Privacy Policy
Last updated: 29 October 2026 · Effective from: 29 October 2026
This privacy policy explains what personal information Art Painting by Numbers collects, why we collect it, how long we keep it, who it is shared with, and the rights you have over it. It applies to our website at artpaintingbynumbers.com, to enquiries and orders made by email, telephone, WhatsApp, WeChat or trade platforms, and to the dropshipping orders we fulfil on behalf of our business customers.
We are a business-to-business manufacturer. Most information we hold is business contact information rather than private consumer data, and we use it only to quote, produce and deliver orders. If you are a customer of one of the stores we dropship for, section 4 explains the specific position that applies to you.
1. Who we are
| Data controller | Art Painting by Numbers |
| Address | Room 508, Building 5, No. 100 Youyi Road, Hexi District, Tianjin, China |
| [email protected] | |
| Telephone | +86 156 0537 8062 |
| Website | https://artpaintingbynumbers.com |
For enquiries from the European Economic Area, the United Kingdom or Switzerland, we act as data controller for information you give us directly, and as data processor for order information passed to us by a business customer whose store we fulfil. Contact details for privacy questions are the same as above; please write "Privacy" in the subject line.
2. Information we collect
2.1 Information you give us
- Name, job title and company or store name
- Email address, telephone number, WhatsApp or WeChat identifier
- Business address, shipping address and destination country
- Contents of your enquiries, including artwork, photographs, design briefs, product specifications and target pricing
- Order details: products, quantities, packaging requirements, branding instructions and Incoterm
- Payment and invoicing information necessary to issue an invoice and clear export customs (note: we do not store full card numbers — see section 3.4)
- Passport details, where you ask us to issue an invitation letter for a business visa to visit the factory
- Photographs and video taken during a factory visit, with your consent
2.2 Information collected automatically
Like most websites, ours records limited technical data when you visit: IP address, browser type and version, device type, operating system, referring page, pages viewed, date and time of visits, and the WordPress cookies required to run the site. If analytics are enabled, we use them in aggregate to understand which pages help buyers and which do not. We do not build advertising profiles of individual visitors and we do not sell visitor data.
2.3 Information we receive from third parties
Where a business customer places a dropshipping order with us, that customer provides the end recipient's name, delivery address, contact telephone or email and order details so the parcel can be delivered. We receive this information from the customer, not from the recipient. Trade platforms such as Alibaba may also pass on enquiry and transaction records for orders placed through them.
3. How we use information, and the legal basis
| Purpose | Legal basis (GDPR Art. 6) | Retention |
|---|---|---|
| Answering enquiries and preparing quotations | Legitimate interests — responding to a business request | 3 years from last contact |
| Designing artwork and producing samples | Pre-contractual steps at your request | Duration of the project plus 3 years |
| Manufacturing, packing, labelling and shipping orders | Performance of a contract | 7 years (tax, customs and export records) |
| Issuing invoices, receiving payment, export customs declarations | Legal obligation | 7 years |
| Quality control, warranty claims and dispute resolution | Legitimate interests | 3 years from delivery |
| Dropshipping fulfilment for a business customer | Performance of our contract with that customer; legitimate interests for the recipient's delivery | 2 years from delivery |
| Sending occasional news, new product specifications and lead-time alerts | Consent, or legitimate interests for existing business contacts (B2B soft opt-in) | Until you unsubscribe |
| Website security, spam prevention and performance measurement | Legitimate interests | Server logs 30 days; aggregate analytics 26 months |
| Factory visit arrangements and visa invitation letters | Consent and legitimate interests | 2 years from the visit |
3.1 Marketing communications
We send email updates about new products, specifications, seasonal lead-time deadlines and pricing only to business contacts who have asked for them or who have an existing trading relationship with us. Every message contains an unsubscribe link, and honouring it takes effect immediately. We do not send unsolicited marketing to consumer email addresses, and we do not make automated marketing calls.
3.2 Artwork, designs and confidential material
Files you send us — artwork, photographs, logos, packaging designs, colour references and customer lists — are used only to produce and deliver your order. We do not reuse, resell, publish or show them to other customers, and we do not add them to our public design library. We can sign a non-disclosure agreement before files are exchanged, and we will delete project files on written request once an order is complete and any warranty period has expired. See also our terms of service for the intellectual property position.
3.3 Automated decision-making
We do not use automated decision-making or profiling that produces legal or similarly significant effects on you. Quotations are prepared by people. Where we use design software to convert an image into a numbered canvas layout, a designer reviews and adjusts the output before it reaches you.
3.4 Payment information
Bank transfers are processed through our bank; PayPal and card payments are processed by PayPal or the relevant payment provider; Wise transfers are processed by Wise. We receive confirmation that payment cleared, together with the payer name and transaction reference. We do not store full card numbers, card security codes or online banking credentials on our systems.
4. Dropshipping: if you bought from a store we fulfil
If you ordered a paint by numbers kit from an independent online store and the parcel arrived from us, that store is the data controller for your order and we act as its processor. We use your name, delivery address and contact details for one purpose only: to deliver the parcel and to provide tracking. We do not add you to any marketing list, we do not contact you except about that delivery, and we do not sell or share your details.
Parcels are shipped blind — they carry no invoice showing what the store paid us, and no branding that identifies our company as the seller. To exercise any privacy right about such an order, contact the store you bought from; they can instruct us to delete or correct records on your behalf. You may also write to us directly at [email protected] and we will act where we are able to.
