Privacy Policy
Who We Are
Charcuart CIC is a Community Interest Company registered in England and Wales. We provide arts and crafts activities and workshops for participants of all age groups, including children, young people and adults.
For the purposes of UK data protection law, Charcuart CIC is the data controller — meaning we are responsible for deciding how and why personal data about you is processed.
Data We Collect
Depending on how you interact with us, we may collect the following categories of personal data:
| Category | Examples |
|---|---|
| Identity data | First name, last name, date of birth (for age-specific activities) |
| Contact data | Email address, telephone number, postal address |
| Booking & participation data | Workshop bookings, session attendance, activity preferences |
| Payment data | Transaction records (card details are handled by Stripe — we do not store full card numbers) |
| Health & access requirements | Allergies, medical conditions, or accessibility needs disclosed for safeguarding or participant welfare |
| Parental / guardian data | Name and contact details of a parent or guardian where a participant is under 18 |
| Photography / media | Images or video taken during events (only with prior consent) |
| Marketing preferences | Whether you have opted in to receive our newsletter or event updates |
| Website usage data | IP address, browser type, pages visited, cookies (see Section 7) |
We collect only the minimum data necessary for the purpose for which it is needed (the principle of data minimisation).
How We Collect Your Data
We collect personal data through the following means:
- Our website contact form — when you submit a booking enquiry through our website
- Email or telephone — during booking discussions and ongoing event communications
- Payment processing — when you pay a deposit or balance via a Stripe payment link sent by us (card data is handled entirely by Stripe and is never seen by CharcuArt)
- In-person at workshops, events, or activities
- Social media interactions (where you contact us via our social media accounts)
- Photography and video taken during our events, only where explicit consent has been obtained
- Automatically via cookies and analytics when you browse our website
We do not purchase personal data lists or obtain your data from third parties for marketing purposes.
Why We Use Your Data
| Purpose | Data used |
|---|---|
| Processing bookings and managing participation in activities | Identity, contact, booking data |
| Processing payments for workshops and events | Identity, contact, payment data |
| Safeguarding participants, including children and vulnerable adults | Identity, health, parental/guardian data |
| Communicating about bookings, changes or cancellations | Identity, contact data |
| Sending newsletters or event updates (where you have opted in) | Identity, contact, marketing preferences |
| Promoting our activities using photographs or video | Media (only with consent) |
| Improving our website and understanding how visitors use it | Website usage data, cookies |
| Meeting our legal obligations (e.g. safeguarding records, accounting) | Identity, financial, health data |
| Responding to enquiries and complaints | Identity, contact data |
Lawful Basis for Processing
Under the UK GDPR, we must have a lawful basis for processing personal data. The bases we rely on are:
| Basis | When we use it |
|---|---|
| Contract | Processing is necessary to fulfil a booking or service you have purchased from us |
| Legitimate interests | Running and improving our activities, responding to enquiries, fraud prevention — where these interests are not overridden by your rights |
| Consent | Sending marketing communications; use of photographs/video; non-essential cookies. You may withdraw consent at any time |
| Legal obligation | Where we are required to process data to comply with law, including safeguarding duties and financial records |
| Vital interests | In an emergency to protect the life or health of a participant |
Where we rely on consent as our lawful basis, you have the right to withdraw it at any time by contacting us (see Section 12) or by using the unsubscribe link in any marketing email.
Children's Data
For participants under 18 years of age:
- We require a parent or guardian to provide their consent and contact details at the time of booking.
- We will not use a child's personal data for marketing purposes.
- We will not photograph or film a child without the explicit, written consent of a parent or guardian.
- Health and safeguarding data relating to children is stored securely and accessed only by authorised staff.
If you believe we have inadvertently collected data about a child without appropriate parental consent, please contact us immediately using the details in Section 12.
