Privacy policy

Version 1.2 · Last updated 6 October 2026

1. Who we are

Leo Martelli Ltd ("we", "us", "the studio") is the data controller for the personal data described in this policy. We are registered in England and Wales under company number 17451135, registered office 82a James Carter Road, Bury St. Edmunds, IP28 7DE, England. For anything about your data, email hello@leomartelli.com.

This policy covers leomartelli.com, orders you place with us, reviews you write about our works, emails and messages you exchange with us and our mailing list, the Collectors Circle. We follow the UK General Data Protection Regulation, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003. If you live in the European Economic Area, the EU General Data Protection Regulation also applies to how we handle your data, and you have the same rights under it.

2. What we collect

Contact and identity details: your name, email address, phone number and delivery and billing addresses, when you order, join the Collectors Circle or write to us.
Order details: the works you buy, the edition numbers allocated to you, prices, discount codes used, delivery and tracking information, and any returns or replacements.
Payment details: payments are processed by Shopify Payments. We receive confirmation of payment and the last 4 digits and type of your card. We never see or store your full card number.
Messages: anything you send us by email or through the site, including photos you send if a work arrives damaged.
Reviews: what you write, rate and attach when you review a work, and whether it can be linked to an order placed with us. See section 5.
Marketing preferences: whether you have joined the Collectors Circle, when and how you joined, and whether you have opened or clicked our emails (each email contains a small tracking image and tracked links; you agree to this when you join).
Technical and usage data: your IP address, device and browser type, the pages you visit, how you reached the site and what you add to your cart, collected automatically when you use the site and through the cookies described in section 9.

Most of this comes from you. We also receive delivery updates from Gelato and the carriers, fraud and technical signals from Shopify, email engagement data from Klaviyo, and review data from Judge.me.

To place an order you must give us your name, delivery address and email address, and a phone number where the carrier needs one; without them we cannot make or deliver the work. Everything else is optional.

We do not collect any special category data and we do not knowingly collect data from anyone under 18. Our site and works are for adults.

3. How we use your data, and on what legal basis

Process and deliver your order, allocate your edition number, send order and delivery emails, handle returns, replacements and refunds — performance of our contract with you.
Keep the edition register (which number went with which order) so that every edition stays at 250 — our legitimate interest in the integrity of each edition, which is also what you bought.
Keep accounting and tax records — our legal obligations under company and tax law.
Answer your questions and complaints — performance of the contract; otherwise our legitimate interest in running the studio well.
Publish your review, show it in our emails, advertising and social media accounts, invite you to write one and keep reviews honest — our legitimate interest in an honest public record of our work; see section 5.
Send the Collectors Circle emails you signed up for — your consent, which you can withdraw at any time.
Remind you about a checkout you started but did not complete — your consent, given by ticking the marketing box at checkout or by joining the Collectors Circle; you can opt out in every email.
Measure how our site and advertising perform — your consent, given through the cookie banner.
Detect fraud and keep the site secure — our legitimate interest in preventing fraud, and our legal obligations.

Where we rely on legitimate interests we have checked that our interest is not overridden by your rights. You can object at any time; see section 10.

4. Marketing

The Collectors Circle is our mailing list. You join it by entering your email address in the sign-up form on our site or by ticking the marketing box at checkout; we record when and how you joined. We then email you a welcome code and, from time to time, news of new work. New work is announced to the list first. We do not send text messages. Every email has an unsubscribe link, and unsubscribing takes effect immediately for marketing; order and delivery emails will still reach you.

If you start a checkout, enter your email address and leave without paying, we may email you up to 2 reminders about the work you left. We only do this if you ticked the marketing box at checkout or are already in the Collectors Circle. You can opt out in the email itself or by writing to us.

We do not sell or rent your data. Apart from Meta's own use of pixel data described in section 6, we do not share it with other businesses for their marketing.

