Privacy policy

1. INTRODUCTION

1.1 Welcome to Castle Arts Academy privacy policy.

1.2 Castle Arts Academy respects your privacy and is committed to protecting your personal data. This privacy policy will inform you as to how we look after your personal data and tell you about your privacy rights and how the law protects you. We ask that you read this privacy policy carefully as it contains important information about what to expect when Castle Arts Academy collects personal information about you and how Castle Arts Academy will use your personal data.

1.3 Castle Arts Academy is a trading name for Creative Origins is a UK limited company, registered at Companies House, (CRN: 16141364).

1.4 This policy applies to information we collect about:

1.4.1 our members or subscribers;

1.4.2 those who sign up to Castle Arts Academy (including via social media platforms);

1.4.3 visitors to our website;

1.4.4 artists and tutors;; and

1.4.5 other users and those who enquire about our services.

2. PURPOSE OF THIS PRIVACY POLICY

2.1 This privacy policy aims to give you information on how Castle Arts Academy collects and processes your personal data when you enquire about our services or from your use of our website.

2.2 This privacy policy is not intended for children, and we do not knowingly collect data relating to children when processing personal data of our members and visitors to our site. However, where this inadvertently happens, such data will usually be limited only to that required to complete a purchase transaction and no other information will be processed about them.

3. WHO WE ARE

3.1 This privacy policy is issued on behalf of the Castle Arts Academy (see below) so when we mention "we", "us" or "our" in this privacy policy, we are referring to Castle Arts Academy.

3.2 Castle Arts Academy is a data controller in respect of data collected in running its business and is responsible for your personal data.

3.3 If you have any questions about this privacy policy or our privacy practices, please make contact in the following ways:

3.3.1 By email to: info@castlearts.com.

3.3.2 Website contact address: www.uk.castlearts.com/pages/contact-us.

3.3.3 Postal address: 1 St James Gate, Newcastle upon Tyne, NE1 4AD, United Kingdom.

3.4 You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

4. THE DATA WE COLLECT ABOUT YOU

4.1 Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

4.2 When you visit our website, enquire about our services, enrol in one of our classes, join our online community or post to our forum wall, we may collect, use, store and transfer the different kinds of personal data about you.

4.3 We also collect personal information from our artists, during telephone calls or when you contact us using our website contact page. Castle Arts Academy collects personal data via social media channels, such as Facebook, Instagram, TikTok, Pinterest and YouTube.

4.4 Don’t wish to provide us with your personal data?

This is, of course, your prerogative. However, we do need to collect your personal data to offer our services to you, and without it, we may not be able to provide you with our tutorials or give you access to the range of services available on our website. In this case, you will have limited use of our services.

The different kinds of data we may process are as follows:

· Contact Data includes first name and last name, postal address including country, email address [and telephone numbers, including mobile numbers] and social media channels including Facebook, Instagram, TikTok, Pinterest and YouTube.

· Profile Data includes purchase and user history, date of subscription (if any), source, language and time zones.

· Finance Data includes bank account, card payment information and credit reference information (where using third party payment options such as Klarna) in respect of purchases.

· Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access our website or communicate with us (please see our Cookie Policy for further information about this).

· Marketing and Communications Data includes your preferences in receiving marketing from us such as running our art competitions, tips and tricks, sending newsletters, emails, SMS and other communication preferences.

4.5 We gather this information to allow us to provide our services to you. As part of our services, we will use this information to communicate with you and to analyse our data to identify patterns, enabling us to provide targeted support and marketing to enhance your experience with us.

4.6 We also collect and use Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your Profile Data to calculate the percentage of users interested in a particular product line.

4.7 It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

5. SPECIAL CATEGORIES OF PERSONAL DATA

5.1 We do not intend to collect (and we ask that you do not disclose) any particularly sensitive data to us such as information relating to your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, genetic and biometric data and information about your health.

5.2 Occasionally, we may ask you to complete a survey which asks questions about your mental health, however we will anonymise your responses so that this information is only held at an aggregated level.

6. HOW WE USE YOUR PERSONAL DATA

6.1 We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

6.1.1 Where you are a Castle Arts Academy member, and we need to perform the contract we are about to enter into or have entered into with you.

6.1.2 Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

6.1.3 Where we need to comply with a legal or regulatory obligation.

6.1.4 Where you have consented to the processing of the personal data so that we may provide details about our services to you.

6.2 We will use your personal data to perform the following activities:

6.2.1 to register you and respond to your enquiry on our website or via the various social media channels available to contact us;

6.2.2 to provide our services to our members (including access to our online community);

6.2.3 to inform our members about conferences, events and competitions;

6.2.4 to tell you about our services (unless you have asked us not to contact you);

6.2.5 to undertake training and quality assurance to help us continuously provide the best possible service; or

6.2.6 to report, assess and learn from any feedback that we receive.