5. Who we share information with
- Freight forwarders, shipping lines, airlines and couriers (DHL, FedEx, UPS, national postal operators) — recipient name, address, telephone, parcel contents and value, as required to move and clear the goods
- Customs authorities and export control agencies in China and the destination country — consignor, consignee, description, quantity, value and origin, as legally required
- Banks and payment providers — details needed to receive and reconcile payment
- Testing laboratories and certification bodies (for EN71-3, ASTM F963, CPSIA, REACH, ISO or BSCI work) — product specifications and your company name where a report must be issued in your name; never your customer data
- Accountants, auditors and legal advisers — under professional duty of confidence
- Software and hosting providers — website hosting, email, customer relationship management, cloud storage and the WhatsApp and WeChat platforms you choose to communicate through
- Trade platforms (Alibaba, Made-in-China) — for enquiries and orders placed through them, under their own policies
We do not sell, rent or trade personal information to data brokers, advertisers or any other third party for their own marketing.
6. International transfers
We are located in the People's Republic of China, and information you provide is processed here. Where you are in the EEA, UK or Switzerland, this means your data is transferred outside your region to a country that has not been found to provide an equivalent level of protection by the European Commission. We handle that in three ways: transfers are limited to what is needed to quote, produce and ship your order; we apply standard contractual clauses or the UK International Data Transfer Addendum where the volume and sensitivity of data justify them; and we keep technical and organisational safeguards in place, described in section 7.
Data may also pass through destination countries where recipients, carriers and customs authorities are located, which is inherent to international trade. If you would prefer that certain information not be transferred, tell us before you send it — in many cases a business-only email address and a company address are sufficient for us to serve you.
7. How we protect information
- TLS encryption on the website and for email in transit
- Role-based access — only staff who need a record to do their job can see it
- Unique account credentials, strong passwords and device locking on all workstations
- Regular backups with restoration testing
- Confidentiality obligations in staff contracts, reinforced by NDAs for design and customer files
- Paper records — quotations, packing lists, inspection reports — stored in locked cabinets and shredded when the retention period ends
No system is completely secure. If a breach occurs that is likely to result in a high risk to your rights and freedoms, we will notify affected contacts without undue delay and, where we are the controller, the relevant supervisory authority within 72 hours of becoming aware.
8. Your rights
Depending on where you are located, you may have some or all of the following rights over your personal information:
- Access — receive a copy of the personal data we hold about you
- Rectification — have inaccurate or incomplete data corrected
- Erasure — have data deleted where there is no continuing legal reason to keep it
- Restriction — limit how we use your data while a dispute is resolved
- Objection — object to processing based on legitimate interests, including direct marketing, at any time and free of charge
- Portability — receive your data in a structured, commonly used, machine-readable format
- Withdraw consent — where we rely on consent, withdraw it without affecting prior processing
- Complaint — complain to your local data protection authority. In the EU that is your national supervisory authority; in the UK, the Information Commissioner's Office (ico.org.uk)
California residents (CCPA/CPRA): you have the right to know what categories and specific pieces of personal information we have collected, the sources and purposes, the categories of third parties we disclose it to, and to request deletion or correction. You have the right to opt out of any "sale" or "sharing" of personal information — we do not sell or share personal information as those terms are defined, so no opt-out is necessary. You have the right to limit use of sensitive personal information; we collect none in the ordinary course. You have the right not to be discriminated against for exercising any of these rights.
To exercise any right, email [email protected] with "Privacy request" in the subject line. We will respond within 30 days, or 45 days for California requests where an extension is needed and we tell you why. We may ask you to confirm your identity before releasing data, and we cannot delete records that tax, customs or export law requires us to retain.
9. Cookies
Cookies are small text files stored on your device. Our site uses three categories:
| Category | Purpose | Examples | Duration |
|---|---|---|---|
| Strictly necessary | Run the site, remember your cookie preferences, keep the site secure | wordpress_test_cookie, cookie-consent record | Session to 12 months |
| Analytics | Understand in aggregate which pages and guides are useful, so we can improve them | Self-hosted or privacy-configured analytics identifiers | Up to 26 months |
| Third-party embeds | Only set if you interact with an embedded item such as a map or a video | Map provider preferences | Set by the third party |
We do not use advertising or cross-site tracking cookies. Where analytics are used, IP addresses are truncated before storage and no advertising identifiers are shared. You can refuse non-essential cookies through the banner on your first visit, and you can block or delete cookies at any time in your browser settings — the site remains fully usable, including the enquiry and quotation process, with cookies disabled.
10. Third-party links
Our pages link to services we use or recommend — WhatsApp, trade platforms, freight and certification bodies, and reference articles. This policy does not cover those sites, and we are not responsible for their content or their data practices. Check their policies before submitting personal information.
11. Children
This website and our services are directed at businesses and adults. We do not knowingly collect personal information from children under 16 (or the equivalent minimum age in your jurisdiction). Although many of our products are enjoyed by children and can be produced to child-safe specifications, we do not market to them directly and we do not operate a consumer storefront here. If you believe a child has provided us with personal information, contact us and we will delete it.
12. Changes to this policy
We may update this policy when our services, tools or legal obligations change. The "last updated" date at the top of this page always reflects the current version, and material changes will be noted here with the date they take effect. If you have an active order or an open account with us, we will notify you of material changes by email.
13. Contact us
Questions about this policy, or about how we handle your information, are welcome:
- Email: [email protected] (write "Privacy" in the subject line)
- Phone / WhatsApp: +86 156 0537 8062
- Post: Art Painting by Numbers, Room 508, Building 5, No. 100 Youyi Road, Hexi District, Tianjin, China
Questions about how we handle artwork files, customer photographs uploaded for custom kits, and dropshipping recipient data are also answered in the FAQ.
Trading terms, warranty provisions and the rules on intellectual property in custom orders are set out in our terms of service. General information about our manufacturing services is on the wholesale, OEM and private label and dropshipping pages.