Request 1-1

Privacy & Cookies Policy

Iona Russell Studio Ltd

Last updated: 19 June 2026 | Updated to reflect the Data (Use and Access) Act 2025

Iona Russell Studio Ltd  is committed to safeguarding your privacy. Contact us at team@ionarussell.com if you have any questions or problems regarding the use of your Personal Data and we will gladly assist you.

By using this site or our services, you consent to the Processing of your Personal Data as described in this Privacy Policy.

 

Table of Contents

    1. Definitions
    2. Data Protection Principles
    3. Your Rights Regarding Your Personal Data
    4. Data We Gather
    5. How We Use Your Personal Data
    6. Who Else Has Access to Your Personal Data
    7. How We Secure Your Data
    8. Data Protection Complaints Procedure
    9. Cookies and Other Technologies
    10. Contact Information

 

1. Definitions

    • Personal Data – any information relating to an identified or identifiable natural person.
    • Processing – any operation or set of operations performed on Personal Data.
    • Data subject – a natural person whose Personal Data is being Processed.
    • Child – a person under 16 years of age.
    • We/us – Iona Russell Studio Ltd (trading name of Iona Russell)  
    • ICO – Information Commissioner’s Office, the UK’s independent data protection regulator.

 

2. Data Protection Principles

We comply with the UK GDPR and the Data (Use and Access) Act 2025 (DUAA). We follow these data protection principles:

    1. Processing is lawful, fair and transparent. We always consider your rights before Processing Personal Data.
    2. Processing is limited to the purpose for which Personal Data was gathered.
    3. Processing is done with minimal data. We only gather and Process the minimum amount of Personal Data required.
    4. Processing is limited in time. We will not store your Personal Data for longer than needed.
    5. We do our best to ensure the accuracy of data.
    6. We do our best to ensure the integrity and confidentiality of data.

 

3. Your Rights Regarding Your Personal Data

Under UK GDPR and the DUAA, you have the following rights:

    1. Right to information – you have the right to know whether your Personal Data is being processed, what data is gathered, where it is obtained and why.
    2. Right to access – you have the right to access the data collected from/about you, including a copy of your Personal Data.
    3. Right to rectification – you have the right to request rectification or erasure of inaccurate or incomplete Personal Data.
    4. Right to erasure – in certain circumstances you can request that your Personal Data be erased from our records.
    5. Right to restrict processing – where certain conditions apply, you have the right to restrict the Processing of your Personal Data.
    6. Right to object to processing – in certain cases you have the right to object to Processing, for example in the case of direct marketing.
    7. Right to object to automated Processing – you have the right to object to automated Processing, including profiling, where it produces legal effects concerning or significantly affecting you.
    8. Right to data portability – you have the right to obtain your Personal Data in a machine-readable format or, where feasible, as a direct transfer from one Processor to another.
    9. Right to complain – you have the right to raise a data protection complaint with us and, if unresolved, to escalate to the ICO. See Section 8 for full details of our complaints procedure.
    10. Right to withdraw consent – you have the right to withdraw any consent given for Processing of your Personal Data at any time.

 

4. Data We Gather

Information you have provided us with

This may include your email address, name, billing address and other information necessary for delivering a product or service or to enhance your customer experience. We save information you provide to enable you to comment or perform other activities on the website.

Information automatically collected about you

This includes information stored by cookies and other session tools, such as your IP address and browsing/shopping history. This information is used to improve your customer experience. When you use our services or view our website content, your activities may be logged.

Information from our partners

We gather information from trusted partners who have confirmed they have legal grounds to share that information with us.

Publicly available information

We may gather information about you that is publicly available.

 

5. How We Use Your Personal Data

We use your Personal Data in order for the following purposes:

    • Provide our service to you, including registering your account, delivering products and services, communicating with you and notifying you of changes.
    • Enhance your customer experience.
    • Fulfil obligations under law or contract.

On the grounds of entering into or fulfilling contractual obligations, we Process your Personal Data for the following purposes:

    • Identify you.
    • Provide a service or send/offer you a product.
    • Communicate for sales or invoicing purposes.

On the grounds of legitimate interest, we Process your Personal Data for the following purposes:

    • Send you personalised offers from us and/or our carefully selected partners.
    • Administer and analyse our client base to improve the quality and availability of products and services.
    • Conduct questionnaires concerning client satisfaction.

 With your consent, we Process your personal data for the following purposes:

    • Send you newsletters and campaign offers from us and/or our carefully selected partners.
    • Any other purpose for which we have asked your consent.

We Process your Personal Data in order to fulfil obligation rising from law and/or use your Personal Data for options provided by law. We reserve the right to anonymise Personal Data gathered and to use any such data. We will use data outside the scope of this Policy only when it is anonymised. We save your billing information and other information gathered about you for as long as needed for accounting purposes or other obligations deriving from law.

