Privacy Policy

Introduction
This privacy policy explains the types of personal data we collect from students when they enroll and/or attend a course. It explains how and why we use it, who we disclose it to, and how we protect your privacy. Changes and updates to this policy may be made from time to time and I suggest that you re-visit this webpage to check and ensure you are still happy.

Please get in touch with me (details here>) if there is anything about your personal data that
you wish to discuss.

Which personal data does Creative Art Courses collect
I collect personal data from you when you book and attend a course, contact me, or use my website.
The term “personal data” means information that relates to you and allows me to identify you either directly or in combination with other information that I may hold.

Your personal data may include things like your name, contact details, address, receipt
booking reference number, etc.

Using my website

1. Google Analytics collects technical information about your internet connection and browser as well as the country and telephone code where your computer is located, the web pages viewed during your visit, amongst other technical data. I am able to view this on the Google website and it gives me insights into how my website is being accessed, but does not give me any personal data about you as an individual.  You can read their terms of Terms of Service here>>
2. Woocommerce by Automattic, the world’s most used ecommerce platform is installed to process your course bookings.  Automattic requires your personal data to complete the transaction.  Your personal information is securely stored on my computer for the purposes of completing your purchase and administrating my courses. You can read their Privacy Policy here>> which explains how they use your data.
3. PayPal, the most widely used, trusted and secure payment gateway is used to securely process your payment. Your personal information is securely stored on my computer for the purposes of completing your purchase and administrating my courses.  I do not retain credit card details. You can read their Privacy Policy here>> 
4. Themify, the company that provides the design and look of the site collects statistics based on how users use my website.  This is anonymised information and does not contain personal facts about you.  You can read their Privacy Policy here>> 
5. Website-based Contact forms or ‘Leave a Reply’ via webpages
   • Your name, contact details and query will be recorded when you fill out a Contact form or ‘Leave a Reply’ at the bottom of webpages. Do not use these if you do not want this information retained by my website as it is automatically recorded by WordPress.
6. We will use your social media username, if you interact with us through social media platforms, to enable us to respond to your comments, questions or feedback.

Making a booking

• When you make a booking for a course I record your personal data via the Registration form I ask you to complete which includes information such as your name, address, postcode, telephone number, email address, children’s ages, year group, health and SEN information, etc.
• When you make a payment for a course via PayPal they will collect your personal data. Some of this is shared with me such as your name, contact details, email address, etc, but other information such as credit card details are not stored on my systems.
• I collect children’s names, gender and ages when parents/carers book children on classes as part of the booking procedure.

Attending a course, class or workshop

• I make copies of your personal data as part of the class registration form I use to register students’ attendance. This includes information such as name, telephone number, post code, email address, children’s ages, year group, health and SEN information, etc.

Contact after attending a course, class or workshop

• I will hold onto your comments, feedback and course reviews.
• I will hold onto your social media username, so long as you choose to interact with me via those platforms.
  • Please read Facebooks, Pinterest, Twitter, Instagram and Meetup’s Privacy policies to understand how they use and manage your personal data.

Special Category Data
At times, especially when offering children’s classes, I may collect information that could reveal details of physical or mental health (including SEND), religious beliefs, etc. This information is considered “sensitive personal data” under GDPR and other data protection laws.
I only collect this information as it is necessary in order for me to deliver our classes to a high professional standard.

Examples:

• Information about specific dietary requirements could indicate specific religious beliefs, racial or ethnic origin, etc.
• Information regarding SEND, or when you ask for special assistance when attending a course could reveal information about you, or your child’s health and wellbeing

By providing any sensitive personal data you explicitly agree that we may collect and use it in order to provide courses, and in accordance with this Privacy Policy. However, it is important to note that, if you do not allow me to process any sensitive personal data, it may mean I am unable to deliver my courses to my usual high standards. Please be aware that in such circumstances, this may result in you not being accepted onto a course, or if you are unhappy with your experience when dealing with Creative Art Courses, you will not be entitled to cancel or obtain a refund.

I do not share any sensitive personal data with anyone, other than your course tutor.

Explaining the legal basis
The law on data protection sets out a number of different reasons for which a company may collect and process your personal data, including:

• Consent
  In specific situations, a company can collect and process your data with your consent. For example, when you tick a box to receive email newsletters. When collecting your personal data, companies can always make clear to you which data is necessary in connection with a particular service.
•  Contractual obligations
  In certain circumstances, companies need your personal data to comply with their contractual obligations. For example, if you book a course, a company will collect your address details in order to send you booking information.
• Legal compliance
  If the law requires a company to, they may need to collect and process your data. For example, a company can pass on details of people involved in fraud or other criminal activity to law enforcement. A company may also have to pass data to regulatory or governing bodies.
• Legitimate interest
  In specific situations, a company may require your data to pursue their legitimate interests in a way which might reasonably be expected as part of running their business and which does not materially impact your rights, freedom or interests. For example, a company will use your booking history to send you or make available personalised offers. A company may also combine the browsing history of many customers to identify trends and/or develop new products/services. A company will also use your address details to send you direct marketing information by post, telling you about products and services that they think might interest you

How and why I use your personal data

I want to ensure my students have the very best experience.

