Privacy notice.

Who is responsible

Arsalan Tahir, trading as Slowrev, is the data controller for the personal information described in this notice. This means I decide why and how that information is used.

For privacy questions or to exercise your rights, email support@slowrev.co.uk. You can also contact me through @car.sptz on Instagram. You can browse the photographs without creating an account.

Business postal address: 67 Alexandra Road, London

Information collected

• Orders: your name and email address, selected photographs, prices, order and payment references, payment status, order dates, and email-delivery status. An order record can be created when you continue to payment even if you do not complete the purchase.
• Immediate-delivery agreement: your acceptance, the date and time it was recorded, and the wording and version you agreed to at checkout.
• Enquiries: your contact details, your message and any information you choose to provide when contacting me.
• Website requests: connection information such as your IP address, browser and requested pages or files, which hosting and security services process to deliver and protect the website. Request limits use hashed versions of IP addresses, email addresses and order or payment-session identifiers. Hashing does not make these identifiers anonymous.

Information comes from you, your browser, and payment or email-delivery updates from the providers below. Your name and email address are needed to handle an order and deliver its download link. Without the required checkout details, I cannot process your purchase.

You enter billing and card details on Stripe’s hosted checkout. The website’s order database does not store full card numbers or card security codes. Stripe processes payment information and may make billing and transaction details available to me as the merchant.

Why information is used

• Taking payment, supplying photographs and providing order support: to perform the purchase contract, or take steps you request before entering it.
• Answering enquiries: to take requested steps towards a purchase, or for my legitimate interest in responding to other messages.
• Keeping transaction and agreement records: to meet applicable accounting, tax and consumer-law obligations, and for my legitimate interest in establishing or defending legal claims.
• Protecting the website and handling suspected misuse: for my legitimate interest in keeping the service secure and available and preventing fraud.

The immediate-delivery checkbox records your agreement about supply and cancellation rights. Order processing uses the legal bases above. This notice does not sign you up for marketing.

Services that receive information

• Cloudflare provides hosting, website delivery, security and storage, including order records and photographs.
• Stripe receives contact and order information and processes payments, refunds and disputes. It also handles information for its own payment, security and regulatory purposes, described in its privacy notice.
• Resend sends order and download emails. It receives the recipient’s email address and email contents, including order details, the recorded delivery agreement and the download link.
• Sanity hosts published gallery content and image assets. Requests to its services can include connection information. Customer order records are not stored in the gallery content system.

Information may also be shared with professional advisers, payment-dispute parties or public authorities where necessary for accounting, legal claims or a legal obligation. I do not sell customer information.

Processing outside the UK

These providers operate internationally, so personal information may be processed outside the UK, including in the United States. Their published data-processing terms provide for relevant international-transfer safeguards, including contractual transfer clauses and UK provisions where applicable.

You can read the transfer terms for Cloudflare, Stripe, Resend and Sanity, or contact me for information about safeguards relevant to your data and how to obtain a copy.

How long information is kept

Order and agreement records are kept while needed for delivery, customer support, refunds and disputes, applicable tax and accounting requirements, or establishing and defending legal claims. Retention depends on those requirements and whether an enquiry, dispute or claim is still open.

Enquiry correspondence is kept while needed to answer and resolve your message and any related order or claim. Technical and security information is retained according to the relevant provider’s service and security practices. Contact me for information about a particular record.

Download links expire after seven days. This limits access to the files; it does not automatically delete your order or agreement record.

Cookies and browser storage

The basket stores selected photograph identifiers in your browser so your choices remain available between visits. The light or dark theme preference is also stored in your browser. These settings have no automatic expiry in the application: they remain until changed or removed by you or your browser. You can remove basket items, change the theme, or clear site data in your browser settings.

Hosting and payment providers may use cookies or similar technologies for service delivery, security and their own services. Stripe’s hosted payment page is covered by its cookie policy. Following an Instagram link takes you to a separate service with its own privacy practices.

Your rights and complaints

Depending on the circumstances, you can ask to access your personal information, correct inaccurate information, have information erased, restrict its use, or receive certain information in a portable format. These rights have legal limits, including where records are needed to meet a legal obligation or handle a legal claim.

Your right to object: you can object to processing based on legitimate interests. Contact me using the email above to explain your request.

I may need proportionate information to verify your identity before responding. The shop does not build customer profiles for automated decisions with legal or similarly significant effects; payment and security providers explain their own practices in their notices.

You can also complain to the Information Commissioner’s Office (ICO), the UK data-protection regulator. You do not have to contact me before making a complaint.

Changes to this notice

This page will be updated if the information collected or its uses change. The date above identifies the current version.