Privacy Policy

Introduction

Shannon Associates, Ltd. (“Shannon Associates,” “we,” “us,” or “our”) is a commercial artist representation agency. We respect your privacy and are committed to protecting the personal data we collect from visitors to our website at shannonassociates.com and related subdomains (collectively, the “Site”), as well as users of our artist portal, admin dashboard, and client portal (collectively, the “Services”). This Privacy Policy explains what information we collect, how we use and share it, and the choices available to you.

Information We Collect

Information You Provide

• Contact and inquiry forms: name, email address, phone number, company name, job title, and the content of your message when you contact us about artist availability, project inquiries, or general questions.
• Newsletter subscriptions: email address and name when you subscribe to receive updates about our artists and services.
• Portfolio submissions: name, email, website URL, social media links, and portfolio samples if you submit artwork for representation consideration.
• Account registration: email address, name, and password when you create an account on our artist portal or client portal.
• Artist portal data: biographical information, portfolio images, tags, categories, and other content uploaded by represented artists managing their profiles.
• Client portal data: saved favorites, moodboards, project briefs, and communications submitted through our client tools.

Information Collected Automatically

• Device and browser information: IP address, browser type and version, operating system, device type, screen resolution, and language preferences.
• Usage data: pages visited, time spent on pages, click patterns, referring URLs, and navigation paths through the Site.
• Cookies and similar technologies: we use cookies, web beacons, and similar tracking technologies as described in our Cookie Policy.
• Log data: server logs that record requests made to our servers, including timestamps, URLs, and response codes.

Information From Third Parties

We may receive information about you from third-party platforms if you interact with us through social media, from analytics providers, or from business partners who refer clients to us.

Legal Basis for Processing (EEA/UK Visitors)

If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data under the following legal bases as defined by the General Data Protection Regulation (GDPR) and the UK GDPR:

• Consent: where you have given clear consent for us to process your personal data for a specific purpose, such as subscribing to our newsletter or accepting non-essential cookies.
• Contractual necessity: where processing is necessary to perform a contract with you, such as managing your artist portal account or responding to a project inquiry.
• Legitimate interests: where processing is necessary for our legitimate business interests (such as improving our Site, marketing our services, and preventing fraud), provided those interests are not overridden by your rights.
• Legal obligation: where processing is necessary to comply with a legal obligation to which we are subject.

How We Use Your Information

• Respond to inquiries about artist availability and project opportunities.
• Connect potential clients with represented artists relevant to their projects.
• Process and evaluate portfolio submissions from prospective artists.
• Manage artist portal accounts and facilitate portfolio management.
• Manage client portal accounts, saved favorites, moodboards, and project briefs.
• Send newsletters and marketing communications (with your consent, where required).
• Improve, personalize, and optimize our Site and Services.
• Analyze usage trends and Site performance through aggregated analytics.
• Detect, prevent, and address security issues, fraud, and technical problems.
• Comply with legal obligations and enforce our terms of service.

Information Sharing and Disclosure

We do not sell, rent, or trade your personal information. We may share your information in the following circumstances:

• With our represented artists: when you submit a project inquiry or express interest in working with a specific artist, we may share relevant details with that artist to facilitate the engagement.
• Service providers: we work with trusted third-party providers who assist us in operating the Site and Services, including cloud hosting (Amazon Web Services), content delivery (Amazon CloudFront), email delivery, and analytics. These providers are contractually obligated to protect your data and use it only for the services they provide to us.
• Legal requirements: we may disclose your information if required to do so by law, regulation, legal process, or governmental request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business transfers: in the event of a merger, acquisition, or sale of all or a portion of our assets, your personal data may be transferred as part of that transaction. We will notify you via email or a prominent notice on our Site of any change in ownership or use of your personal data.
• With your consent: we may share your information for other purposes when you have given us explicit consent to do so.

