Privacy Policy
Last updated: 30 September 2026. This Privacy Policy explains how Silk & Needle Gallery handles information when you browse the website, use its contact or enquiry forms, or otherwise communicate with the Gallery.
Who is responsible for your data
Silk & Needle Gallery is responsible for the personal data described in this notice.
Privacy and data-protection requests can be submitted through our Contact page.
Data processed when you browse the site
The website is delivered through Cloudflare infrastructure. As part of providing hosting, network, security and reliability services, Cloudflare may process ordinary technical connection information associated with requests to the website.
We do not use the website for advertising profiling or cross-site behavioural tracking.
Cloudflare Web Analytics
We use Cloudflare Web Analytics to understand aggregate website usage and website performance.
Cloudflare Web Analytics may provide information including:
- page views and visits;
- website host and page path;
- referral source;
- country;
- device type;
- browser and operating system;
- navigation type;
- page-load performance; and
- Core Web Vitals and related performance measurements.
Cloudflare Web Analytics uses a JavaScript performance beacon to collect these metrics. It does not use cookies or local storage for analytics.
According to Cloudflare, Web Analytics does not fingerprint individuals for the purpose of analytics, does not track individual users across Cloudflare customer websites, and does not collect or use visitors' personal data for the Web Analytics service.
We use Web Analytics only for aggregate audience measurement, understanding which content is consulted, identifying navigation or performance problems, and improving the technical performance and presentation of the website.
We do not combine Web Analytics information with customer records, contact-form submissions or other information in order to identify individual visitors. We do not use it for advertising, individual behavioural profiling or cross-site tracking.
Cloudflare currently makes Web Analytics information available for the previous six months. Cloudflare states that unsampled beacon data is retained for seven days and is then aggregated for longer-term analytics.
Contact and artwork-enquiry data
When you submit a contact form or artwork enquiry, we process the information you provide, which may include:
- your name;
- your email address;
- the subject or artwork concerned; and
- your message.
A hidden anti-spam field is also submitted.
The browser also obtains a temporary Cloudflare Turnstile verification token for security verification.
The contact service validates the submitted fields and applies an IP-based rate limit. For Turnstile verification, the temporary Turnstile token and request IP address are sent to Cloudflare's Siteverify service.
If verification succeeds, the validated form content is converted into an email addressed to the Gallery.
The contact Worker does not create a separate application database containing contact messages.
Purposes and legal bases
Contact information is processed in order to respond to your request.
Where an enquiry concerns a possible acquisition or another transaction, the processing may be necessary to take steps at your request before entering into a contract.
Other ordinary correspondence is processed on the basis of our legitimate interest in communicating with people who contact the Gallery.
IP-based rate limiting, Turnstile verification, origin checks, input validation and anti-spam controls are used for our legitimate interest in protecting the website and contact service against fraud, abuse and automated submissions.
To the extent that technical connection information processed in operating, securing or delivering the website constitutes personal data, it is processed for our legitimate interest in providing a secure, reliable and functional website.
Cloudflare Web Analytics is used exclusively for aggregate audience and performance measurement and is not used for advertising, profiling or cross-site tracking.
Technical logs
The contact Worker generates a random request identifier and records limited operational events such as:
- the request identifier;
- the processing outcome;
- the site name; and
- a timestamp.
The application does not intentionally include the visitor's name, email address, message or IP address in these custom log messages.
Cloudflare may additionally process technical request metadata as part of providing its infrastructure, security and observability services.
Worker log retention depends on the applicable Cloudflare service configuration and is limited by Cloudflare's service retention periods. Under Cloudflare's current Workers Logs limits, retained Worker logs are kept for no more than seven days.
Recipients and service providers
Information may be processed by Cloudflare, which provides services including:
- website network and delivery infrastructure;
- Cloudflare Pages and related hosting infrastructure;
- Cloudflare Web Analytics;
- Worker infrastructure;
- rate limiting;
- Turnstile security verification; and
- related security and observability services.
When you successfully submit a contact or artwork enquiry, the message is delivered to the Gallery's designated email inbox. The applicable email provider therefore processes the email and subsequent correspondence.
We do not sell personal data and do not provide visitor information to advertising networks for behavioural advertising.
International transfers
Some service providers may process information outside the European Economic Area.
Where data-protection law requires safeguards for an international transfer of personal data, the applicable provider is required to rely on an appropriate transfer mechanism, such as an adequacy decision, Standard Contractual Clauses or another mechanism permitted by applicable law.
Retention
The contact Worker does not retain a separate database copy of submitted contact messages.
Contact emails and subsequent correspondence are retained only for as long as reasonably necessary to deal with the enquiry and related follow-up.
As a general rule, prospect correspondence should not be retained for more than three years after the last meaningful contact unless a longer period is necessary for an ongoing transaction, compliance with a legal obligation, or the establishment, exercise or defence of legal claims.
Temporary Turnstile tokens are used for verification and are not retained by the Gallery as contact records.
Operational Worker logs are retained only for the applicable short Cloudflare log-retention period.
Cloudflare Web Analytics data is retained according to Cloudflare's applicable Web Analytics retention rules and is used only in aggregate for audience and performance measurement.
Cookies and browser storage
We do not use advertising, behavioural-profiling or cross-site-tracking cookies.
Cloudflare Web Analytics does not use analytics cookies or local storage.
Cloudflare security services may use technical information or strictly necessary security technologies where required to protect and deliver the service.
Further information is available in our Cookies & Browser Storage notice.
Because the website does not currently use optional tracking technologies requiring prior consent, no cookie-consent banner is displayed.
Your rights
Subject to the conditions and exceptions provided by the GDPR and other applicable data-protection law, you may have the right to:
- obtain access to your personal data;
- request correction of inaccurate personal data;
- request erasure of personal data;
- request restriction of processing;
- receive personal data in a portable format where the right to portability applies; and
- object to processing based on legitimate interests.
You may exercise these rights through our Contact page.
We may need to verify your identity before responding to a request.
You also have the right to lodge a complaint with a competent data-protection supervisory authority. In France, the supervisory authority is the Commission nationale de l'informatique et des libertés (CNIL).
Changes to this Privacy Policy
We may update this Privacy Policy when the website's data flows, technologies, service providers or applicable legal requirements change.
The date shown at the top of this page identifies the current version.