What we collect and why
When you book, we collect your contact details, the participant’s name, school year and group, club and dates. We ask about medical issues, allergies, additional needs, emergency contacts and collection arrangements for safe participation. We record attendance, payments, refunds and permission choices.
Payment records include amounts, dates, transaction references and payment results. We use them to check received payments, refunds and unclear or duplicate results.
Information comes from you, staff acting on your instruction, or a school preparing a funded booking. Please check it and tell us about changes. Let emergency contacts know you have given us their details and show them this notice.
Enquiries use your contact details so we can reply and arrange your request. Waiting lists collect parent contacts and children’s names/years, without care answers. They hold no place.
If you choose to save your details for quicker booking, we keep your name, email address and mobile number, and for each child their name, class, school year, second emergency contact, the adults allowed to collect them and whether they walk home. We never save medical, allergy or additional-needs answers, health-data permission, photography permission or payment details: we ask for these on every booking. You sign in with a code we email to you.
Our legal reasons
We use your booking and contact information to arrange and carry out your booking contract. For ordinary information about children and emergency contacts, we rely on our legitimate interests in running clubs safely, keeping accurate registers and arranging collection. We also use limited connection and security records to protect bookings against misuse.
We limit these uses and consider children’s privacy. Missing essential booking or safety information may prevent a booking; contact us to discuss any difficulty.
Health and care information, including the yes/no flags, needs an extra legal condition. We ask for separate express permission to use it to support safe participation and share the limited information described below. An adult participant gives their own permission; someone acting for a child must have the right authority. You can withdraw this permission by contacting Tom. We will stop that care use, remove the active care record and arrange changes to paper and school copies. We will discuss what can safely be offered without it. Necessary booking and payment records remain on their separate schedule.
Saving your details is optional. We keep them because you asked us to, so you can book more quickly; you can delete them at any time.
Who sees the information
Managers see booking and care records. Assigned tutors see their clubs’ records; care access ends after the child’s last confirmed session. Managers print care sheets for use without a connection, replace them after changes and arrange shredding when replaced or the term ends.
A school list contains names, school year and group, collection arrangements, attendance columns and yes/no medical, allergy and additional-needs flags. Detailed care answers and safety notes are excluded. The flags still reveal health information.
Confirmation emails include dates and a child’s first name. For staff-entered bookings, they also repeat emergency contacts, collection arrangements, school year and group and yes/no care flags for you to check. Detailed care answers are left out.
Community Tech maintains the website. Hosting, email and payment services handle information needed for their work. Online payments use the selected provider, such as Stripe or PayPal, with its own privacy information. WooCommerce holds parent billing contacts, amounts and club/dates; its booking order lines omit child names and care answers.
Staff access is restricted. Care notes and designated phone fields are encrypted, but this does not encrypt every database field, email or paper copy.
Mailing list and photos
The WhatsApp mailing list and promotional photographs have separate, optional permissions. Both start unticked, and saying no does not prevent a booking. Contact the studio to withdraw either permission. We record the change and update our mailing lists and future photo use. Withdrawal does not affect earlier lawful use.
How long we keep records
Our usual retention periods are:
Care answers, safety notes, emergency contacts and collection details: normally three months after the last booked session, even if the child did not attend.
Unfinished booking details: normally seven days after the hold expires. Paid, on-hold or enrolled records follow their separate period. We also keep details needed to check a received payment or an unclear payment result. Care information still follows its shorter period above. Evidence of a permission choice, including who gave it, remains on the consent-record schedule below.
Waiting-list entries: six months after the request at most. When a school club’s term ends, its waiting list moves to the same club next term. Holiday club and workshop entries are deleted when the club ends.
Other unconverted enquiries: six months.
Saved family details: deleted 18 months after you last signed in, changed them or booked while signed in, or straight away when you delete them yourself or ask us to.
Booking, attendance, payment and consent records: six years from each record’s creation.
Security audit events: twelve months. Change, consent, withdrawal, care-sheet print and financial action evidence: six years.
Mail, backups, downloaded lists and marketing or photo copies need separate review and removal; the booking system does not delete these copies automatically. Records needed for a specific dispute or legal duty may be kept longer, with access limited and the reason reviewed.
Your rights and concerns
Contact Tom to ask for access, correction, deletion, restricted use or a portable copy where the right applies. We check identity and authority before sharing records. Rights in a child’s information belong to the child; we consider their understanding and interests when someone acts for them.
You can see, change or delete your saved details yourself on the booking page after signing in.
You can object to uses based on our legitimate interests. Tell us which use concerns you so we can consider it.
If you want to complain about how we have handled your personal information, contact Tom at Myshellartstudio22@gmail.com or 07437 879 473. We will acknowledge your complaint within 30 days, look into it and tell you the outcome.
If you are unhappy with our response, you can complain to the Information Commissioner’s Office, the UK’s data-protection regulator.
For cookies and your browser choices, read our cookie notice.