Last updated: 01/08/2026

1. Controller and contact details

Stanley Millz, trading as addictive assets, is the controller responsible for the personal information described in this notice. Contact: Stanley Millz via email: teammillz@proton.me, 

This notice explains how we collect, use, disclose, retain and protect personal information when you visit stanleymillz.com, buy or enquire about artwork, register or transfer a digital COA, join our mailing list, contact us, enter a promotion, attend an event or otherwise interact with us.

2. Information we collect

Depending on the interaction, we may collect:

• identity and contact details, including name, billing/delivery address, email, telephone number and social-media handle;

• order, payment status, transaction, refund, delivery and customs information; payment providers process full payment-card details;

• enquiry, commission brief, correspondence, review and customer-service records;

• artwork, edition, COA, NFC record, provenance and ownership-transfer information;

• account credentials and preferences;

• newsletter choices and records of consent, objection or unsubscribe;

• technical and usage data, including IP address, device/browser information, pages viewed, referral information, cookie identifiers and approximate location; and

• information required to prevent fraud, enforce rights, comply with tax/accounting duties or respond to lawful requests.

We normally receive information from you, your device, our Site and service providers. We may also receive delivery or payment-status information from payment providers and couriers, and COA transfer information from a previous owner where a legitimate provenance-transfer process is used. If information comes from another source, we will provide required privacy information within the applicable period unless an exception applies.

3. How and why we use your information

We only use personal information when we have a lawful reason to do so. The information we use, the reason for using it and the lawful basis will depend on how you interact with us.

Processing and delivering orders

We use your name, contact details, billing and delivery details, order information, payment status and relevant correspondence to accept and manage your order, confirm payment, arrange delivery, deal with returns and provide customer support.

Our lawful basis is that this processing is necessary to enter into or perform our contract with you. We may also process some order information to comply with consumer, tax, accounting or other legal obligations.

Responding to enquiries

We use the contact details and information contained in your message to answer questions, provide requested information, prepare quotes and discuss a possible purchase or commission.

Our lawful basis is taking steps at your request before entering into a contract where your enquiry concerns a possible order. For other enquiries, we rely on our legitimate interests in communicating with customers, collectors and other people interested in our work.

Managing commissions and personalised work

We use your contact details, commission brief, reference materials, measurements, requested wording or imagery, approvals, correspondence, payment status and delivery information to quote for, create and supply commissioned or personalised work.

Our lawful basis is taking steps at your request before entering into a contract and performing our contract with you. We may also rely on our legitimate interests in keeping an accurate record of the agreed brief, approvals and project history.

Certificates of authenticity, NFC records and provenance

Where an artwork includes a physical or digital certificate of authenticity, NFC tag or provenance record, we use relevant contact details, artwork details, edition information, record identifiers, authentication status and ownership-transfer information to create, maintain, verify and, where offered, transfer that record.

Our lawful basis is performing our contract with you and our legitimate interests in maintaining reliable provenance, protecting collectors, authenticating genuine works and preventing fraudulent duplication or misrepresentation. A core non-personal record about the artwork, edition and authentication history may be retained even if personal ownership details are later removed or restricted, where necessary for those purposes.

Taking payments and preventing fraud

We use order information, transaction references, payment status, delivery details, account information and relevant technical or security data to take payment, process refunds, confirm transactions and identify or prevent fraud. Our payment provider processes full payment-card details; we do not normally receive or store the complete card number or security code.

Our lawful basis is performing our contract with you, complying with legal obligations and our legitimate interests in protecting customers, the business and the authenticity system from fraud and misuse.

Meeting legal, tax, accounting and customs requirements

We use identity, order, transaction, refund, delivery, customs and correspondence records to keep business and tax records, deal with customs or sanctions requirements, respond to regulators or law-enforcement authorities and meet other legal duties.

Our lawful basis is compliance with a legal obligation. Where a legal obligation does not apply, we may rely on our legitimate interests in keeping accurate business records and demonstrating compliance.

Operating and protecting the Site

We use account details, IP address, device and browser information, security logs and information about how the Site is used to provide essential website functions, keep accounts and authentication records secure, diagnose technical problems, prevent attacks and enforce our rights.

Our lawful basis is our legitimate interests in operating a reliable and secure website and protecting our business and users. We may also process information to comply with a legal obligation. Necessary cookies and similar technologies are explained in the Cookie Policy.

Sending marketing

We use your name, email address or other contact details, marketing preferences, consent record and limited engagement information to send newsletters, new-release announcements and other marketing that you have requested or that we are otherwise permitted to send.

Our lawful basis is your consent or, for our own similar products and only where the legal requirements are met, the limited customer “soft opt-in”. You can object or unsubscribe at any time as explained in section 4.

Analytics and improving the Site

If you accept analytics cookies, we use cookie identifiers, device and browser information, approximate location, referral information and details of pages viewed or actions taken to understand how the Site performs and how visitors use it.

Where consent is required for these technologies or the resulting processing, our lawful basis is consent. You can change your choice through the Site's cookie settings.

Advertising and campaign measurement

If you accept advertising cookies, we use cookie identifiers, device information, campaign information and website activity to measure campaigns and, where applicable, personalise advertising.

Where consent is required, our lawful basis is consent. You can withdraw that consent through the Site's cookie settings.