Cookies
Our website uses cookies — small text files stored on your device — to help the site function correctly and to understand how visitors use it.
| Type | Purpose | Consent required? |
|---|---|---|
| Strictly necessary | Essential for the website to function (e.g. session cookies, booking form operation) | No |
| Analytics | Help us understand how visitors use the site (e.g. Google Analytics, anonymised) | Yes |
| Marketing / social | Allow sharing of content and measurement of social media campaigns | Yes |
When you first visit our website, you will be shown a cookie banner and asked to make your choices. You can update your cookie preferences at any time through the cookie settings link in our website footer.
For more information about cookies and how to manage them, visit www.aboutcookies.org.
Sharing Your Data
We do not sell, rent or trade your personal data. We may share it in the following limited circumstances:
- Service providers: Third-party suppliers who help us operate. These act as data processors under a written contract and may only use your data as instructed by us. Our current key processors include:
- Stripe, Inc. — our payment processor. Stripe is certified to PCI DSS Level 1, the highest level of payment security certification. Stripe does not share your card details with us. Privacy policy: stripe.com/gb/privacy
- Squarespace, Inc. — our website hosting provider. Squarespace processes website usage data in connection with hosting our website, including data submitted through our contact form.
- Safeguarding authorities: Where we have a legal obligation or safeguarding duty to report concerns to social services, the police, or other statutory bodies.
- Legal compliance: Where required by law, court order, or regulatory authority.
All third-party processors are required to protect your data in line with UK GDPR requirements. Stripe is based in the United States and operates under appropriate data transfer safeguards (Standard Contractual Clauses). Squarespace is also US-based and operates under equivalent protections.
Data Retention
We retain personal data only for as long as is necessary for the purposes for which it was collected, or as required by law.
| Data type | Retention period |
|---|---|
| Booking and participation records | 3 years from the date of the last activity |
| Financial / payment records | 7 years (as required by HMRC) |
| Safeguarding records (children) | Until the child turns 25, or 7 years after last contact, whichever is later |
| Marketing consent records | Until you withdraw consent, plus 12 months for audit purposes |
| Photography / video | Until consent is withdrawn; we will then promptly remove the material |
| Website analytics data | 26 months (anonymised; aggregated only) |
At the end of the applicable retention period, data is securely deleted or anonymised.
Your Rights
Under the UK GDPR, you have the following rights in relation to your personal data:
Right of access
You may request a copy of the personal data we hold about you (a Subject Access Request).
Right to rectification
You may ask us to correct inaccurate or incomplete personal data.
Right to erasure
In certain circumstances you may ask us to delete your personal data ('the right to be forgotten').
Right to restrict processing
You may ask us to limit how we use your data while a dispute is resolved.
Right to data portability
Where processing is based on consent or contract, you may request your data in a structured, machine-readable format.
Right to object
You may object to processing based on our legitimate interests, or to direct marketing at any time.
Right to withdraw consent
Where processing is based on consent, you may withdraw it at any time without affecting previous processing.
Rights re automated decisions
We do not carry out automated decision-making or profiling that significantly affects you.
Data Security
We take appropriate technical and organisational measures to protect your personal data against accidental loss, unauthorised access, use, alteration or disclosure. These measures include:
- Secure, password-protected systems with access limited to authorised personnel only
- Payment security: All card payments are processed by Stripe, certified to PCI DSS Service Provider Level 1 — the highest level of certification in the payment industry. Card details are encrypted using AES-256 and are never transmitted to or stored by CharcuArt. We do not see, handle, or retain any full card numbers.
- Enquiry and booking data: Information submitted via our website contact form and subsequent booking communications is held securely by CharcuArt and processed only by authorised staff.
- Our website is hosted on Squarespace, which provides HTTPS encryption across all pages
- Regular review of our data handling practices
- Staff awareness of data protection responsibilities
In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours and, where required, inform affected individuals without undue delay.
Contact Us & How to Complain
If you have any questions about this Privacy Policy, wish to exercise your rights, or have a concern about how we handle your data, please contact us:
Charcuart CIC — Data Contact
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
- Website: ico.org.uk
- Helpline: 0303 123 1113
- Post: ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Privacy Policy · Version 1.2 · Last reviewed: June 2026
This document was prepared for informational purposes. If you are uncertain whether it meets all your specific legal obligations, please seek advice from a qualified data protection professional.