Purpose of this notice
This notice outlines how I collect and use personal data about you, in line with my responsibilities under the UK General Data Protection Regulation (GDPR).
Please note that the ‘Facebook Page’ section below deals specifically with my responsibilities as a Facebook Page administrator; this section is relevant to you if you engage with my Facebook Page. The remainder of this notice outlines my responsibilities when I collect and use personal data in the course of my work as an artist/maker and workshop facilitator.
Collecting and using personal data
In the course of my work, if we form a business relationship I will only collect and use your data for the purposes of my legitimate interests (ie in ways that you would reasonably expect in the context of providing goods and/or services). I will not gather or use your personal data for any other purpose unless I have first taken the steps required by the GDPR (for example, I would need to seek your explicit consent to contact you for marketing purposes).
Any personal data collected will be limited to what is necessary for initiating, carrying out and concluding our business relationship. The information I hold about you will normally include basic details to be used for core business purposes (such as your name, address, email address and telephone number).
I will share your personal data with third parties only where it is necessary to administer the business relationship between us (for example, a delivery company or a print partner who will subsequently deliver directly to you), where required by law or where I have another legitimate interest in doing so. The processing of information by third parties is subject to their own privacy policies.
Website and cookies
I do not collect personal data via my website.
Cookies are small pieces of data that are stored on your device when you browse a website. Cookies can be used for a variety of purposes and some are necessary for a site to operate correctly. My website is hosted by WordPress.com. Please refer to their policy to learn more about what cookies are, how they may be used and how you can restrict or block their use. The policy also includes links to additional resources that you may find informative. If you have any queries or concerns regarding cookies please get in touch (see ‘Queries and concerns’ below).
Marketing communications
If you have explicitly consented for me to do so, I will contact you with information relating to products, services, activities or events that may be of interest. You have the right to withdraw the consent that has been given in this specific respect (either by contacting me directly, or by using the unsubscribe facility in any marketing communications you receive from me).
Data security, storage and retention
I have put in place reasonable and appropriate security measures to prevent data loss and to safeguard your information from unauthorised access, use, alteration or disclosure. Data at rest encryption has been enabled on the electronic devices that I use when accessing your data. These are further protected by security and anti-virus software, plus lock screens (requiring user authentication) to prevent unauthorised access. I secure my user accounts with 2FA (Two Factor Authentication) wherever possible.
I will retain your personal data for as long as is necessary to meet the purposes for which it is collected and to comply with legal obligations. Retention of financial records for tax purposes requires that records are kept for at least 5 years after the 31 January submission deadline of the relevant tax year.
Queries and concerns
Please contact me if you have any queries relating to this notice or my collection/use of your data. You have the right to make a subject access request (SAR) to obtain a copy of your personal data. You may also have rights to change, restrict the use of, or delete your personal information (please note that exceptions apply, for example where I am required to retain data for legal reasons).
If you have any queries, concerns or wish to make a SAR please write to me via estherwaitestudio@outlook.com or contact me on +44 7857 980182.
In the UK you can also raise concerns via the Information Commissioner’s Office (ICO): Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
Facebook Page
As a Facebook Page administrator I have access to Facebook Page Insights. This service provides an aggregated view of interactions with my page which I may access for the purposes of my legitimate interests (ie enabling me to learn more about my audience so that I can improve and target the information and services I provide).
The Facebook Page Insights Controller Addendum specifies that I am a joint data controller, however my GDPR responsibilities in this respect are limited to having a legal basis for processing Insights data. Please visit ‘Information about Page Insights‘, provided by Facebook, if you would like to find out more about the Insights service, the privacy information that is relevant to you when you interact with a Page and your rights under data privacy law.
I do not collect any additional data from my Facebook Page.
Changes to this notice
This notice was last reviewed on 05/09/25 and last updated on 05/09/25.
