Privacy Policy

Last updated: November 5, 2026

Artline Group Ltd, trading as Andrew Tough Fine Art (“we”, “us” or “our”), operates this store and website, including all related information, content, features, tools, products and services (the “Services”). Our business address is 35 Boclair Road, Bearsden, Glasgow, G61 2AF, United Kingdom.

Andrew Tough Fine Art is powered by Shopify, which enables us to provide the Services to you. This Privacy Policy describes how we collect, use and disclose your personal information when you visit, use or make a purchase through the Services, or otherwise communicate with us.

If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls in relation to the collection, processing and disclosure of your personal information.

Personal Information We Collect

“Personal information” means information that identifies, or can reasonably be linked to, you or another person. It does not include information that has been anonymised so that it can no longer identify you.

Depending on how you interact with the Services, we may collect or process:

• Contact details: your name, billing address, shipping address, phone number and email address.

• Payment and financial information: payment method, payment confirmation, transaction details and payment information processed through our payment providers.

• Account information: your username, account credentials, preferences and settings.

• Transaction information: items you view, add to your basket or wishlist, purchase, return, exchange or cancel, and your previous transactions.

• Communications: information you provide when contacting us, including customer support enquiries.

• Device information: information about your device, browser, network connection, IP address and other unique identifiers.

• Usage information: information about how and when you interact with or navigate the Services.

Where We Collect Personal Information

We may collect personal information:

• Directly from you, including when you make a purchase, create an account, contact us or otherwise provide information.

• Automatically through the Services, including through cookies and similar technologies when you visit our website.

• From service providers, including payment, website hosting, analytics and fulfilment providers acting on our behalf.

• From partners or other third parties, where permitted by applicable law.

How We Use Your Personal Information

We use your personal information for the following purposes:

• Providing the Services: processing payments, fulfilling orders, arranging delivery, managing accounts, handling returns and refunds, remembering preferences and providing customer support.

• Improving and personalising the Services: understanding how visitors use our website, improving its functionality and recommending relevant products.

• Marketing and advertising: sending promotional communications where permitted and displaying relevant advertising through the Services or other websites.

• Security and fraud prevention: protecting accounts, payments and the Services, investigating suspicious activity and preventing fraud or misuse.

• Communicating with you: responding to enquiries and sending order updates, account information and other service messages.

• Legal and administrative purposes: maintaining required records, complying with legal obligations, responding to valid legal requests, resolving disputes and enforcing our terms.

Our Lawful Bases for Processing

Under UK and European data protection laws, we rely on the following lawful bases, depending on the purpose of the processing:

• Contract: where processing is necessary to fulfil your order or take steps at your request before entering into a contract, including processing payment, arranging delivery and handling returns.

• Legal obligation: where processing is necessary to comply with requirements such as tax, accounting and consumer protection obligations.

• Legitimate interests: where necessary to operate and improve our business, respond to enquiries, protect the Services, prevent fraud or establish and defend legal claims, provided those interests are not overridden by your rights and interests.

• Consent: where required for activities such as certain marketing communications, non-essential cookies and related tracking technologies.

Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect processing carried out lawfully before you withdrew consent.

Where information is necessary to process an order or meet a legal obligation, we may be unable to complete your purchase or provide the relevant service if you do not supply it.

Cookies and Similar Technologies

We and our service providers may use cookies and similar technologies to operate the website, remember preferences, understand website usage and support advertising.

Where required, we ask for your consent before using non-essential cookies or related tracking technologies. You can manage your choices through the cookie banner or privacy preferences available on our website. You can also manage cookies through your browser settings, although blocking certain cookies may affect website functionality.

How We Share Personal Information

We may disclose personal information:

• To Shopify and service providers that support our business, including payment processing, IT services, analytics, customer support, cloud storage, fulfilment and shipping.

• To business and marketing partners that help us provide marketing services and advertising, subject to applicable consent requirements and your privacy choices.

• At your request or with your consent, including where needed to deliver products or support an integration you choose to use.

• Within our corporate group, where necessary for the purposes described in this policy.

• For legal or business purposes, including to meet legal obligations, respond to valid requests from authorities, protect rights, investigate breaches of our terms, or in connection with a merger, acquisition, restructuring or insolvency.

Our business and marketing partners process information in accordance with their own privacy notices. Depending on where you live, you may have the right to opt out of sharing personal information for targeted advertising.

Our Relationship with Shopify

The Services are hosted by Shopify. Shopify collects and processes personal information about your access to and use of the Services to provide and improve them.

Information you submit through the Services may be transmitted to Shopify and other service providers in countries outside your country of residence.

We also use Shopify enhanced features, including Shopify Network Intelligence. These features may use information about your interactions with our store together with information about your interactions with other merchants and Shopify to support services such as personalisation and advertising, subject to applicable law and your privacy choices.

For certain processing connected with these enhanced features, Shopify acts as an independent data controller and is responsible for responding to requests relating to that processing.

For more information, read the Shopify Consumer Privacy Policy. You can also visit the Shopify Privacy Portal to learn about and exercise rights relating to Shopify’s processing.

Third-Party Websites and Links

The Services may contain links to websites or platforms operated by third parties. If you follow these links, please review their privacy and security policies.

We are not responsible for the privacy practices, security or content of third-party websites. Information you share in public areas or on social media may be visible to others and used by them. Linking to a website does not, by itself, mean we endorse it.

Children’s Information

The Services are not directed at children, and we do not knowingly collect personal information from children.

If you are a parent or guardian and believe a child has provided us with personal information, please contact us so we can investigate and take appropriate action.

We do not have actual knowledge that we sell or share personal information about individuals under 16 years of age, as those terms are defined under applicable law.

Security and Retention

We use appropriate technical and organisational measures to protect personal information. However, no system or transmission method is completely secure. Please avoid sending sensitive payment information or other confidential details through unsecured channels.

We retain personal information for as long as necessary for the purposes described in this policy. The period depends on the type of information, whether it is needed to fulfil orders or maintain an account, applicable tax and accounting requirements, and whether it is required to resolve disputes, prevent fraud or establish or defend legal claims.

When information is no longer required, we delete or anonymise it, subject to applicable legal requirements.

Your Rights and Choices

Depending on where you live and the applicable law, you may have the right to:

• Access the personal information we hold about you.

• Correct inaccurate or incomplete personal information.

• Request deletion of your personal information.

• Receive or transfer information in a portable format in certain circumstances.

• Restrict processing in certain circumstances.

• Object to processing based on legitimate interests, including certain profiling.

• Object to direct marketing, including related profiling.

• Withdraw consent where processing relies on your consent.

These rights may be subject to legal conditions and exceptions.

You can unsubscribe from marketing emails using the unsubscribe link in the message. You may still receive essential communications about your orders or account.

To exercise your rights, email sales@andrewtough.com. We may need to verify your identity before responding. Where permitted by law, an authorised representative may make a request on your behalf, and we may ask for evidence of their authority.

We will respond within the timescales required by applicable law and will not discriminate against you for exercising your privacy rights.

For requests relating to processing for which Shopify is independently responsible, visit the Shopify Privacy Portal.

Complaints

If you have concerns about how we handle your personal information, please contact us at sales@andrewtough.com.

You also have the right to complain to the relevant data protection authority. In the United Kingdom, this is the Information Commissioner’s Office (ICO).

If you live in the European Economic Area, you can contact your local supervisory authority. A list is available through the European Data Protection Board.

Where applicable, you may also appeal our response to a privacy request by contacting us.

International Transfers

We and our service providers, including Shopify, may store or process personal information outside the United Kingdom or your country of residence.

Where required by applicable law, transfers outside the UK or European Economic Area are supported by appropriate safeguards, such as an adequacy decision, the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Agreement or the UK Addendum, as applicable.

Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, services or legal requirements. We will publish the updated policy on this website, revise the “Last updated” date and provide additional notice where required by law.

Contact Us

For questions about this Privacy Policy, our privacy practices or your personal information, contact:

Artline Group Ltd, trading as Andrew Tough Fine Art
35 Boclair Road
Bearsden
Glasgow
G61 2AF
United Kingdom

Email: sales@andrewtough.com

Artline Group Ltd is the data controller for the personal information we process for our own purposes as described in this Privacy Policy. Shopify acts as an independent data controller for certain processing described in the “Our Relationship with Shopify” section.