5. Reviews

Reviews on our product pages are run for us by Judge.me. How reviews work, who can write one and when we remove one are in our Reviews policy; this section is about the personal data involved.

What we collect. When you write a review: the display name you type, your email address, your rating, your review, the date, any photograph or video you attach, and the technical information your browser sends to the review service, including your IP address. Judge.me also records whether your review can be linked to an order placed with us, which decides whether it carries the "Verified" label.

What is published. Your display name, rating, review, the date, how the review reached us, whether it is verified, and anything you attach. Your email address is not published. We may also show your review, with your display name and anything you attach, in our emails, our advertising and on our social media accounts (see section 8 of our Reviews policy).

Why, and on what legal basis. Publishing your review on the page of the work it is about — our legitimate interest, and yours, in an honest public record of our work; you choose what to write and whether to attach anything. Showing your review, with your display name and anything you attach, in our emails, in our advertising, including on Facebook and Instagram, and on our social media accounts — our legitimate interest in showing what buyers think of our work; you can object at any time (section 10) and we stop. Confirming email addresses, linking reviews to genuine orders and checking for fake or repeated reviews — our legitimate interest in keeping reviews honest. Inviting buyers to write a review — our legitimate interest in asking the people who bought our work what they think of it. Answering you — the same. Any photograph or video you attach is used under the licence you give when you submit it, set out in section 11 of our Terms of service.

The confirmation email. If you write a review on our site rather than through an invitation, Judge.me may email you from support@judge.me with a link to confirm your address. It does this when the address looks like a customer's, for example because it matches an order. The link checks the address; it does not delay publication. The link also opens your Judge.me reviewer profile; filling it in is optional.

The invitation email. If you buy a work, we email you 14 days after it is dispatched to ask for a review; if your order is sent in more than one box, each box gets its own email, for up to 7 works per order. We send it under the soft opt-in in regulation 22 of the Privacy and Electronic Communications Regulations 2003: we obtained your address when you bought from us, the email concerns the works you bought, your order confirmation email tells you how to refuse it, and every invitation carries its own unsubscribe link. Invitations are separate from the Collectors Circle (section 4): unsubscribing from our mailing list does not stop review invitations, and opting out of invitations does not unsubscribe you from the mailing list. You can refuse either at any time by emailing hello@leomartelli.com.

Who else sees it. Judge.me stores and displays reviews and sends these emails on our instructions, under its data processing addendum (section 6). It stores review data in the United States (section 7). Judge.me also keeps your reviews in a Judge.me reviewer account in your name, where you can see, edit or delete them; Judge.me handles that account under its own privacy policy (judge.me/privacy). If we use your review in our advertising or on our social media accounts, it is published on those platforms, including Facebook and Instagram, which are run by Meta.

How long we keep it. A published review stays up for as long as the work is in our catalogue, unless it is taken down under section 6 of our Reviews policy; see section 8 for what happens to it then.

Removing it. You can ask us to take your review down at any time, and we will hide it from our site. Judge.me does not let a shop delete a review a customer wrote, or change the name, rating or date on it, so we cannot delete your review ourselves or make it anonymous. If you ask us to delete your personal data, we hide your review, pass your request to Judge.me and tell you what has been done; we may first ask you to confirm the review was yours (section 10). We keep a record that the review was taken down, with the date and the address it was left from, for 2 years (section 8). You can also delete the review yourself: sign in to your Judge.me reviewer account on judge.me with the email address you used, open My reviews and delete it. Or ask Judge.me, at support@judge.me, to delete your Judge.me account, which removes your reviews from every shop that uses Judge.me.

6. Who we share your data with

We share your data with the organisations below. Shopify, Gelato, Klaviyo, Judge.me and our email, hosting and IT providers process it on our instructions under written contracts; for Judge.me, that is the data processing addendum that forms part of its terms of service. Carriers, our professional advisers and public authorities are responsible for their own use of it. Meta is a joint controller with us for the data the Meta Pixel collects, as explained below.