I use your data to ensure you have a personalized experience and the best way to achieve this is to get a broad picture of who you are by combining the different data we have about you. The data privacy law allows me to do this as part of my legitimate interest in getting to know my students and ensure I provide the very best quality courses.

You have a right not to share your personal data, but please be aware that if you choose not to share your personal data with us, or refuse certain contact permissions, I might not be able to provide the high quality of course and experience you expect from me.

Outlined below is how I use your personal data and why:

• To manage your booking and make arrangements for you
• When you book a course I use your information to provide my services and fulfil our contractual obligations.
  • For example to confirm your booking, email course reminders and post course summaries.
• To communicate with you & manage our relationship.
• I will need to contact you by email for administrative or operational reasons.
  • For example to send you confirmation of your booking and payments, to inform you about a specific aspect of the course you have enquired about or booked.
  • I may also use your personal data after you have sent us a request, filled in a web-contact form through my website or contacted me on social media.
  • In order to manage my relationship with you as my customer and to improve my services and experiences for you I will use the communications you exchange with us and the feedback you may provide.
• To personalise & improve customer experience.
• I may use personal data to tailor our courses to your needs and preferences and to provide you with a personalised customer experience.
  • For example, if you inform me about a special need you may have so I can provide a special piece of equipment to support your full participation. I will do this as part of my legitimate business interests.
  • I may also collect information, via Google Analytics, on how you use my website, which pages of my website you visit most, which destinations and products you search for and what products you book, in order to understand what you like. I may use this information to tailor the content and offers that you see on my website. 
• When I process your personal data for my legitimate interests, I will consider and balance any potential impact on you and your rights under data protection and any her relevant law. My legitimate business interests do not automatically override your interests – I will not use your personal data for activities where my interests are overridden by the impact on you (unless I have your consent or are otherwise required or permitted to by law).
• You can also choose to opt out from receiving marketing communications at any time, by clicking on the relevant unsubscribe link at the bottom of any marketing email you may receive from me.
• If you prefer, you can also telephone or email me and notify me of your preference to not receive marketing communications. My contact details are available on the ‘Contact me’ page of my website.
• Most importantly, I do not share your contact details and other personal data to any other organisations or businesses.

To improve my courses and quality of customer care, fulfil my administrative purposes and protect my business interests;

• I will use your information for the following business purposes which include accounting, billing and audit, safety, security and legal purposes, statistical and marketing analysis, customer feedback requests, systems testing, maintenance and development.
• To comply with my legal obligations
  • I may use your data to send you communications required by law such as updates to our Privacy Policy or to comply with any legal obligation to provide data to police.
• To respond to your queries, refund requests and concerns.
  • Handling the information you have sent to me enables me to respond. I may also keep a record of these communications to inform any other future contact I have with you and to demonstrate how I communicated throughout. I do this on the basis of my contractual obligations to you, my legal obligations and my legitimate interests in providing the best service, and understanding how I can improve my customer care and courses based on your experience.
• To protect my business and your account from fraud and other illegal activities
  • This includes using your personal data to maintain, update and safeguard your account. I may also monitor your browsing activity with me to quickly identify and resolve any problems and protect the integrity of my website.
  • This is all done as part of my legitimate interest.
  • For example, by checking your password when you login and using
  • automated monitoring of IP addresses to identify possible fraudulent log-ins from unexpected locations.
  • To develop, test and improve our systems
  • I’ll do this on the basis of my legitimate business interests. For example, I may record your browser’s Session ID to help me understand more when you leave online feedback about any problems you’re having.
• To send you survey and feedback requests to help improve my courses and customer care.
  • These messages will not include any promotional content and do not require prior consent when sent by email or text message. I have a legitimate interest to do so as this helps make my courses more relevant to you.
• To administer any prize draws or competitions
  • I will use your data to contact you about prize draws or competitions which you enter, based on your consent given at the time of entering.
• To inform our business decisions
  • I may combine data captured within my computer and paper-based systems with that from third parties and data from publicly-available lists. I’ll do this on the basis of my legitimate business interest. For example, by combining this data, this will help me personalise your experience and decide which content to share with you. I may also use anonymised data from customer purchase histories to identify trends, create a better understanding of our customers and improve the quality of my marketing activities.

Requesting access to your personal data
I respect your right to control your data. Your rights include:

Right of access – you have the right to access and obtain a copy of the personal data that I hold about you. I will only charge you for making such an access request where I feel your request is unjustified or excessive.

