top of page

Save when you book a bundle. The perfect next step in your pottery journey.

Privacy Policy

Last updated:  3 August 2026
 

BACKGROUND:

We respect the privacy of our clients and of everyone who visits our website, www.sarahcorearts.com (Our Site). Sarah Core Arts Ltd (we / us / our) will only collect and use personal data in ways that are described in this Privacy Notice, and that are consistent with our obligations and your rights under the Data Protection Legislation.

​

1. Definitions and Interpretation

​

In this Privacy Notice, the following terms have the following meanings:

​

Client: means a client who engages our services or who purchases products from us; and

​

Data Protection Legislation: means all applicable data protection and privacy legislation in force from time to time in the UK including the UK GDPR; the Data Protection Act 2018 (DPA 2018); the Privacy and Electronic Communications Regulations 2003 (SI 2003/2426); the Data (Use and Access) Act 2025, in each case as amended, and all other legislation and regulatory requirements in force from time to time which apply to a party relating to the use of personal data (including the privacy of electronic communications).

​

2. Information About Us

​

Sarah Core Arts Ltd is a limited company incorporated in England & Wales with company number 15122999, whose registered office address is at 4 Fernwood Crescent, Whetstone, United Kingdom, N20 0RN. We are the controller and responsible for your personal data.

​

We are registered as a Data Controller with the Information Commissioner's Office (ICO) under registration number ZB878155.

​

If you have any questions relating to your personal data or this Privacy Notice, you may contact Sarah Core at sarah@sarahcorearts.com.

​

3. Third party links

​

Our Site may include links to third-party websites. Clicking on those links may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for the way in which they handle personal data. We encourage you to read the privacy policy or privacy notice of every website you visit.

​

4. Your personal data

​

Personal data is any information about you that enables you to be identified. Personal data covers your name and contact details, but also information such as electronic location data and other online identifiers. It does not include data where your identity has been removed (anonymous data).

​

It is important that your personal data is kept accurate and up-to-date. If any of the personal data we hold about you changes, please let us know.

​

Where we need to collect personal data by law, or under the terms of a contract we have with you, and you do not provide that data when requested, we may not be able to perform that contract. In this case, we may have to cancel a product or service contract you have with us. We will notify you if this is the case.

​

5. Your rights in relation to your personal data

​

Under the Data Protection Legislation, you have the following rights. More information on how to exercise these rights follows later in this Privacy Notice.

​

  • The right to be informed about our collection and use of your personal data.

  • The right to access your personal data.

  • The right to rectify your personal data if any of it is inaccurate or incomplete.

  • The right to request deletion of your personal data (subject to certain legal requirements) or to withdraw consent to us using it.

  • The right to prevent processing of your personal data.

  • The right to restrict the use of your personal data for particular purposes.

  • The right of portability, enabling you to ask for a copy of your personal data to re-use with another business.

  • Rights relating to automated decision-making and profiling. We do not however use your personal data in this way.

  • The right to lodge a complaint if you believe your privacy or data protection rights have been breached. You should raise your complaint with us in the first instance, and a copy of our Data Protection Complaints Policy is available on request. We will acknowledge your complaint within 30 days and respond to it without undue delay. If we are not able to resolve your complaint effectively, then you may submit a complaint to the Information Commissioner's Office (ICO) at www.ico.org.uk or by telephone on 0303 123 1113.
     

For more information about our use of your personal data or exercising your rights set out above, please contact us at sarah@sarahcorearts.com.

​

6. What Data We Collect

​

Depending upon whether you are simply browsing Our Site or are a Client, we may collect and hold some or all of the personal data set out below, using the methods also set out below. Please also see our Cookie Policy on Our Site regarding our use of cookies and similar technologies.

​

We collect the following types of personal data:

​

  • Contact Information: This may include your name, email address, postal address, phone number, and other similar contact details that you provide when contacting us through Our Site, by email, telephone, or via social messaging services such as WhatsApp.

  • Account Information: If you create an account on Our Site, we may collect information associated with your account, such as your username, password, and profile details.

  • Payment Information: If you purchase goods or services from us, we may collect payment information, including card details, billing address, and transaction history. However, please note that we do not store full card numbers on our servers.

  • Communication Data: This includes any correspondence or communication between you and us.

  • Booking and Class History: Information about the classes, workshops and events you have booked with us, your attendance, and your purchase history.

