimate interests in running a secure, working website.

Your cart

What: the products you add and their quantities, stored in your browser's local storage. No name, email, address or payment details.
Why: to remember your cart as you move from page to page.
Who sees it: nobody but you. While online ordering is closed, it is never sent to us. Once ordering opens, its contents reach us only when you go through checkout. Details are on our cookies page.

When you email us

What: your email address, your name if you give it, what you write and any photos you send.
Why: to answer you, and to handle cancellations, returns, complaints and data protection requests.
Lawful basis: our contract with you when your message is about an order; our legitimate interests in answering the people who write to us otherwise; and our legal obligations when you use your data protection or consumer rights.

When you place an order (once online ordering opens)

What: your name, delivery address, email address, a phone number if the carrier needs one for delivery updates, the items ordered, amounts paid, payment status and delivery tracking. Your full card details go to our payment provider, never to us.
Why: to take payment, prepare and deliver your order, send you order and delivery emails, and handle cancellations, returns, refunds and any problem with the goods.
Lawful basis: performance of our contract with you.

Accounting, fraud prevention and legal claims

What: order and payment records.
Why: to keep accounting and tax records, to prevent fraudulent payments, and to establish or defend legal claims.
Lawful basis: our legal obligations for accounting and tax records; our legitimate interests in preventing fraud and protecting our legal position.

Where we rely on legitimate interests, we have weighed them against your rights, and you can object at any time (see "Your rights" below).

Where your data comes from

Almost everything comes from you. Once ordering opens, our payment provider tells us whether a payment succeeded, and carriers tell us where a parcel is.

We share only what each one needs:

Our hosting provider, Vercel Inc., in the United States, which serves this website and keeps its technical logs.
Our payment provider, once online payment opens. We will name it here before it does.
Our partner warehouse, which prepares and dispatches orders: your name, delivery address and the items ordered.
Delivery carriers: your name and address, and your email address or phone number where the carrier uses them for delivery updates.
Our email provider, which stores the emails we send and receive.
Professional advisers such as accountants and lawyers, under a duty of confidentiality, and public authorities when the law requires it.
A buyer of our business, if it is ever sold, who would have to respect this policy.

Providers that act for us may use your data only on our instructions and must keep it secure.

Transfers outside the UK

We are established in the United States, and so are some of our providers, so your data is processed outside the UK, mainly in the United States. When we share it with a provider there, we rely on:

the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), where the provider is certified under it; or otherwise
the International Data Transfer Agreement issued by the Information Commissioner, or the UK Addendum to the EU Standard Contractual Clauses.

You can ask us for more information about these safeguards by email.

How long we keep it

Order, payment and accounting records: six years from the order, to meet tax and accounting rules and to deal with any claim.
Emails: as long as needed to deal with your request, then two years from our last exchange, or six years if they concern an order.
Technical logs: a short period set by our hosting provider, generally no longer than 30 days, unless we need them to investigate a security incident.
Your cart: in your browser, until you empty it or clear this site's data.

How we protect it

The site is served over an encrypted connection (HTTPS). Access to personal data is limited to the people who need it to serve you, and we choose providers that apply recognised security measures.

Your rights

Under UK data protection law, you have the right to:

be informed about how we use your data (this policy);
access your data and receive a copy;
have inaccurate data corrected;
have your data erased, where we no longer have a reason to keep it;
restrict how we use it in some cases;
receive data you gave us in a portable format;
object to our use of your data based on legitimate interests, and object at any time to direct marketing;
withdraw any consent you have given, at any time;
not be subject to a significant decision based solely on automated processing without safeguards.

To use any of these rights, email skoltartllc@outlook.com. There is normally no fee. We may ask you to confirm your identity before acting. We reply within one month; for complex or numerous requests we can extend this by two further months, and we will tell you if we do. When you ask for your data, we carry out a reasonable and proportionate search for it.

Complaints

If you are unhappy with how we have handled your data, please tell us first by email. We will acknowledge your complaint within 30 days, look into it without undue delay, and tell you the outcome.

You also have the right to complain to the UK data protection regulator, the Information Commissioner's Office (ICO), or its successor, the Information Commission:

online: ico.org.uk/make-a-complaint
by phone: 0303 123 1113
by post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Marketing, automated decisions and selling data

We do not send marketing emails unless you have agreed to receive them, and every one would let you stop them in one step.
We do not make decisions about you based solely on automated processing. Once online payment opens, our payment provider will screen payments automatically to prevent fraud; if a payment is declined and you think that is wrong, email us and a person will look at it.
We do not sell, rent or trade your personal data.

Children

Our shop is for adults aged 18 and over. We do not knowingly collect data from children. If you think a child has sent us personal data, email us and we will delete it.

Cookies

This site sets no advertising or analytics cookies. The only thing it stores on your device is your cart. See our cookies page.

Changes to this policy

We will update this policy when our practices change, and in particular before online ordering opens, to name our payment provider. Each version is dated. If a change matters to you as a customer, we will tell you by email.