Privacy policy
Last updated: 13 October 2026
This policy explains what personal information this website collects, why, and the rights you have over it. It covers visitors to the site and clients who are given an account for the private gallery.
Who we are
This website is run by Lisa Leung, a digital artworker based in the United Kingdom. We are the “controller” of the personal information described here, which means we are responsible for looking after it under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Email: lisaleung@hotmail.co.uk
What we collect
If you visit the site
- Technical details: your IP address, browser type and the pages you request. Our web host records these automatically in its server logs to keep the site running and secure.
- Failed sign-in attempts: if a sign-in fails, a scrambled (hashed) form of your IP address is kept for 15 minutes to block repeated password guessing.
There are no contact forms, comments, analytics, advertising trackers or social media plugins on this site, and nothing is loaded from other companies’ servers.
If you have a client account
- Account details: your name, username, email address and password. The password is stored scrambled, so we can’t read it.
- Sign-in sessions: while you are signed in, WordPress records the IP address, browser type and time of each session so it can keep the session secure.
If you email us
- Your email address, name and anything you write, including details of a project or commission.
We don’t buy personal information from anyone else.
Why we use it, and our legal basis
| What we do | Legal basis (UK GDPR) |
|---|---|
| Running the website and keeping it secure, including server logs and blocking password guessing | Legitimate interests: operating a secure website |
| Setting up and running your client account so you can see private work | Contract, or steps you asked us to take before entering one. Otherwise legitimate interests: sharing work with clients and studios |
| Replying to your emails and discussing commissions | Legitimate interests: answering enquiries. Contract, once we agree to work together |
We never use your information for marketing without your permission, and we don’t make decisions about you using automated processing or profiling.
Who we share it with
We never sell your information. The only other organisation involved is our web host, IONOS, which stores this website, its database and its server logs on our behalf. We’d only pass information to an authority, such as the police, if the law required us to.
Where it’s stored
Your information is stored on our web host’s servers in the UK or the European Economic Area, which the UK recognises as giving an equivalent level of data protection.
How long we keep it
| Client accounts | Until you no longer need access. We review accounts at least once a year and delete any that aren’t needed. |
| Sign-in sessions | Until you sign out, or after 2 days (14 days if you tick “Keep me signed in”) |
| Failed sign-in records | 15 minutes |
| Emails | As long as needed for your enquiry or project, and for up to 6 years after a commission ends for tax and accounting records |
| Web server logs | A short period set by our host, typically a few weeks |
Cookies
If you only browse the site, it sets no cookies. Cookies are only set when a client signs in to the private gallery. They are strictly necessary for signing in to work, so the law doesn’t require us to ask for your consent. We don’t use analytics, advertising or social media cookies.
| Name | What it does | How long |
|---|---|---|
| wordpress_test_cookie | Checks that your browser accepts cookies when you sign in | Until you close your browser |
| wordpress_sec_…, wordpress_logged_in_… | Keep you signed in securely to the private gallery | Until you close your browser, or 14 days if you tick “Keep me signed in” |
When you close the cookie notice, a small note (pf_cookie_notice) is saved in your browser so the notice isn’t shown again. It isn’t a cookie and is never sent to us. You can delete cookies and site data in your browser settings at any time. If you do, you’ll just need to sign in again.
Your rights
You can ask us to:
- give you a copy of the information we hold about you
- correct anything that’s wrong or incomplete
- delete your information
- restrict or object to how we use it
- send your information to you or another organisation in a portable format
Email lisaleung@hotmail.co.uk to make a request. It’s free, and we’ll reply within one month.
If you’re unhappy with how we’ve handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint or 0303 123 1113.
Children
This website isn’t aimed at children, and we don’t knowingly collect information from them.
Changes to this policy
If we change how we use your information, we’ll update this page and the date at the top.