Reviews, competitions, promotions and events

We use the contact details, entry information, review content, event details and prize-delivery information you provide to administer the activity, contact participants or winners and, where separately agreed, publish a review, name, social-media handle, photograph or other contribution.

Our lawful basis may be performance of the relevant promotion terms, our legitimate interests in running and promoting the business, or consent where publication or another use is optional.

Protecting legal rights and managing the business

We may use relevant account, transaction, artwork, contact, technical and correspondence information to obtain advice, establish, exercise or defend legal claims, resolve disputes, recover debts, enforce agreements or manage a sale, restructuring or transfer of the business.

Our lawful basis is our legitimate interests in protecting and managing the business and its legal rights, or compliance with a legal obligation where one applies.

When you must provide information

Information marked as required at checkout or during a commission is needed so that we can enter into and perform the contract or comply with legal obligations. If you do not provide it, we may be unable to accept, process or fulfil the order. Any optional information will be identified as such.

Legitimate interests and consent

Before relying on legitimate interests, we consider whether the processing is necessary and balance our interests against your rights and reasonable expectations. You may object to processing based on legitimate interests as explained in section 11.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.

4. Marketing

We send marketing emails, texts or direct messages to individuals only where we have valid consent or the law permits the customer soft opt-in for our own similar products and we offered an opt-out when collecting the details. Every electronic marketing message will identify us and provide a simple way to unsubscribe. We keep a minimal suppression record so we can respect opt-outs.

Newsletter consent is separate from acceptance of Terms and is not a condition of purchase. Boxes are not pre-ticked. You can unsubscribe using the link in a message or by contacting teammillz@proton.me

5. Cookies and similar technologies

We use necessary technologies to operate the Site and, where you choose, optional analytics, functionality or advertising technologies. Non-essential technologies are not activated until valid consent is obtained where consent is required. See the Cookie Policy and use the permanent “Cookie settings” link to change your choices.

6. Sharing information

We share information only as reasonably necessary with:

• website, hosting and commerce providers, including wix and others

• payment providers

• couriers, fulfilment, packaging and customs providers, including royal mail and other couriers working with and alongside royal mail.

• email, CRM and customer-support providers.

• analytics and advertising providers where you have consented.

• COA, NFC, storage, security and authentication providers, including SECUREDVERIFY.COM, CLOUDFLARE

• professional advisers such as accountants, insurers, solicitors and IT/security advisers.

• regulators, courts, law enforcement, tax authorities or other bodies where disclosure is legally required or necessary to protect rights; and a buyer or successor if the business or relevant assets are sold, subject to appropriate confidentiality and data-protection measures.

Our service providers may act as processors under written contracts or, in some cases, as independent controllers under their own notices. We do not sell personal information.

7. International transfers

Some providers may process information outside the UK. Where a restricted transfer occurs, we use a lawful mechanism such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved contractual clauses, or another permitted safeguard, and carry out any required risk assessment. Contact us for further information about the relevant safeguard.

8. Retention

We keep information only as long as reasonably necessary for the relevant purpose, including legal, accounting, fraud-prevention and claims requirements. Our intended starting periods are:

• orders, invoices, payments and tax records: SIX YEARS AFTER THE RELEVANT FINANCIAL YEAR.

• customer service and order correspondence: TWO YEARS WHERE CONTRACTUALLY MATERIAL.

• unsuccessful general or commission enquiries: 12–24 MONTHS

• marketing records: until consent is withdrawn or after 36 MONTHS of inactivity, with a minimal suppression record retained to honor opt-outs;

• cookie choices and technical logs: for the periods stated in the Cookie Policy or security schedule; and

• artwork and COA records: core non-personal provenance may be kept for the life of the work; personal owner/contact data will be separated, minimised, deleted or anonymity when no longer necessary.

We may retain information longer where a complaint, dispute, investigation or legal requirement makes that necessary. Replace the periods above with the periods actually followed by the business.

9. Security

We use proportionate technical and organisational measures to protect information, including access controls, authentication, updates, backups, secure providers and staff/contractor confidentiality where appropriate. No online system is completely secure. If a personal-data breach occurs, we will assess it and notify the ICO and affected people where law requires.

10. Your rights

Depending on the circumstances, you may have rights to:

• be informed about processing;

• access personal information and receive a copy;

• correct inaccurate or incomplete information;

• request erasure;

• restrict processing;

• receive certain information in a portable format;

• object to processing based on legitimate interests and object at any time to direct marketing;

• withdraw consent at any time; and

• obtain safeguards relating to solely automated decisions with legal or similarly significant effects.

These rights are not absolute. To exercise them, contact [EMAIL]. We may request proportionate proof of identity. We normally respond within one month, subject to lawful extensions. We do not charge a fee unless a request is manifestly unfounded or excessive and law permits a fee or refusal.

11. Automated decision-making

We do not currently use personal information to make solely automated decisions that have legal or similarly significant effects.

12. Children

The Site and products are not directed to children under 13, and purchases must be made by an adult. If we learn that we collected a child's information without an appropriate lawful basis or authorization, we will take steps to delete it.

13. Changes to this notice

We review this notice regularly and will update the date above. If we plan a new use that is materially different, we will update the notice and bring the change to affected people before starting that processing where required.

​

​