Shopify hosts our online store and checkout, processes payments through Shopify Payments, runs the site analytics and fraud checks, sends order and delivery emails on our behalf, and hosts the chat on our site (Shopify Inbox).
Gelato is our production partner. To make and deliver your work we share your name, delivery address, email address and phone number with Gelato, which passes them to the production facility and carrier nearest to your address. Where the facility can print it, your edition number and the title of the work are printed on a card in your box.
Klaviyo sends our Collectors Circle and reminder emails and stores your email preferences.
Judge.me collects, stores and displays the reviews on our product pages and sends the review invitation and confirmation emails. It receives what you enter in a review and, from our store, order details including your name, email address, what you ordered, where it is being delivered and when it was dispatched, so that it can send invitations and match reviews to orders.
Carriers such as Evri, DHL, UPS and national postal services receive your name, address, phone number and email address to deliver your work and send delivery updates.
Meta (Facebook and Instagram) receives data about your visit through the Meta Pixel and Conversions API, but only if you accept marketing cookies: the pages and works you view, what you add to your cart or buy, your IP address and browser details and, in hashed form, the email address, phone number and name you enter at checkout. We use it to measure our advertising and to show our work to people like you. For collecting this data on our site and sending it to Meta, we and Meta Platforms Ireland Limited are joint controllers under Meta's Controller Addendum; Meta alone is responsible for what it does with the data afterwards, as described in Meta's privacy policy (facebook.com/privacy/policy). You can exercise your rights against either of us.
Email, hosting and IT providers: our email is forwarded by ImprovMX and stored by Google; our order-numbering service, which keeps a copy of each order, is hosted by Railway.
Professional advisers such as our accountant, and public authorities where the law requires it.

7. International transfers

We are based in the UK. Some of our providers store or process data outside the UK:

Shopify processes data in Canada and the United States. Canada is recognised by the UK as providing adequate protection for commercial organisations; for the United States we rely on the UK Addendum to the standard contractual clauses in Shopify's data processing agreement.
Klaviyo processes data in the United States and is certified under the EU-US Data Privacy Framework and its UK Extension.
Gelato is based in Norway, which is in the European Economic Area and recognised as adequate. To make and deliver a work ordered from outside the UK, Gelato passes your delivery details to its production facility and carrier in or near your country. This is necessary to perform your contract with us (Article 49(1)(b) UK GDPR), and our written contract with Gelato requires it to protect your data to UK standards wherever it is processed. Where that country is not recognised by the UK as adequate (for example the United States, Australia or Singapore), the data may not have the same legal protection there as in the UK.
Judge.me is based in the UK and stores review data in the United States; for that transfer we rely on the standard contractual clauses and the UK Addendum in Judge.me's data processing addendum.
Meta processes data in Ireland and the United States and is certified under the EU-US Data Privacy Framework and its UK Extension.
Our email (Google) and our order-numbering service (Railway) are hosted in the United States. Google is certified under the EU-US Data Privacy Framework and its UK Extension; for Railway we rely on standard contractual clauses approved for UK transfers.

You can ask us for more detail on the safeguards used for any transfer.

8. How long we keep your data

Orders, invoices and correspondence about them: 6 years after the end of the financial year in which the order was placed, as company and tax law requires.
Edition register: the link between an edition number and an order number is kept for as long as the edition exists. Once the 6-year period above has passed, the register holds only the order number and edition number, not your name or contact details.
Collectors Circle: until you unsubscribe or ask us to delete your data. After you unsubscribe we keep your email address on a suppression list so that we do not email you again.
Abandoned checkouts: 12 months from your last visit, unless you order or join the Collectors Circle. Enquiries that do not lead to an order: 2 years after our last exchange.
Reviews: a published review stays up for as long as the work is in our catalogue, unless it is taken down under our Reviews policy. Judge.me does not let a shop delete a review a customer wrote, so a review we take down, or one for a work that has left the catalogue, is hidden rather than deleted; it stays in our Judge.me account until you or Judge.me delete it (section 5). The record linking a review to an order is kept with the order. Removed reviews: our record of a removal (the date, the reason and the address the review was left from) is kept for 2 years. Review invitations: if you refuse them, your email address stays on Judge.me's blocklist so that you are not invited again.
Analytics and advertising data: for the lifetime of the cookie shown in section 9, and in aggregated form after that.