We might process your Personal Data for additional purposes that are not mentioned here, but are compatible with the original purpose for which the data was gathered. To do this, we will ensure that:

    • the link between purposes, context and nature of Personal Data is suitable for further Processing;
    • the further Processing would not harm your interests and
    • there would be appropriate safeguard for Processing.

 

We will inform you of any further Processing and purposes.

 

6. Who Else Has Access to Your Personal Data

We do not share your Personal Data with strangers. In some cases, Personal Data is provided to trusted partners to enable us to provide our service or enhance your customer experience. 

We only work with Processing partners who can ensure an adequate level of protection for your Personal Data.

We disclose your Personal Data to third parties or public officials only when legally obliged to do so, when you have consented, or where other legal grounds exist.

 

7. How We Secure Your Data

We do our best to keep your Personal Data safe. We use secure protocols for communication and data transfer (such as HTTPS), anonymising and pseudonymising where suitable, and monitor our systems for vulnerabilities and attacks.

Whilst we cannot guarantee the security of information, we will notify the appropriate authorities of any data breaches and will notify you if there is a threat to your rights or interests. 

If you have an account with us, please keep your username and password confidential.

We do not intend to collect or knowingly collect information from children. We do not target children with our services.

 

8. Data Protection Complaints Procedure

Updated in accordance with the Data (Use and Access) Act 2025 – effective 19 June 2026.

Under the Data (Use and Access) Act 2025, you have a specific right to raise a complaint about how your Personal Data is being handled. We take all data protection complaints seriously.

How to raise a complaint

If you have a concern about how we have handled your Personal Data, please contact us in the first instance:

    1. Email: team@ionarussell.com
    2. Subject line: Data Protection Complaint
    3. Please include your name, contact details, and a description of your concern.

What happens next

    1. Once we receive your complaint, we will follow this process:
    2. Acknowledgement: We will acknowledge receipt of your complaint within 30 days of receiving it.
    3. Investigation: We will investigate your complaint thoroughly and fairly.
    4. Response: We will provide you with a written response, including the outcome of our investigation and any steps we have taken or intend to take.
    5. Resolution timescale: We aim to resolve all data protection complaints within 30 days. In complex cases, we may need longer and will keep you informed of progress.

If you remain unhappy

    1. If you are not satisfied with our response, or if we have not resolved your complaint within a reasonable timescale, you have the right to escalate directly to the Information Commissioner’s Office (ICO):
    2. Website: www.ico.org.uk
    3. Telephone: 0303 123 1113
    4. Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

The ICO is the UK’s independent data protection regulator. You can raise a concern with the ICO at any time; however, we would appreciate the opportunity to address your complaint internally before an escalation.

 

9. Cookies and Other Technologies

We use cookies and similar technologies to analyse customer behaviour, administer the website, track users’ movements and collect information about users, in order to personalise and enhance your experience with us.

A cookie is a tiny text file stored on your computer. Only we can access the cookies created by our website. You can control your cookies at the browser level. Choosing to disable cookies may hinder your use of certain functions.

We use the following types of cookies:

  • Necessary cookies – required for important features on our website such as logging in. These do not collect any personal information.
  • Functionality cookies – provide functionality that makes using our service more convenient, such as remembering your name and email address, such as when you have commented in a form so that you don’t have to re-enter this information next time when commenting.
  • Analytics cookies – used to track the use and performance of our website and services.
  • Advertising cookies – used to deliver advertisements relevant to you and limit the number of times you see an advertisement. They are usually placed on the website by advertising networks with the website operator’s permission. These cookies remember that you have visited a website, and this information is shared with other organisations such as advertisers. Often targeting or advertising cookies will be linked to site functionality provided by the other organisation.

Please note: Under the Data (Use and Access) Act 2025, certain cookies used for analytics, security, fraud detection or remembering user preferences may not require consent. However, where cookies are used for marketing or advertising, consent requirements continue to apply. We will keep our cookie practices under review and update this policy as the law develops.

You can remove cookies via your browser settings, or control some third-party cookies using platforms such as optout.aboutads.info or  youronlinechoices.com  . For more information, visit allaboutcookies.org.

We use Google Analytics to measure traffic on our website. You can review Google’s Privacy Policy here separately. To opt out of Google Analytics tracking, visit the Google Analytics opt-out page.

 

10. Contact Information

For any questions or concerns regarding this Privacy Policy or how we handle your Personal Data, please contact us:

  • Email: team@ionarussell.com
  • Business: Iona Russell Studio Ltd

 

This policy was last updated on 19 June 2026 to reflect the requirements of the Data (Use and Access) Act 2025.