1. Who is responsible
Jon-Andrew Martin, an individual operating as a sole proprietor at 602 Lampton Ln, McAlester, OK 74501, USA (“we,” “us,” or “our”), is the data controller responsible for personal data processed through https://jon-andrew.com and related services. Contact details appear at the end of this policy.
2. Information we collect
We collect and process the following categories of information:
- Contact and correspondence information you choose to provide, such as your name, email address, phone number, and project brief.
- Photography launch notifications, including your email address, the date of your signup, and your recorded consent if you ask to receive one email announcing the fine-art print and gallery launch.
- Transaction data, including the products purchased, amounts, currency, order and payment references, payment status, billing address, and delivery email address.
- Fraud-defense and audit data, including your IP address, User-Agent header, timestamps, download token identifiers, and byte-transfer counts, which we log to prevent fraud and to defend against payment disputes and chargebacks.
- Minimal operational logs, such as request identifiers, timestamps, routes, and response statuses, for reliability and security.
Please do not submit passwords, full payment-card numbers, government identification, sensitive health information, or unrelated personal records. Payment-card details are collected by Stripe, not by us, as described below.
3. Stripe payment processing
Payments are processed by Stripe, Inc. on a hosted payment page. When you pay, you enter your payment-card details directly with Stripe; we do not receive or store your full card number or security code. We receive from Stripe the transaction reference, payment status, customer contact and billing details, and the amount and currency needed to fulfill your order and maintain our records.
Stripe acts as a separate data controller for the payment information it processes, and its processing is governed by Stripe's own privacy policy and terms. Stripe may process payment data in the United States and other locations where it operates, using the safeguards described in its documentation.
4. IP address logging for fraud defense
We log the IP address and User-Agent associated with payment and download activity. We process this information for a legitimate interest in preventing fraud, preventing misuse of download tokens, and defending against chargebacks and payment disputes, including compiling evidence for submission to payment networks where a transaction is disputed.
Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms, and we limit the collection and retention of this data to what is necessary for those purposes. You may object to this processing as described in the “Your rights” section below.
5. Purposes and legal bases
We process personal data for the following purposes and on the following legal bases:
- To perform a contract with you, including processing your order, delivering purchased files, and providing support (contract);
- To comply with legal obligations, including tax, accounting, and record-keeping obligations (legal obligation);
- To prevent fraud and defend against payment disputes (legitimate interest);
- Where you have given consent, for any specific purpose for which we request it (consent), which you may withdraw at any time, including a single photography-gallery launch notice if you separately opt in;
6. Service providers and disclosures
We share personal data with service providers that perform functions on our behalf, including payment processing (Stripe), hosting, email delivery, and file delivery. We also disclose data to professional advisers, to payment networks for dispute resolution, and where required by law or to protect legal rights.
We do not sell personal data, and we do not share personal data for targeted advertising. Providers may process data in the United States or elsewhere, subject to appropriate safeguards as required by applicable law.
7. Data retention
We retain personal data only for as long as necessary for the purposes described, and in accordance with these specific windows:
- Tax and accounting records: seven (7) years, to comply with applicable tax record-keeping obligations.
- Security and fraud-defense audit logs: eighteen (18) months, to defend against payment disputes and investigate security incidents.
- Photography launch notifications: until you withdraw consent or the launch notice is sent, after which the signup record is deleted within thirty (30) days; if no launch notice is sent, the record is deleted after eighteen (18) months.
- Correspondence and project records: for the duration of the relevant inquiry or engagement and a reasonable period thereafter, unless a longer period is required by law.
After the applicable period, we delete or anonymize the data, subject to any legal hold or obligation that requires longer retention. We do not promise immediate deletion from provider backups, which may be retained for a limited time in accordance with the provider's own policies.
8. Your rights
Depending on your location and applicable law, you may have the right to:
- Access the personal data we hold about you (GDPR, CCPA);
- Request correction of inaccurate personal data (GDPR, CCPA);
- Request deletion of your personal data (GDPR, CCPA);
- Restrict or object to processing (GDPR);
- Data portability, including a copy in a portable format (GDPR);
- Withdraw consent where processing is based on consent (GDPR);
- Lodge a complaint with a supervisory authority (GDPR).
CCPA rights: California residents have the right to know the categories and specific pieces of personal data collected, the right to request deletion, the right to correct inaccurate data, and the right to opt out of the sale or sharing of personal data. We do not sell or share personal data as those terms are defined under the CCPA, so there is no opt-out to exercise in that regard, but you may still exercise your other CCPA rights.
Non-discrimination: We will not discriminate against you for exercising any privacy right.
To withdraw consent for a photography launch notice, email contact@jon-andrew.com with the address you used to sign up. We will verify your identity before responding, to a degree proportionate to the request. We may decline requests where an exception applies, including where retention is required by law. You may also have the right to appeal a decision or to contact a regulator.
9. Children
This site is not directed to children under 13, and we do not knowingly collect personal data from children under 13. If you believe a child has provided personal data, contact us so it can be reviewed and deleted where appropriate.
10. Changes to this policy
We may update this policy from time to time. Material changes will be identified by a new effective date and any additional notice required by law. A new policy does not authorize a retroactive incompatible use of previously collected data. For website use, see the site terms of service. Contact us at contact@jon-andrew.com or +1 (424) 379-7477 with any privacy question.