Privacy

KERNELSPACE STUDIO LTD, company number 17542786, trading as Kernelspace, is responsible for personal information collected through kernelspace.art.

Email kwaks@kernelspace.art or use our contact form for privacy questions or requests, or write to:

KERNELSPACE STUDIO LTD
Office 7
35–37 Ludgate Hill
London
EC4M 7JN

Information we use

Enquiries and commissions. We use your name, email, request, reference links, budget, deadline and any measurements or project details you provide to respond, prepare a quote and carry out agreed work. Our legal basis is taking steps at your request before a contract, or performing our contract.

Orders and payments. We use ordered items, contact and delivery details, agreed scope and terms, payment references, delivery updates and correspondence to supply your order, provide support and handle refunds. This is necessary to perform our contract. We retain necessary accounting records to meet legal obligations. Without required contact, payment or delivery details, we may be unable to fulfil an order.

Stock alerts. If you request an alert, we use your email, selected product, confirmation and delivery history with your consent. You must confirm your email before we send a stock notification. This is one alert for that product, not a general marketing subscription or a stock reservation. Withdraw consent using the cancellation or unsubscribe link in the email, or contact us. Withdrawal stops unsent alerts; an email already being sent cannot be recalled. It does not affect processing that was lawful before withdrawal.

Website security. We use session identifiers, request limits and security records for our legitimate interests in operating the basket, protecting forms and preventing abuse or fraud.

You supply information through forms, checkout and correspondence. Stripe also provides payment status and transaction details. If you arrange delivery to another person, we receive the recipient details you provide.

Service providers and overseas processing

Spaceship, Inc. provides hosting and its Spacemail service handles email. These services process website records and service correspondence. Spaceship describes US processing and contractual transfer provisions in its data-processing addendum and privacy notice.

Stripe processes checkout and payment information and provides relevant contact, billing, delivery and transaction details to us. Our website does not store full payment-card details. Stripe also processes information for its own fraud prevention and legal obligations. Its international processing includes the United States and India. Stripe describes its use of the UK extension to the Data Privacy Framework and, where applicable, approved contractual clauses with the UK Addendum in its privacy notice and transfer addendum.

Google Drive holds our encrypted recovery backups. Google processes information on servers around the world; we do not restrict these backups to a particular region. Google describes its UK-extension Data Privacy Framework certification and other applicable transfer arrangements in its transfer-framework information.

A delivery provider receives recipient details needed to deliver a parcel. We may disclose relevant information to professional advisers or public authorities where necessary to meet legal obligations or establish, exercise or defend claims. Contact us for information about the countries and safeguards applicable to your information.

Retention

We retain active enquiries, contracts, orders, refunds and complaints while needed to handle them. Financial and contractual records are retained according to applicable accounting obligations, unresolved disputes and legal claims. Security records are retained according to their relevance to service protection or an investigation.

Completed or declined enquiries without a linked quote are removed during routine maintenance once more than 90 days have passed since creation. That rule does not delete active enquiries or financial records.

Unconfirmed stock-alert requests expire within 24 hours; a renewed confirmation request starts a fresh 24-hour period. Confirmed requests expire 180 days after confirmation. Subscriptions, associated tokens and delivery history are removed during routine maintenance after expiry. Unsubscribed and notified records remain only until that same expiry. Separate email copies and backups follow their own retention rules.

Expired visitor sessions and baskets are cleared automatically. Encrypted recovery backups retain seven daily, four weekly and six monthly snapshots; deleted live information may remain in historical snapshots until replaced under that policy. Spacemail describes daily server backups retained for up to four weeks in its service terms.

Cookies and browser storage

• ks_public cookie: Visitor session, basket and form protection. 12 hours.
• ks_language cookie: The language you select. One year from selection.
• kernelspace.theme local storage: Your manual light or dark appearance choice. Until you select System or clear browser storage.

You can remove these through browser settings. Removing the session cookie may clear access to your basket. Stripe's hosted checkout has its own cookie information.

Your rights

Depending on the information and legal basis, you can request access, correction, deletion, restriction or a portable copy. You can object to processing based on legitimate interests and withdraw consent to stock alerts. Some records may need to be retained for legal obligations or claims. We may need proportionate information to verify a request.

Contact us using the details above if you have a concern. You can also complain to the Information Commissioner's Office.