Right to rectification – you have the right to request that I correct any inaccuracies in the personal data stored about you.

Right to erasure – in certain circumstances, you have the right to request that I erase your personal data. For example, you may exercise this right in the following circumstances:

• your personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed by me
• where you withdraw consent and no other legal ground permits the processing
• where you object to the processing and there are no overriding legitimate grounds for the processing
• your personal data have been unlawfully processed
• your personal data must be erased for compliance with a legal obligation

Where I store your personal data for statistical purposes, I may not be able to comply with such a request where it would likely impair such statistical purposes or where I require your personal data for compliance with a legal obligation or in connection with legal proceedings.

Right to restriction – you have the right to restrict my processing of your personal data where any of the following circumstances apply:

• where you feel that the personal data which I hold about you are not accurate.
  This restriction will be in place for a period to enable me to verify the accuracy of your personal data
• where the processing is unlawful and you do not want your personal data be erased and request the restriction of its use instead
• where I no longer need to process your personal data (e.g. any of the purposes outlined above have been completed or expire), but I require it in connection with legal proceedings
• where you have objected to my processing of your personal data pending the verification of whether or not my legitimate business interests override your interests, rights and freedoms.

Where you exercise your right to restrict my processing of your personal data, I will only continue to process it with your consent or in connection with legal proceedings or for the protection of the rights of other people or for reasons of important public interest.

Right to data portability – you have a right to receive and transfer the personal data that you provide to us in a structured, commonly used and machine-readable format where I process your personal data on the legal bases of: a) your consent; or b) where it is necessary to perform my contract with you. Where you make such a request, I will directly transfer your personal data on your behalf to another controller of your choice (where it is feasible for me to do so).

Right to withdraw consent – you have a right to withdraw your consent, at any time, to my processing of your personal data which is based on your consent. Where you exercise this right, our processing of your personal data prior to your withdrawal of consent will remain valid.

Right to object to processing – In certain circumstances, you have a right to object to my processing of your personal data where I process it on the legal bases of my legitimate business interest or your consent to marketing. I may not be able to comply with such a request where I can demonstrate that there are compelling legitimate grounds for me to process your personal data which override your interests, rights and freedoms or where the processing of your personal data is required for compliance with a legal obligation or in connection with legal proceedings.

If you would like to find out what personal data I hold about you (personal data access request) email me and put ‘Data access request’ in the subject line. Please include the following information

• Full name
• Description of what data you would like to know about
• Email addresses used when booking a course
• Attach a copy of a current valid photo ID (passport or driving licence)

From the date that I receive the information that I have asked for, I have one month to process your request. If the request is complex or numerous I may require an additional two months and will contact you to explain why the extension is necessary within the first month of your request. If you have questions in relation to your personal data, please contact me via email.

How I protect your personal data
I am committed to taking appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing and against accidental loss,  destruction or damage to personal data. When you provide your personal data through our website, this information is transmitted across the internet securely using high-grade encryption – SSL encryption.

The information that you provide to me will be held securely in my computer and paper based filing systems, which are located on my studio premises or my office within my
personal residence.

How long will I keep your personal data?
Whenever I collect or process your personal data, I will only keep it for as long as necessary for the purpose which it was collected. At the end of that period your data will either be deleted or anonymised, for example by aggregation with other data – so it can be used in a non-identifiable way for statistical analysis or business planning.

Cookies or other tracking technologies
My website uses cookies to ensure you have the best experience possible while using my site.  The blue GDPR banner at the bottom of the screen allows you to agree or disallow cookies to collect your data.  However, the information gathered via cookies enables me to effectively run my business and improve the service I offer you.  Anonymised information is gathered by 3rd parties such as Google Analytics, Woocommerce and PayPal by way of supporting and improving their service to me and my customers.  

Sharing your personal data
The only circumstances where I will share your personal data are as follows;

• When it is required by the law of any jurisdiction to which Creative Art Courses is subject to.
• Through the Social media platforms we use and you choose to access, your personal data will be accessible to them and each have their own Privacy Policy which you should read.

Contacting the Regulator
If you feel that your data has not been handled correctly, or you are unhappy with my response to any requests you have made to me regarding the use of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office.

You can contact them by calling 0303 123 1113.Or go online to www.ico.org.uk/concerns (opens in a new window; please note I can’t be responsible for the content of external websites)

If you are based outside the UK, you have the right to lodge your complaint with the relevant data protection regulator in your country of residence.

Updates to our Privacy Policy
I may make changes to this Privacy Policy from time to time, including as part of the new European data protection legislation which will start to apply on 25 May 2018 (the “General Data Protection Regulation”) – I will update the Privacy Policy and will publish any new version of this Policy on my website.

Dated: 25th May 2018
Updated: 16th August 2020