9. Cookies

Cookies are small files placed on your device. We use 3 kinds:

Essential cookies set by Shopify, which make the site, your cart and checkout work and protect against fraud. These cannot be switched off.
Analytics cookies set by Shopify, which tell us how the site is used so that we can improve it.
Marketing cookies set by Meta and Klaviyo, which measure our advertising and let us show our work to people who have visited the site.

The main cookies we use:

Cookie	Set by	Kind	Lasts
_secure_session_id	Shopify	Essential	24 hours
cart, cart_sig, cart_ts, keep_alive, localization	Shopify	Essential	2 weeks
secure_customer_sig	Shopify	Essential	1 year
_tracking_consent, _cmp_a	Shopify	Essential (remembers your cookie choice)	1 year / 1 day
_shopify_y	Shopify	Analytics	1 year
_shopify_s, _shopify_sa_p, _shopify_sa_t	Shopify	Analytics	30 minutes
_landing_page, _orig_referrer	Shopify	Analytics	2 weeks
_fbp, _fbc	Meta	Marketing	90 days
__kla_id	Klaviyo	Marketing	2 years

Analytics and marketing cookies are set only if you accept them in the cookie banner. You can change your choice at any time by clearing cookies in your browser; the banner will ask you again on your next visit. Blocking essential cookies may stop parts of the site from working.

Judge.me. The script that runs our reviews is part of our theme and loads on every page of our store, including pages that show no reviews. Your browser fetches it from Judge.me's servers, so Judge.me receives your IP address and browser details, as any website you connect to does. Loading a page does not make it set cookies or store anything on your device. It is there to show reviews and run the review form; we do not use it for advertising or to build a profile of you. If you write a review, section 5 applies.

10. Your rights

You have the right to:

ask for a copy of the personal data we hold about you;
ask us to correct data that is wrong or incomplete;
ask us to delete your data, where we no longer need it;
ask us to restrict how we use your data while a question about it is resolved;
receive the data you gave us in a portable format;
object to processing based on our legitimate interests, and to direct marketing at any time;
withdraw your consent at any time, without affecting what was done before.

To use any of these rights, email hello@leomartelli.com. We will reply within 1 month (up to 3 months for a complex request, in which case we will tell you within the first month) and will not charge you unless a request is clearly unfounded or excessive. We may ask you to confirm your identity first.

If you are unhappy with how we handle your data, email hello@leomartelli.com with "Data complaint" in the subject line. We will acknowledge your complaint within 30 days and reply without undue delay. You also have the right to complain to the UK regulator, the Information Commission (formerly the Information Commissioner's Office, ICO), at ico.org.uk/make-a-complaint or on 0303 123 1113. If you live outside the UK you may also complain to your own data protection authority.

11. Security

Our store runs on Shopify, which is certified to PCI DSS Level 1. All pages are served over an encrypted connection. Order data can be seen only by the people who run the studio and by the providers listed above, and we use 2-step verification on the accounts we use to reach it.

12. Automated decisions

Shopify runs automated fraud analysis on orders. It only flags orders for us; we review any flagged order ourselves before deciding anything. Your bank or Shopify Payments may decline a payment under their own rules. We do not make decisions about you by automated means alone.

13. Changes to this policy

We will post any changes on this page and update the date at the top. If a change is significant we will email customers and Collectors Circle members before it takes effect.