This Privacy Policy explains how Northbridge Creative Studio Ltd ("we", "us", or "our") collects, uses, stores, shares, and protects personal data in connection with our art-studio business activities, including enquiries, bookings, workshops, events, commissions, exhibitions, website use, and related communications.
1. Introduction and company information
Northbridge Creative Studio Ltd is the data controller responsible for the personal data described in this Privacy Policy.
Company name: Northbridge Creative Studio Ltd
Address: Northbridge Creative Studio, 14 Redchurch Street, London E2 7DP, United Kingdom
Email: [email protected]
Phone: +44 20 7946 8372
This Privacy Policy applies to personal data processed through our website, email correspondence, phone calls, in-person interactions, booking systems, social media pages, and any other channels through which you interact with Northbridge Creative Studio Ltd.
2. Data collection and processing
We may collect and process the following categories of personal data:
- Identity data: name, title, artist name, username, and similar identifiers.
- Contact data: email address, phone number, postal address, and billing address.
- Transaction data: information relating to purchases, bookings, commissions, payments, refunds, invoices, and receipts.
- Correspondence data: communications sent to us by email, phone, social media, contact forms, or in person.
- Technical data: IP address, browser type, device information, operating system, and website usage data.
- Profile and preference data: event preferences, marketing preferences, interests, and attendance history.
- Visual and media data: photographs, video recordings, or audio recordings captured during events, exhibitions, workshops, or studio visits, where applicable and lawful.
- Special category data: only where you voluntarily provide it or where necessary and permitted by law, for example accessibility requirements or dietary preferences for events.
We collect personal data directly from you, automatically through our website and digital services, and sometimes from third parties such as payment providers, booking platforms, delivery providers, or publicly available sources where permitted.
3. Purpose of data processing
We process personal data for the following purposes:
- to respond to enquiries and provide customer service;
- to manage bookings, workshops, studio visits, events, exhibitions, and commissions;
- to process payments, issue invoices, and complete transactions;
- to deliver products, services, tickets, artwork, or related materials;
- to maintain business records and administer our relationship with you;
- to send service messages, updates, and administrative communications;
- to send marketing communications where permitted by law and, where required, with your consent;
- to operate, secure, improve, and troubleshoot our website, systems, and services;
- to comply with legal, regulatory, tax, accounting, and contractual obligations;
- to protect our rights, property, staff, clients, visitors, and studio premises;
- to manage disputes, claims, complaints, and investigations;
- to document studio activity, exhibitions, and events for archival, promotional, or editorial purposes where lawful.
4. Legal basis for processing
We process personal data only where we have a lawful basis to do so. Depending on the context, our legal bases may include:
- Contract: processing necessary to enter into or perform a contract with you, including bookings, sales, commissions, or event participation.
- Legal obligation: processing necessary to comply with applicable laws, including accounting, tax, and record-keeping requirements.
- Legitimate interests: processing necessary for our legitimate business interests, such as operating and improving our art-studio services, maintaining security, managing relationships, preventing fraud, and promoting our activities, provided those interests are not overridden by your rights and interests.
- Consent: processing based on your consent, for example certain marketing communications or the use of some optional cookies or media uses where required.
- Vital interests: in rare cases, processing necessary to protect someone’s life or physical safety.
- Public task or other lawful basis: where applicable under relevant law.
Where we process special category data, we will do so only where a lawful exception applies under applicable law.
5. Data sharing and third parties
We may share personal data with third parties only where necessary and appropriate for the purposes described in this Privacy Policy. These third parties may include:
- payment processors and financial institutions;
- booking, ticketing, email, and customer relationship management providers;
- website hosting, analytics, and IT support providers;
- delivery and logistics providers;
- professional advisers such as accountants, auditors, insurers, and legal advisers;
- event partners, collaborators, venues, and exhibition organisers;
- marketing and communications service providers;
- public authorities, regulators, law enforcement, courts, or other parties where required by law or necessary to protect legal rights.
We require third-party service providers to handle personal data securely and only in accordance with our instructions and applicable legal requirements.
6. Data transfer to third countries
Some of our service providers or partners may be located outside the United Kingdom and may process personal data in countries that do not offer the same level of data protection as the UK.
Where such transfers occur, we will take appropriate safeguards as required by applicable law. These may include:
- using adequacy regulations or equivalent legal mechanisms where available;
- entering into standard contractual clauses or other approved transfer mechanisms;
- applying supplementary technical and organisational measures where necessary.
You may contact us for further information about international transfers and the safeguards we rely on, where permitted by law.
7. Storage duration
We retain personal data only for as long as necessary for the purposes for which it was collected, including satisfying legal, accounting, tax, insurance, and reporting requirements.
The retention period depends on the type of data and the context of processing. For example:
- enquiry and correspondence data may be retained for a reasonable period after the enquiry is resolved;
- contract, transaction, and invoice records may be retained for the period required by applicable law and accounting rules;
- marketing data is retained until you withdraw consent or object, where applicable;
- booking and event records may be retained for administrative, legal, and safety purposes;
- website and technical logs are retained for security, operational, and analytical purposes for a limited period.
When personal data is no longer needed, we will securely delete, anonymise, or archive it in accordance with our retention practices and legal obligations.
8. User rights
Subject to applicable law, you may have the following rights in relation to your personal data:
- Access: to request confirmation of whether we process your personal data and to obtain a copy of that data.
- Rectification: to request correction of inaccurate or incomplete personal data.
- Erasure: to request deletion of your personal data in certain circumstances.
- Restriction: to request that we limit the processing of your personal data in certain situations.
- Data portability: to request that we provide certain personal data in a structured, commonly used, machine-readable format, or transmit it to another controller where technically feasible.
- Objection: to object to processing based on our legitimate interests or for direct marketing purposes.
To exercise any of these rights, please contact us using the details in the Contact Information section below. We may need to verify your identity before responding to your request.
9. Withdrawal of consent
Where we rely on your consent to process personal data, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
If you withdraw consent, we will stop processing the relevant data for the consent-based purpose unless we have another lawful basis to continue processing it.
10. Right to complain
If you have concerns about how we handle your personal data, please contact us first so that we can try to resolve the issue.
You also have the right to lodge a complaint with the relevant data protection supervisory authority. In the United Kingdom, this is generally the Information Commissioner's Office (ICO).
We encourage you to contact us before escalating a complaint so that we may address your concerns directly.
11. Data security
We take appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.
These measures may include:
- access controls and role-based permissions;
- password protection and secure authentication practices;
- encrypted communications where appropriate;
- regular backups and system monitoring;
- staff confidentiality obligations and training;
- physical security measures for studio and office premises;
- review of third-party service provider security practices.
However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.
12. Contact information
If you have any questions about this Privacy Policy or how we process personal data, please contact:
Northbridge Creative Studio Ltd
Northbridge Creative Studio
14 Redchurch Street
London E2 7DP
United Kingdom
Email: [email protected]
Phone: +44 20 7946 8372
13. Changes to privacy policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs.
Any updated version will be effective when published on our website or otherwise communicated to you, unless a different effective date is stated. We encourage you to review this Privacy Policy periodically to stay informed about how Northbridge Creative Studio Ltd processes personal data.