7. WHO WE MAY PROVIDE YOUR PERSONAL DATA TO

7.1 We do not generally share your personal data outside of Castle Arts Academy as we understand that this information is private. However, in limited circumstances, we may need to provide your personal data to certain third parties such as:

· our suppliers (acting as data processors or separate data controllers) who support our business and enable us to provide our services (this information will only be that which they require to deliver their products and services to us or on our behalf);

· online advertising related service providers providing social media platforms and advertising networks to deliver, tailor and measure advertising to you (including platforms such as Shopify, Meta, Amazon, Instagram, TikTok and Pinterest);

· HM Revenue & Customs, regulators and other public authorities based in the UK who require reporting of processing activities in certain circumstances;

· professional advisers including lawyers, bankers, auditors, pension providers and insurers who provide consultancy, banking, legal, pension, insurance and accounting products and services;

· service providers acting as data controllers or processors who provide website, IT, platform, system administration products and services and data analytic providers;

· providers of financial transaction and payment products and services, acting as data processors (including Klarna);

· Castle Arts Supplies Limited (see below at paragraph 7.4); and

· third parties to whom we may choose to sell, transfer or merge parts of our organisation or our assets. Alternatively, we may seek to acquire other businesses or organisations, or merge with them. If a change happens to Castle Arts Academy, then the new owners may use your personal data in the same way as set out in this privacy policy.

7.2 We require all third-party data processors to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

7.3 Where we are required to transfer your personal data to other data controllers, such as regulators as set out in paragraph 7.1, we do so in accordance with the law. Details as to how these third-party organisations process this personal data should be obtained directly from their privacy policies. Your right to object directly to any data controllers in relation to the processing of personal data remains intact.

7.4 Castle Arts Academy and Castle Arts Supplies Limited

We work closely with Castle Arts Supplies Limited, a third party we partner with to offer you art products and supplies to support your learning experience. This means that Castle Arts Supplies Limited may advertise certain products and services on our website or through our social media channels which may be of interest to you, to help you on your journey to developing your artistic talent. Such adverts will redirect you to Castle

Arts Supplies Limited’s own website (or linked social media pages) so that you may browse its products and services. Castle Arts Supplies Limited is a separate data controller and by clicking on its external links, your personal data will be processed separately and in accordance with Castle Arts Supplies Limited’s own data protection practices. For further details about how Castle Arts Supplies Limited will use your personal data, please see its privacy policy which is available at Privacy Policy – Castle Arts.

8. MARKETING

8.1 We strive to provide our members with choices regarding certain personal data uses, particularly around marketing and advertising.

8.2 Are marketing activities include reaching out to new members using Facebook ads and using our Facebook page and other social media channels.

8.3 We may use personal information of our members to form a view on what we think they may be of interest to them. However, we do not contact you with marketing communications where you have indicated to us that you do not wish us to do this.

8.4 We don’t buy-in marketing lists and won’t ever share your personal data with any company outside of Castle Arts Academy for marketing purposes without your consent.

8.5 Opting out - you can ask us to stop sending you messages by contacting us at any time, using the details contained in this privacy policy.

9. COOKIES

9.1 Cookies are text files placed on your computer to collect standard Internet log information and visitor behaviour information. The information is used to track visitor use of the website and to compile statistical reports on website activity. For further information about cookies visit www.aboutcookies.org or www.allaboutcookies.org.

9.2 We refer you to our Cookie Policy which sets out our practices in relation to our website.

10. CHANGE OF PURPOSE

10.1 We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

10.2 Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

11. INTERNATIONAL TRANSFERS

11.1 The data that we collect from you is stored on secure servers based in the UK and/or European Economic Area (“EEA”). Where your personal data is held in a destination outside the UK and/or the EEA, we have recognised safeguards in place to protect your personal data in accordance with the Data Protection Legislation. Please email us at info@castlearts.com if you have any questions about this.

12. DATA SECURITY

12.1 We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees and suppliers who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.

12.2 We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

13. DATA RETENTION

13.1 We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

13.2 To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

13.3 Where we process personal data of our members, visitors and customers, we will delete this information after a period of 6 years in accordance with our policies in relation to data retention or you otherwise indicate that you would like us to delete it. We will only retain personal data for longer if we feel that this is in our legitimate interests or if required in compliance with our statutory or regulatory obligations.

13.4 To ask Castle Arts Academy to delete your data, please see below for further information.

14. YOUR LEGAL RIGHTS

14.1 Under certain circumstances, you have rights under data protection laws in relation to your personal data. If you wish to exercise any of these rights, please contact us.

14.2 You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

14.3 We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

14.4 We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

14.5 You have the legal right:

14.5.1 To request access to your personal data (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

14.5.2 To request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

14.5.3 To request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

14.5.4 To object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms.

14.5.5 To request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in certain circumstances.

14.5.6 To request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format.

14.5.7 To withdraw consent at any time where we are relying on consent to process your personal data.

15. CONTACT US

15.1 If you have any questions in relation to this privacy policy, please contact our Data Privacy Manager by email at info@castlearts.com.