Legal
Privacy Policy
Plain English summary: We collect your personal data only when you contact us or make a purchase. We don't sell it, we don't use it for advertising, and we don't share it except with the services needed to run the business (payment processing, website hosting, email newsletter). You have the right to see, correct or delete your data at any time.
1. Who we are
Emily Duchscherer Kirk Studio Ltd, Company no. 17087196, registered in England and Wales, is the data controller for personal data collected through this website.
Registered address: 188 Lyde Road, Yeovil, Somerset, BA21 5PN
hello@emilyduchschererkirkstudio.co.uk · 07734 322107
We are registered with the Information Commissioner's Office (ICO) as a data controller.
2. What personal data we collect and why
Contact form enquiries
Data collected: Name, email address, subject, message content.
Legal basis: Legitimate interests (Article 6(1)(f) UK GDPR) — to respond to your enquiry and manage our business relationships.
Retention: We keep enquiry data for up to 2 years, then delete it unless an ongoing business relationship exists.
Online shop orders (Stripe)
Data collected: Name, email address, delivery address, order details. Payment card data is processed directly by Stripe and is never seen or stored by us.
Legal basis: Contract (Article 6(1)(b) UK GDPR) — processing is necessary to fulfil your order.
Retention: Order records are kept for 6 years in line with HMRC requirements for financial records. Payment data is held by Stripe under their own privacy policy.
Commission enquiries
Data collected: Name, email, phone (if provided), details of the commission.
Legal basis: Legitimate interests / pre-contractual steps (Article 6(1)(b) and (f) UK GDPR).
Retention: Retained for the duration of the commission plus 6 years for financial record-keeping.
Email newsletter (if you subscribe)
Data collected: Email address and first name.
Legal basis: Consent (Article 6(1)(a) UK GDPR). You can withdraw consent and unsubscribe at any time via the link in any newsletter email.
Retention: Until you unsubscribe, after which your data is removed from our mailing list within 30 days.
Website analytics
We use Cloudflare Web Analytics, which is cookieless and does not collect personally identifiable information. No consent is required for this.
3. Who we share your data with
We share personal data only with the third-party services that are essential to running the business. All are acting as data processors on our behalf:
- Stripe — Payment processing — USA / UK (Standard Contractual Clauses)
- Cloudflare — Website hosting, CDN, cookieless analytics — USA / UK (Standard Contractual Clauses)
- Sanity — Content management system — USA / EU (Standard Contractual Clauses)
- Brevo (Sendinblue) — Email newsletter delivery — EU (adequacy decision applies)
We do not sell, rent or trade personal data to any third party. We do not use personal data for advertising or profiling.
4. International data transfers
Some of our service providers are based outside the UK. Where personal data is transferred outside the UK, we ensure that appropriate safeguards are in place — either an adequacy decision by the UK government, Standard Contractual Clauses (SCCs), or another approved transfer mechanism.
5. Your rights under UK GDPR
You have the following rights regarding your personal data:
- Right of access — you can request a copy of the personal data we hold about you.
- Right to rectification — you can ask us to correct inaccurate data.
- Right to erasure ("right to be forgotten") — you can ask us to delete your data where there is no longer a legitimate reason to hold it.
- Right to restrict processing — you can ask us to limit how we use your data in certain circumstances.
- Right to data portability — you can request your data in a structured, machine-readable format.
- Right to object — you can object to processing based on legitimate interests.
- Right to withdraw consent — where processing is based on consent (e.g. newsletter), you can withdraw at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, contact us at hello@emilyduchschererkirkstudio.co.uk. We will respond within one calendar month.
6. Right to complain
If you believe we have not handled your personal data correctly, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
ico.org.uk · Phone: 0303 123 1113 · ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
We would always ask that you contact us first so we have the opportunity to resolve any concern directly.
7. Data security
We take reasonable technical and organisational measures to protect your personal data. All data is transmitted over HTTPS. Payment data is handled entirely by Stripe and is never transmitted to or stored on our systems. We do not store payment card details.
8. Children's data
Our website and services are not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe we have inadvertently received data from a child, please contact us and we will delete it promptly.
9. Cookies and browser storage
For full details of the cookies and local storage used on this site, see our Cookie Notice.
10. Changes to this policy
We may update this policy when our practices change or when required by law. The date at the top of this page shows the most recent update. Significant changes will be noted clearly.
11. Workshop bookings
Data collected: Name, email address, phone number, the session date/time and ticket type booked, and the amount paid.
Legal basis: Contract (Article 6(1)(b) UK GDPR) — processing is necessary to provide the workshop you have booked and paid for.
Retention: Booking records are kept for 6 years in line with HMRC requirements for financial records — the same period used for online shop orders (see section 2 above). Waitlist sign-ups that never turn into a booking are not kept indefinitely.
Where this data is stored: Booking details are held in a private database that has no public read access, separate from the content management system (Sanity) that runs the rest of this website — most of this site's content is openly readable by design, but booking names, emails and phone numbers deliberately are not.
Consent at the point of booking: Before paying, you are asked to confirm you have read the booking terms and cancellation policy. We record that confirmation, and when it was given, alongside your booking.
Right to erasure: As with online shop orders, we can delete your booking data on request once it is outside the 6-year financial retention period referenced above. Within that period, UK GDPR’s legal-obligation exemption (Article 17(3)(b)) allows us to retain the transaction record, but we will remove you from anything not required for that purpose (e.g. a waitlist entry) straight away.
A note on processors
The following should be read alongside the processor table in section 3 above:
- Web3Forms — contact form delivery. In use since this site launched; included here for completeness as it was missing from the original table.
- Cloudflare D1 — the private database referenced above that stores workshop booking records — UK / EU / USA (Cloudflare network, Standard Contractual Clauses).
- Brevo (Sendinblue) — in addition to the newsletter use already listed above, Brevo also sends transactional workshop emails (booking confirmation, reminders, cancellation/refund notices).