PRIVACY & COOKIES POLICY

1. About Us and This Policy

This Privacy Policy explains how personal data is collected, used, and protected when you use the contact enquiry form or get in touch via email.

For the purposes of the UK General Data Protection Regulation (UK GDPR), the Data Controller is Golden Canvas Ltd, a company registered in England and Wales under Company Registration Number: 17215224, with its registered office address at 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. We are committed to data minimisation and protecting your privacy.

We are registered with the Information Commissioner’s Office (ICO) under registration number: Registration in progress.

2. Data We Collect and Why

We only collect standard business, contact, and event details necessary to process your initial enquiry, check availability, provide quotes, and facilitate the planning and running of our mobile painting workshops or other services. This includes:

• Identity Data: Contact person name, company or organisation name.
• Contact Data: Email address, phone number.
• Event Preferences: Preferred date range, preferred time blocks (AM/PM/Evening), and estimated guest counts.
• Venue Logistics: Information regarding whether you are providing your own venue (including tables and chairs) or if you require venue hire services, which is essential for us to assess event feasibility and equipment requirements.
• Enquiry Notes: Any additional contextual notes you voluntarily choose to provide about your event layout, schedule, or theme within the open text field.

3. The Legal Basis for Processing

Under the UK GDPR, we rely on the following legal grounds to process your information:

• Contractual Necessity: To perform our obligations under a contract with you, or to take specific steps at your request before entering into a contract. This directly includes processing your details to prepare custom quotes, check availability, manage bookings, and successfully deliver our mobile painting workshops or other requested services.
• Legitimate Interests: To respond to your direct messages, answer questions, and manage our customer onboarding and administrative processes efficiently.

4. Data Retention: How Long We Keep It

We only keep your personal information for as long as necessary to fulfil the purposes we collected it for:

• Enquiries that do not proceed: We manually review our records annually and securely delete enquiry data where there has been no contact or active business relationship for 6 months.
• Confirmed bookings that are cancelled: If an invoice was raised or financial transactions occurred, we retain records for 7 years for company tax purposes. If no financial transactions took place, the data is treated as an unsuccessful enquiry and deleted during our annual review.
• Completed bookings: Retained for 7 years following the date of the event to comply with UK tax, financial reporting, and accounting laws.

5. Data Sharing and Security

We do not sell, rent, trade, or share your personal data with third parties for marketing purposes. Your data is securely processed and stored within the UK using secure email infrastructure provided by Fasthosts Internet Limited. It is only accessible to authorised personnel necessary to run our day-to-day operations.

6. Photography and Social Media at Events

We may take photographs and high-quality videos during our workshops and other services to capture the creativity and enjoyment of our services. These media assets are processed under our legitimate interest to promote our services, and may be featured on our website, marketing materials, and any official social media channels.

Your Right to Opt-Out: Your personal comfort and privacy are highly important to us. If you or any of your guests prefer not to be filmed or photographed, or do not wish to have your images uploaded to social media, please notify our team at the very start of the session. You may also contact us by email at any time to request the swift removal of any specific published image where you are identifiable.

7. Cookies and Tracking

Our website uses basic, functional cookies to ensure the contact form works correctly and securely. We do not use invasive tracking cookies, we do not monitor your personal browsing habits across the web, and we do not pass cookie data to external advertising networks. You can easily clear, control, or block cookies at any time through your individual web browser settings.

8. Your Legal Rights

Under UK data protection laws, you hold specific rights regarding your data:

• Right of Access: You can ask us for a copy of the personal data we hold about you.
• Right to Erasure ("Right to be Forgotten"): You can request that we delete your contact details immediately, provided we are not legally required to retain them for company tax purposes.
• Right to Rectification: You can ask us to update, correct, or complete any inaccurate details.

To exercise any of these rights, please email us directly. If you believe we have handled your data incorrectly, you also have the right to lodge a formal complaint with the Information Commissioner's Office (ICO).