Privacy Policy - Creative Collective Art Classes
Last updated: 03/07/26
This policy explains how Creative Collective Art Classes ("we", "us", "our") collects, uses, stores and protects your personal information, and the rights you have over it. It applies whenever you enquire about, book or attend one of our art courses, or otherwise get in touch with us.
We are committed to protecting your privacy and handling your data openly and lawfully under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
Creative Collective Art Class is a business run by Carole Markham Mullett, based in Newport Pagnell.
For anything to do with your personal data, you can reach us at:
Email: hello@creativecollectiveartclass.com
Phone: 07727 098300
For the purposes of data protection law, we are the "data controller" — meaning we decide how and why your personal data is used.
We are registered with the Information Commissioner's Office (ICO).
2. The personal data we collect
Depending on how you interact with us, we may collect:
Your contact details — name, email address, telephone/mobile number.
Your enquiry details — the course, session time or dates you're interested in, and anything you tell us in messages, comments or on our enquiry forms.
Booking and attendance information — which course and session you've booked, your attendance, and any relevant notes to help us support you in class (for example, accessibility needs you choose to share with us).
Payment information — records that your course fee has been paid. Card payments are handled by our payment provider; we do not store your full card details ourselves.
How you found us — for example, whether you responded to one of our social media adverts, so we can understand what's working.
We only ask for what we need to answer your enquiry and run your course.
3. How we collect your data
We collect personal data when you:
respond to one of our adverts or lead forms on Facebook or Instagram;
contact us by phone, text, email, our website or social media;
book or pay for a course;
attend one of our classes.
4. Why we use your data, and our lawful basis
The law requires us to have a valid reason ("lawful basis") for using your personal data. We rely on the following:
To respond to your enquiry and send you the course details you asked for. Lawful basis: your consent, and/or our legitimate interest in replying to people who have contacted us.
To manage your booking, take payment, and deliver your course. Lawful basis: performance of a contract with you.
To send you information about our courses, offers and news (only where you've agreed to hear from us, or you're an existing customer and it relates to similar classes). Lawful basis: your consent, or our legitimate interest in marketing to existing customers, in line with electronic marketing rules (PECR).
To keep proper business and accounting records. Lawful basis: our legal obligation (for example, tax and accounting rules).
To understand and improve our marketing (for example, seeing which adverts lead to enquiries). Lawful basis: our legitimate interest in running the business effectively.
Where we rely on consent, you can withdraw it at any time (see section 9).
5. Marketing communications and your choices
If you've asked us to, or you're an existing customer, we may contact you by phone, text or email about our courses.
You are always in control. You can ask us to stop marketing to you at any time by replying "STOP" to a text, clicking "unsubscribe" in an email, or simply emailing or telling us. We'll action your request promptly. Even if you opt out of marketing, we may still need to contact you about a course you've booked.
6. Automated tools and AI assistance
To run a small business efficiently, we use reputable third-party software to help us organise our contacts and manage our communications with you. This includes customer relationship management (CRM) software and AI-assisted tools that help us draft, organise and keep track of messages.
We want to be transparent about this, so please note:
These tools act on our instructions as our "processors", under contracts that require them to keep your data secure and use it only as we direct.
We do not use these tools to make decisions about you that have legal or similarly significant effects without human involvement. A person (us) reviews communications before they are sent to you.
We only share the minimum personal data necessary for these tools to do their job.
7. Who we share your data with
We do not sell your personal data, and we never will. We share it only with trusted service providers who help us run the business, including:
our CRM provider (currently HubSpot), which stores our contact records;
the social media advertising platforms we use (Meta — Facebook and Instagram and Whatsapp), through which you may have submitted your details;
the AI-assisted tools we use to help manage and draft our communications;
our email and messaging providers;
our payment provider;
our accountant or bookkeeper, where needed for tax and accounting.
We may also disclose information if we're required to do so by law.
International transfers. Some of these providers are based outside the UK (for example, in the United States). Where your data is transferred outside the UK, we take steps to ensure it is protected by appropriate safeguards — such as a UK adequacy decision (including the UK Extension to the EU–US Data Privacy Framework) or the ICO's International Data Transfer Agreement / Addendum.
8. How long we keep your data
We keep your personal data only for as long as we need it:
Enquiries that don't lead to a booking: up to 24 months, so we can follow up on courses you were interested in, after which we delete or anonymise your details.
Customers and course bookings: for the duration of our relationship and for as long as afterwards as needed to support you and meet our legal obligations.
Financial and accounting records: for 7 years, as required by tax law.
When we no longer need your data, we delete or securely destroy it.
9. Your rights
Under data protection law, you have the right to:
Be informed about how we use your data (this policy).
Access the personal data we hold about you.
Rectification — have inaccurate data corrected.
Erasure — ask us to delete your data in certain circumstances.
Restrict or object to certain uses of your data, including direct marketing.
Data portability — receive your data in a reusable format.
Withdraw consent at any time, where we rely on it.
To exercise any of these rights, contact us using the details in section 1. We'll respond within one month. There's normally no charge.
10. How we keep your data secure
We take reasonable steps to protect your personal data, including using reputable providers with their own security measures, limiting access to your data to those who need it, and using secure passwords and up-to-date devices.
11. Cookies
Our website uses cookies to help it function and to understand how visitors use it. You can control cookies through your browser settings and through any cookie banner we display.
12. Changes to this policy
We may update this policy from time to time. When we do, we'll change the "last updated" date above, and where changes are significant we'll make this clear.
13. Complaints
If you have any concerns about how we handle your personal data, please contact us first — we'll always try to put things right.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator:
Website: ico.org.uk
Helpline: 0303 123 1113
