Privacy Policy

1. Who we are

River Valley Drawing School UK (“we”, “our”, “us”) provides arts education and related services in the United Kingdom. We act as the data controller for personal data processed in connection with our website, enrolments, events, and communications.

Contact: [email protected] • +44 20 7946 0958

2. Data we collect

• Identity and contact data: name, email, phone, emergency contact (for in-person classes).
• Course and enrolment data: course choices, schedules, attendance, progress notes.
• Payment data: transaction identifiers and billing details. Full card data is handled by our payment processor; we do not store card numbers.
• Communications data: enquiries, feedback, consent preferences.
• Technical data: IP address, device, browser, and cookie identifiers for security and analytics.

3. Purposes and legal bases

• Provide courses, events, and support (contract necessity, Art. 6(1)(b) UK GDPR).
• Take payment and manage invoices (contract necessity; legal obligation for accounting, Art. 6(1)(c)).
• Service updates and operational messages (legitimate interests, Art. 6(1)(f)).
• Marketing communications (consent, Art. 6(1)(a); you may withdraw at any time).
• Safety, fraud prevention, and performance analytics (legitimate interests, Art. 6(1)(f)).
• Legal claims and compliance (legal obligation/legitimate interests).

4. Retention

• Enrolment and course records: up to 6 years after last activity.
• Invoices and payment records: 6 years to meet UK tax requirements.
• General enquiries: 12 months after resolution.
• Marketing consent records: until you withdraw consent or 24 months of inactivity.
• Cookie identifiers: per cookie lifetime shown in our banner settings.

5. Sharing and international transfers

We share data with trusted processors acting on our instructions, such as hosting providers, email and CRM platforms, analytics, and payment processors. We require processors to implement appropriate safeguards and to process data only for our stated purposes.

Where data is transferred outside the UK, we rely on adequacy regulations or appropriate safeguards such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, along with technical and organisational measures.

6. Cookies and similar technologies

We use cookies for essential site functionality, security, preferences, performance, and analytics. Non-essential cookies are used with your consent. You can change your preferences at any time via your browser settings or our cookies banner.

• Essential: site operation, security, load balancing.
• Preferences: remember settings such as theme and plain-English mode.
• Analytics: measure usage to improve courses and website.

7. Children’s data

For learners under 13, we collect data only with verifiable parental or guardian consent. For learners aged 13–17, we may request guardian details where appropriate for safety. We do not knowingly market directly to children.

8. Your rights

• Access, rectification, and erasure.
• Restriction or objection to processing, including objection to direct marketing.
• Data portability for information you provided to us.
• Withdraw consent at any time, where processing is based on consent.
• Complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

To exercise rights, email [email protected] from the address associated with your account, or call +44 20 7946 0958. We may request proof of identity to protect your data.

9. Security

We apply layered security controls, access restrictions, encryption in transit, and regular reviews of suppliers. No method is 100% secure; we maintain processes to detect, respond to, and notify about incidents where required by law.

10. Changes to this policy

We may update this notice to reflect operational, legal, or regulatory changes. Material changes will be highlighted on this page and, where appropriate, notified by email.

Effective date: 25 November 2025