Privacy Policy

Last updated: 10 July 2026

Creative Connections respects your privacy and is committed to handling personal information fairly, lawfully and transparently. This notice explains how we use personal information when you visit our website, contact us, make or manage a booking, attend an activity, hire a space, take part in a community project, or otherwise deal with us.

1. Who we are

Data controller: Creative Connections (East Midlands) Ltd,

Company number: 15862307

Registered office: 1 Wycliffe Road, Alfreton, DE55 7HR

Email: enquiries@creative-connections.org.uk

Telephone: 07514 700667

2. Personal information we collect

Depending on your relationship with us, we may collect:

• identity and contact details, such as name, email address, telephone number and organisation;

• booking, attendance and enquiry details;

• party, workshop, event, room-hire and pottery collection details;

• payment and transaction records (we do not need to store full payment-card details where a payment provider processes them);

• correspondence and customer-service records;

• dietary, allergy, access or support information you choose to give us;

• photographs or video where we have an appropriate lawful basis;

• community-project, evaluation or funder-reporting information where relevant;

• website technical and usage information, including cookie or similar-technology data where applicable.

3. Where we get information from

We usually receive information directly from you. We may also receive it from a parent, carer, group organiser, organisation making a booking on your behalf, a project partner, a payment or booking provider, or automatically through our website and permitted cookies or similar technologies.

4. Why we use information and our lawful bases

We use personal information only where we have a lawful basis. Depending on the circumstances, these may include:

• Contract: to take steps at your request before a booking or agreement, and to provide and administer booked services;

• Legal obligation: to meet legal, tax, accounting, food-safety, safeguarding or other regulatory duties that apply to us;

• Legitimate interests: to respond to general enquiries, administer and improve our organisation and services, keep proportionate business records, prevent misuse, establish or defend legal claims, and communicate with organisations about relevant services where those interests are not overridden by individuals’ rights;

• Consent: where we ask for a genuine choice, for example for certain marketing or promotional photography uses;

• Vital interests: in a genuine emergency where processing is necessary to protect someone’s life.

We decide and document the appropriate lawful basis for each processing activity. We do not rely on consent where another basis is more appropriate.

5. Allergy, dietary, access and health information

Information that reveals health may be special category data. Where we process special category data, we identify both an Article 6 lawful basis and a separate Article 9 condition. Depending on the circumstances, this may include your explicit consent for optional advance information you provide so that we can consider dietary, allergy or access needs, or vital interests in a genuine emergency where the legal conditions are met. You may withdraw consent for future processing at any time, although this does not affect processing already carried out lawfully. We ask you not to provide more health information than is necessary.

6. Marketing

We may send electronic marketing only where permitted by applicable law. Where consent is required, we will ask for it. You can opt out at any time by using an unsubscribe facility where provided or contacting us. Service messages about an existing booking are not marketing.

7. Photographs and video

We may take and use photographs or video for agreed purposes such as promotion, project reporting or documenting activities where we have an appropriate lawful basis. We take additional care with children’s images. See our Photography & Media Policy. Where we rely on consent, it can be withdrawn for future use, subject to practical and legal limits for material already lawfully printed or distributed.

8. Who we share information with

Where necessary and lawful, we may share relevant information with service providers acting for us (for example website hosting, IT, email, booking, payment, document storage or professional advisers), tutors or delivery partners where needed to run an activity, funders or project partners where properly disclosed and lawful, insurers, accountants, legal advisers, and public authorities where required or permitted by law. We do not sell personal information.

Some suppliers may act as independent controllers rather than processors. Their own privacy information may also apply.

9. International transfers

Some technology providers may store or access personal information outside the UK. Where a restricted transfer occurs, we will use an appropriate UK GDPR transfer mechanism or another lawful safeguard where required. You may contact us for more information about relevant safeguards.

10. How long we keep information

We keep information only as long as reasonably necessary for the purpose collected and for legal, tax, insurance, safeguarding or dispute requirements. Our working retention approach is:

• routine unsuccessful enquiries: normally up to 12 months after the last meaningful contact;

• ordinary booking and customer-service records: normally up to 24 months after the booking or last meaningful contact, unless needed longer for a dispute, safeguarding or another justified reason;

• invoices, accounts and core tax records: normally 6 years after the end of the relevant financial year, or longer if legally required;

• marketing records: until you unsubscribe or we determine the information is no longer needed, while retaining a minimal suppression record where necessary to respect an opt-out;

• consent records: for as long as needed to demonstrate the consent and deal with related claims or compliance;

• photographs and project records: according to the stated purpose, consent terms, safeguarding needs and any disclosed funder requirements.

These are general periods. We may shorten or extend a period where a documented legal or operational reason applies.

11. Cookies and similar technologies

Our website may use cookies and similar technologies. See our Cookie Policy and cookie controls for details.

Non-essential technologies are used only where permitted and, where required, after valid consent.

12. Your rights

Depending on the circumstances, you may have rights to access your personal information; correct inaccurate information; request erasure; restrict processing; object to processing; receive certain information in a portable format; and withdraw consent where consent is the basis used. These rights are not absolute and legal exemptions may apply.

To exercise a right, contact enquiries@creative-connections.org.uk. We may need to verify identity before acting on a request.

13. Complaints

Please contact us first if you have concerns so we can try to resolve them. You also have the right to complain to the UK Information Commissioner’s Office (ICO).

14. Security

We use reasonable organisational and technical measures appropriate to the information and risks involved. No system can be guaranteed completely secure.

15. Changes to this notice

We may update this notice. The latest version will show its last-updated date. Where a change is significant, we will take reasonable steps to bring it to the attention of affected people.