Legal
Privacy policy
Last updated: 13 October 2026
This policy explains what personal information Wool&Silk Art studio collects when you use woolandsilk.co.uk, book a class or buy an online course. It also covers why we collect it, who we share it with and your rights under UK data protection law (the UK GDPR and the Data Protection Act 2018).
1. Who we are
The data controller is Wool&Silk Art studio, run by Svetlana Lilley, 29 Hunter Street, Briton Ferry, SA11 2RL, Wales, United Kingdom. Phone 07818 893524. For anything about your data, please use our contact form.
2. What we collect and why
| Information | Why we use it | Lawful basis |
|---|---|---|
| Name, email, phone and address you give at checkout | To take your booking or order, send confirmations and contact you about your class (for example if it has to move) | Contract |
| Account details: email, username, password (stored encrypted), saved details and your courses | To let you sign in and watch the courses you have bought | Contract |
| Bookings made on Eventbrite: name, email, ticket and order details | To know who is coming to each class and avoid overbooking | Contract |
| Messages from our contact form, testimonials and survey answers | To reply to you, publish reviews you have agreed to share, and plan classes | Legitimate interests; consent for published testimonials |
| Order and payment records | Accounting and tax | Legal obligation |
| Technical data such as IP address, browser and pages visited | To run the site securely and stop spam and fraud | Legitimate interests |
| Marketing cookies (Meta Pixel), only if you accept them | To measure our Facebook and Instagram adverts and show them to people likely to be interested | Consent |
We never see or store your card details. Stripe handles payments.
3. Cookies
Essential cookies keep you signed in, remember your bag and protect forms from misuse. The site can’t work without them, so they don’t need your consent.
Marketing cookies. If you click “Accept” on our cookie banner, we load the Meta (Facebook) Pixel. It tells Meta when you view a class or course, add it to your bag, or buy. We use this to measure our adverts. Meta may combine it with what it knows about you, under Meta’s privacy policy. If you click “Reject”, the Pixel is not loaded. You can change your mind at any time with Cookie settings, which is also in the footer.
4. Who we share it with
We don’t sell your data. We share it only with the services that help us run the studio, and only as much as each one needs:
- Stripe: card payments and refunds.
- Eventbrite: if you book through Eventbrite, under their own privacy policy.
- Heroku (Salesforce) and Amazon Web Services: hosting the website, its database and images.
- Cloudflare: website security and the spam check on forms.
- Google (Gmail): sending and receiving our emails.
- Vimeo: playing course videos.
- Google Fonts, jsDelivr and Font Awesome: fonts and page code, which your browser downloads from them.
- Meta: only if you accept marketing cookies.
Some of these companies are based in the United States or elsewhere outside the UK. Where data leaves the UK, it is protected by the UK–US Data Bridge or the UK International Data Transfer Agreement and standard contractual clauses.
5. How long we keep it
- Order and payment records: 6 years after the end of the tax year, as UK tax law requires.
- Your account: until you ask us to close it. Closing your account ends access to your online courses.
- Contact messages: up to 2 years.
- Marketing cookies: up to 90 days. Your cookie choice is remembered for 6 months.
6. Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to you in a portable format. Where we rely on your consent, you can withdraw it at any time. Just contact us. We’ll reply within one month.
If you’re unhappy with how we handle your data, please tell us first. You also have the right to complain to the Information Commissioner’s Office: ico.org.uk, 0303 123 1113. If you live in the EU, you can complain to your local data protection authority.
7. Children
Children are welcome at family classes, but bookings and accounts must be made by an adult. We don’t knowingly collect personal data from children under 13.
8. Changes to this policy
If we change this policy, we’ll update the date at the top. If a change is significant, we’ll tell account holders by email.