Third-Party Services

Our Site and Services use the following third-party services that may collect data as described in their own privacy policies:

• Amazon Web Services (AWS): cloud infrastructure, including hosting, storage (S3), content delivery (CloudFront), and application services (App Runner). Data is processed in the US East (N. Virginia) region.
• MongoDB Atlas: cloud database service used to store site data.
• Google Fonts: web fonts loaded from Google servers, which may log your IP address in accordance with Google's privacy policy.

International Data Transfers

Shannon Associates is based in the United States. If you access our Site from outside the United States, your information will be transferred to, stored, and processed in the United States and potentially other countries where our service providers operate. These countries may have different data protection laws than your country of residence. Where required by applicable law (including GDPR and UK GDPR), we ensure appropriate safeguards are in place for such transfers, such as Standard Contractual Clauses approved by the European Commission or reliance on the EU-U.S. Data Privacy Framework. By using our Site and Services, you consent to the transfer of your information as described in this policy.

Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. Contact form submissions and inquiry data are retained for up to three (3) years. Newsletter subscriber data is retained until you unsubscribe. Artist portal and client portal account data is retained for the duration of the account relationship and for a reasonable period thereafter. Anonymized or aggregated data that can no longer identify you may be retained indefinitely for analytics and improvement purposes.

Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include encryption of data in transit (TLS/SSL), secure authentication with hashed passwords and token-based access, access controls limiting data access to authorized personnel, and regular security assessments. However, no method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

Your Rights

All Users

Regardless of your location, you may:

• Opt out of marketing communications by using the unsubscribe link in any email or by contacting us.
• Request access to the personal data we hold about you.
• Request correction of inaccurate personal data.
• Request deletion of your personal data, subject to legal obligations.

EEA, UK, and Swiss Residents (GDPR / UK GDPR)

Under the GDPR and UK GDPR, you have the following additional rights:

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: request correction of inaccurate or incomplete data.
• Right to erasure: request deletion of your data where there is no compelling reason for continued processing.
• Right to restrict processing: request that we limit how we use your data.
• Right to data portability: receive your data in a structured, commonly used, machine-readable format.
• Right to object: object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: withdraw consent at any time where processing is based on consent.
• Right to lodge a complaint: file a complaint with your local data protection authority.

California Residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) provides you with the following rights:

• Right to know: request disclosure of the categories and specific pieces of personal information we have collected, the sources, the business purposes, and the third parties with whom we share it.
• Right to delete: request deletion of personal information we have collected from you.
• Right to correct: request correction of inaccurate personal information.
• Right to opt out of sale or sharing: we do not sell or share your personal information for cross-context behavioral advertising. If this changes, we will provide an opt-out mechanism.
• Right to limit use of sensitive personal information: where applicable.
• Right to non-discrimination: we will not discriminate against you for exercising any of your CCPA/CPRA rights.

To exercise any of these rights, contact us at info@shannonassociates.com. We will respond within the timeframes required by applicable law (generally 30 days for GDPR, 45 days for CCPA/CPRA). We may need to verify your identity before fulfilling your request.

Other U.S. State Privacy Laws

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), and other states with comprehensive privacy laws may have similar rights to access, correct, delete, and opt out of certain processing of their personal data. Please contact us to exercise your rights under your state's applicable privacy law.

Children's Privacy

Our Site and Services are not directed to children under the age of 16 (or 13 in jurisdictions where that is the applicable age threshold). We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at info@shannonassociates.com and we will promptly delete such information.

Do Not Track Signals

Some browsers offer a “Do Not Track” (DNT) setting. There is currently no industry standard for how websites should respond to DNT signals. We honor the Global Privacy Control (GPC) signal where required by applicable law. For other DNT mechanisms, our Site does not currently alter its behavior in response to DNT signals, but you may manage cookies and tracking through the methods described in our Cookie Policy.

Third-Party Links

Our Site may contain links to third-party websites, including artist websites and social media platforms. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party sites you visit.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the “Last updated” date at the top of this page and, where required by law, notify you by email or through a prominent notice on our Site. Your continued use of the Site and Services after any changes constitutes your acceptance of the updated policy.

Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

If you are located in the EEA or UK and are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority.