Privacy Policy

Last updated: 30 July 2026

1. Introduction

ART CARNIVAL LTD respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how we collect, use, store, share, and protect personal information when you:

Visit the Art Carnival website;
Create a customer account;
Purchase or download a digital product;
Contact customer support;
Subscribe to marketing communications; or
Otherwise interact with our website or services.

This policy applies to website visitors, customers, account holders, and people who contact us.

2. Who We Are

ART CARNIVAL LTD is the organisation responsible for deciding how and why your personal information is used.

For data-protection purposes, ART CARNIVAL LTD is the data controller.

Legal Business Name: ART CARNIVAL LTD
Registered in: England and Wales
Company Number: 17330660
Registered Office: 61 Bridge Street, Kington, HR5 3DJ, United Kingdom
Privacy and Support Email: contact@artcarnival.shop

Our registered office is used for official company correspondence. Our online business is managed remotely, including authorised business administration from Pakistan.

Questions or requests relating to your personal information should be sent to our privacy and support email address.

3. The Information We Collect

We only collect information that is reasonably necessary to operate our website, process orders, deliver digital products, provide support, prevent fraud, and comply with our legal obligations.

Information You Provide to Us

You may provide us with:

Your full name;
Email address;
Billing address;
Telephone number, where provided;
Customer-account username and password-related information;
Order and purchase information;
Messages sent through our contact forms;
Customer-support emails and communications;
Refund, complaint, or dispute information;
Marketing preferences; and
Any other information you voluntarily provide.

Because we sell digital products only, we do not require a shipping address for physical delivery.

Order and Transaction Information

When you place an order, we may collect:

Order number;
Product purchased;
Purchase date and time;
Amount and currency;
Discount or promotional-code information;
Payment status;
Transaction reference;
Billing information;
Download status;
Download date and time;
IP address connected with the order; and
Records relating to refunds, payment failures, complaints, or disputes.

Payment Information

Payments are processed by the payment provider displayed during checkout.

We do not normally receive or store your complete credit-card or debit-card number.

The payment provider may give us limited transaction information, such as:

Payment status;
Payment method type;
Card brand;
Last four digits of the card;
Transaction reference;
Billing country;
Fraud or security alerts; and
Refund or dispute information.

Payment providers process personal information under their own privacy policies and security procedures.

Technical and Website Information

When you use our website, we may automatically collect:

IP address;
Browser type and version;
Device type;
Operating system;
Language and time-zone settings;
Referring website;
Pages visited;
Time spent on the website;
Shopping-cart activity;
Login activity;
Download activity;
Website errors;
Security logs; and
Cookie and similar-technology information.

Information Received From Service Providers

We may receive information from:

Payment processors;
Fraud-prevention providers;
Website-hosting providers;
Email-delivery providers;
Website-security providers;
Analytics providers, where enabled;
Customer-support systems; and
Other providers involved in operating our website.

We do not intentionally collect special-category information, such as information concerning health, religion, ethnicity, political opinions, sexual orientation, or biometric identity.

Please do not provide this type of information unless it is genuinely necessary and we have specifically requested it.

4. How We Use Your Information

We may use personal information for the following purposes.

Processing and Delivering Orders

We use your information to:

Process your purchase;
Confirm payment;
Create and manage your order;
Provide access to purchased digital files;
Send order confirmations;
Restore download access;
Maintain order history; and
Respond to order-related questions.

Our lawful basis is normally that processing is necessary to perform our contract with you or to take steps at your request before entering into a contract.

Managing Customer Accounts

We use account information to:

Create and maintain customer accounts;
Authenticate users;
Display order and download history;
Reset passwords;
Protect accounts from unauthorised access; and
Provide account-related support.

Our lawful basis is performance of our contract with you and our legitimate interest in managing secure customer accounts.

Customer Service

We use your information to:

Respond to questions;
Investigate download problems;
Correct order errors;
Handle refund requests;
Review complaints;
Resolve payment disputes; and
Provide technical support.

Our lawful basis is performance of our contract and our legitimate interest in providing effective customer support and maintaining accurate service records.

Payment Processing and Fraud Prevention

We may use transaction, billing, technical, and device information to:

Process payments;
Verify transactions;
Prevent card testing;
Detect fraudulent or unauthorised activity;
Protect customers and our business;
Respond to chargebacks;
Enforce purchase and licence conditions; and
Cooperate with payment providers.

Our lawful basis is performance of our contract, compliance with legal obligations, and our legitimate interest in preventing fraud and protecting the security of our business.

Accounting and Legal Compliance

We may use and retain information to:

Maintain invoices and transaction records;
Prepare company accounts;
Complete tax filings;
Respond to regulatory enquiries;
Meet legal and financial-record requirements;
Establish or defend legal claims; and
Comply with court orders or lawful requests.

Our lawful basis is compliance with legal obligations and our legitimate interest in protecting our legal rights.

Website Operation and Security

We may process technical information to:

Operate the website;
Maintain website availability;
Protect customer accounts;
Identify technical problems;
Prevent malicious activity;
Monitor website performance;
Maintain backups;
Investigate security incidents; and
Improve website reliability.

Our lawful basis is our legitimate interest in operating a secure, reliable, and functional online business.

Analytics and Website Improvement

Where permitted and, when required, after receiving your consent, we may use analytics information to:

Understand how visitors use the website;
Identify popular products and pages;
Measure website performance;
Improve navigation;
Evaluate marketing activity; and
Improve our products and customer experience.

Where non-essential cookies or similar technologies are involved, our lawful basis is normally your consent.

Marketing Communications

Where you have subscribed or where applicable law otherwise allows us to contact existing customers, we may use your email address to send:

Product announcements;
Special offers;
Discount information;
Business updates; and
Other marketing communications.

You may unsubscribe at any time by using the unsubscribe option in the email or contacting us.

Where consent is required, our lawful basis is your consent. Where applicable law permits another basis, we may rely on our legitimate interest in promoting relevant products to existing customers.

We will not send marketing messages after you have opted out.

5. Our Legitimate Interests

Where we rely on legitimate interests, those interests may include:

Operating and improving our business;
Providing customer support;
Protecting our website;
Preventing fraud and payment abuse;
Maintaining accurate business records;
Understanding how our services are used;
Enforcing product licences;
Protecting intellectual property;
Recovering money owed to us; and
Establishing, exercising, or defending legal claims.

We consider whether our interests are necessary and balanced against your privacy rights before relying on this lawful basis.

6. Information Required to Complete a Purchase

Certain information is required to process an order and supply digital content.

This normally includes:

Your name;
Email address;
Billing information;
Order details; and
Valid payment information supplied to the payment provider.

Without this information, we may be unable to accept payment, deliver your digital files, provide customer support, or comply with accounting requirements.

Marketing information is optional and is not required to complete a purchase.

7. Cookies and Similar Technologies

Our website may use cookies and similar technologies.

Necessary Cookies

Necessary cookies may be used to:

Maintain the shopping cart;
Enable checkout;
Process login sessions;
Remember security settings;
Prevent fraud;
Maintain website functionality; and
Protect the website.

These cookies are required for the website to function and cannot always be disabled through our systems.

Preference Cookies

Preference cookies may remember choices such as:

Language;
Login preferences;
Display preferences; and
Cookie settings.

Analytics Cookies

Where enabled, analytics cookies help us understand how visitors use the website.

Non-essential analytics cookies will only be used where the required consent has been provided.

Marketing Cookies

Where enabled, marketing cookies may be used to measure advertisements or understand marketing performance.

These cookies will only be used where the required consent has been provided.

You can accept, reject, or manage non-essential cookies through our cookie-preference tool.

You may also control cookies through your browser. Disabling necessary cookies may prevent certain website functions, including shopping-cart, login, or checkout features, from working correctly.

8. How We Share Personal Information

We do not sell or rent your personal information.

We may share limited information with service providers where necessary to operate our business.

These providers may include:

Payment-processing providers;
Website-hosting and infrastructure providers;
E-commerce and digital-download systems;
Website-platform and plugin providers;
Email and customer-communication providers;
Website-security and fraud-prevention providers;
Backup and data-storage providers;
Analytics providers, where consent has been provided;
Accountants, tax advisers, insurers, and legal advisers;
Banks and financial-service providers; and
Government authorities, regulators, courts, or law-enforcement agencies where legally required.

We require service providers to process information only for authorised purposes and to apply appropriate privacy and security protections.

We may also disclose information:

To investigate fraud or unlawful activity;
To respond to a payment dispute;
To enforce our contractual or licence rights;
To protect customers or the public;
To comply with a legal obligation; or
In connection with a genuine merger, business transfer, restructuring, or sale.

9. Access From Pakistan and International Processing

ART CARNIVAL LTD is registered in England and Wales.

The company’s director manages parts of the online business remotely from Pakistan. This means authorised access to customer information may take place from Pakistan when reasonably necessary for:

Processing and reviewing orders;
Providing customer support;
Preventing fraud;
Managing refunds and disputes;
Maintaining accounting records;
Administering the website; and
Operating the business.

Access is limited to authorised business purposes and is subject to reasonable security measures.

Some service providers may also process or store personal information outside the United Kingdom.

Where information is transferred to a separate organisation outside the UK and the law requires additional protection, we use an applicable legal transfer mechanism. Depending on the circumstances, this may include:

UK adequacy regulations;
Recognised contractual safeguards;
The UK International Data Transfer Agreement;
An approved UK Addendum; or
Another lawful transfer mechanism.

You may contact us for further information about the safeguards applicable to your personal information.

The ICO explains that international-transfer rules can apply when a UK organisation sends or makes information accessible to a separate organisation outside the UK.

10. How Long We Keep Information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected.

Our normal retention periods are:

Orders, Invoices, and Accounting Records

Order, invoice, payment, refund, and accounting records may normally be retained for at least six years from the end of the relevant company financial year.

Information may be retained longer where required because of:

A tax or regulatory enquiry;
An unresolved payment dispute;
A legal claim;
Suspected fraud;
A court order; or
Another legal requirement.

UK government guidance requires companies to retain relevant company and accounting records for six years from the end of the financial year to which they relate, subject to certain exceptions.

Customer Accounts

Customer-account information may be retained while the account remains active and for up to two years after account closure or prolonged inactivity.

Transaction and accounting information connected with the account may be retained for the longer period described above.

Customer-Support Communications

Customer-support enquiries may normally be retained for up to two years after the matter has been resolved.

Communications connected with a dispute, fraud investigation, refund, or legal claim may be retained longer.

Website and Security Logs

Technical and security logs may normally be retained for up to 12 months unless a longer period is reasonably required to investigate fraud, misuse, or a security incident.

Marketing Information

Marketing information is retained until you unsubscribe, withdraw consent, or we determine that it is no longer required.

After you unsubscribe, we may retain limited information on a suppression list to ensure that we do not accidentally send further marketing messages.

We periodically review retained information and delete or anonymise it when it is no longer required.

11. How We Protect Your Information

We use reasonable technical and organisational measures designed to protect personal information from:

Unauthorised access;
Accidental loss;
Misuse;
Alteration;
Disclosure; and
Destruction.

These measures may include:

Secure website connections;
Restricted account access;
Strong authentication;
Security monitoring;
Website and software updates;
Fraud-prevention controls;
Secure backups; and
Limited access based on business need.

No website, payment system, or electronic-storage method can be guaranteed to be completely secure. However, we take reasonable steps to reduce foreseeable risks.

12. Your Data-Protection Rights

Depending on applicable law and your circumstances, you may have the right to:

Request Access

You may ask for confirmation of whether we process your personal information and request a copy of that information.

Request Correction

You may ask us to correct inaccurate or incomplete personal information.

Request Deletion

You may ask us to delete your personal information where there is no continuing lawful reason to retain it.

We may need to retain certain information for accounting, fraud-prevention, dispute-management, or legal purposes.

Request Restriction

You may ask us to restrict how we use your information in certain circumstances.

Object to Processing

You may object where we rely on legitimate interests.

You may object to direct marketing at any time.

Request Data Portability

Where applicable, you may request personal information you provided to us in a structured, commonly used, machine-readable format.

Withdraw Consent

Where we rely on consent, you may withdraw it at any time.

Withdrawal will not affect processing lawfully completed before consent was withdrawn.

Complain to a Regulator

You have the right to complain to the Information Commissioner’s Office, the UK data-protection regulator.

We would appreciate the opportunity to address your concern first, but you are not required to contact us before approaching the regulator.

These rights are not absolute. A request may be limited or refused where permitted by law.

To exercise a right, contact us at contact@artcarnival.shop.

We may request reasonable information to confirm your identity before responding.

13. Marketing Preferences

You can stop receiving promotional emails at any time by:

Clicking the unsubscribe link in a marketing email; or
Emailing contact@artcarnival.shop.

Unsubscribing from marketing will not stop necessary service communications, such as:

Order confirmations;
Download information;
Security notifications;
Refund communications; or
Responses to customer-support requests.

14. Automated Payment and Fraud Checks

We do not independently make decisions based solely on automated processing that produce legal or similarly significant effects.

However, payment processors and fraud-prevention providers may use automated systems to:

Assess transaction risk;
Identify suspected fraud;
Request additional authentication;
Delay a payment; or
Decline a transaction.

These providers operate under their own privacy policies and decision-making procedures.

15. Children’s Information

Our website and digital products are not specifically directed at children.

You must normally be at least 18 years old to make a purchase, or have the involvement and permission of a parent or legal guardian.

We do not knowingly collect personal information from children without appropriate permission.

16. Third-Party Websites

Our website may contain links to third-party websites, platforms, or services.

We are not responsible for the privacy practices of third parties. You should review the privacy notice of any external website before providing personal information.

17. Changes to This Privacy Policy

We may update this Privacy Policy when:

Our services change;
We introduce a new provider;
Our data-processing practices change;
Legal requirements change; or
We improve our privacy procedures.

The latest version will be published on this page with an updated effective date.

Where a change materially affects how we use personal information, we will take reasonable steps to provide an appropriate notice.

18. Contact Us

For privacy questions, requests, or complaints, contact:

ART CARNIVAL LTD
Company Number:17330660
Registered in England and Wales
Registered Office: 61 Bridge Street, Kington, HR5 3DJ, United Kingdom
Email: contact@artcarnival.shop