  • Health and Medical Information: Before attending one of our classes, workshops or events, we ask you to disclose any medical conditions, physical limitations, allergies or skin sensitivities that may affect your ability to participate safely (for example, sensitivities to clay dust or to chemical compounds used in glazing). This is “special category” data under the UK GDPR. We collect and use this information solely on the basis of your explicit consent, given at the time you provide it, for the purpose of ensuring your safe participation. You may withdraw your consent at any time by contacting us at sarah@sarahcorearts.com, although this may mean we are unable to continue providing classes to you safely. Where you withdraw your consent, we will stop using your health information to plan your participation in classes. We will, however, retain a record of the information you provided for the period set out in Section 8, on the basis that this is necessary for the establishment, exercise or defence of legal claims (Article 9(2)(f) UK GDPR) and in our legitimate interests in defending claims arising from your participation.

  • Photographs and Images: From time to time we take photographs or short video clips of finished ceramic work, the Studio environment, activities and Classes in progress, for use on Our Site, in newsletters, and on our social media channels. Where an image identifies you personally, we will only use it for these marketing purposes with your prior consent. You may withdraw your consent at any time by emailing sarah@sarahcorearts.com. Following receipt of your withdrawal, we will not use any new images of you; however, we are not obliged to remove images that have already been published. Images that have been reshared by third parties, or that appear in printed or physical marketing materials, may not in any event be recoverable.

    • Sensitive or special category data: Aside from the Health and Medical Information set out above, we do not ask you to provide any sensitive or special category data. In the context of our mindfulness, therapeutic and wellbeing classes, however, you may voluntarily share information relating to your mental or physical health, background, religious or philosophical beliefs, gender identity, sexual orientation or other sensitive matters. We do not record, retain or process this information unless this is unavoidable, and only then with your explicit consent, for the purpose for which you have shared it. We will retain any such information for no longer than is necessary. We do not collect personal data relating to criminal convictions or offences. Our Site and classes are not intended for children; we do not knowingly collect personal data relating to children under the age of 18 without the explicit consent of a parent or guardian.

    • Usage Information: We automatically collect information about your usage of Our Site, including pages visited, time spent on the site, clickstream data, and referring URL, using our analytics software. This data helps us analyse website performance and user preferences.

    • Technical Information: We may collect technical information about your device and browser, using our analytics software, including your IP address, browser type and version, device type, operating system, and platform.

    • Social Media Data: If you interact with our social media pages or use social media features integrated into Our Site, we may collect information from your social media profiles, such as your social media handles and activities.

    • Cookies and Tracking Technologies: We may use cookies and similar tracking technologies to collect information about your browsing behaviour and preferences. For more details, please see our Cookie Policy.

    • Other Information: We may collect additional information not specifically mentioned here with your consent or as required by applicable laws and regulations.

​

Please note that the exact information collected may vary depending on your interactions with Our Site and the services we offer. We only collect information that is necessary for the purposes outlined in this Privacy Notice and as permitted by the Data Protection Legislation.

​

7. How we use your personal data

​

Under the Data Protection Legislation, we must always have a lawful basis for using personal data. The lawful bases available to us under the UK GDPR are:

​

  • Consent: you have given consent to the processing of your personal data for one or more specific purposes. You have the right to withdraw your consent at any time;

  • Contract: the processing is necessary for the performance of a contract with you, or in order to take steps at your request before entering into a contract;

  • Legal obligation: we need to process your personal data to comply with a legal obligation to which we are subject;

  • Vital interests: the processing is necessary to protect the vital interests of you or another person;

  • Public interest: the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority (we do not generally rely on this basis); and

  • Legitimate interests: the processing is necessary for the purposes of legitimate interests pursued by us or a third party, except where such interests are overridden by your interests or fundamental rights and freedoms.
     

We will use your personal data in the following circumstances:

​

  • To perform a contract with you.

  • Where it is necessary for our legitimate interests (or those of a third party), for example:

    • To develop our business

    • To protect the security or integrity of our IT systems

    • To manage our relationship with you as our client

    • To administer our business

    • To administer or improve Our Site

    • To maintain records for legal and regulatory compliance

    • To maintain or defend legal claims

  • Where we need to comply with a legal or regulatory obligation.

  • Where you have consented to us using or processing your personal data (for example, where you have provided health or medical information so that you can safely participate in a class, where you have consented to being photographed, or where you have opted in to receive marketing communications from us). You have the right to withdraw consent at any time by contacting us.

  • With your permission and/or where permitted by law, to market our products and/or services to you. You will not be sent any unlawful marketing or spam, and you will always have the opportunity to opt-out of marketing communications at any time.
     

We do not carry out automated decision making or any type of automated profiling.

​

We will only use your personal data for the purposes for which it was originally collected unless we reasonably believe that another purpose is compatible with those original purposes and we need to use your personal data for that purpose.

​

If we need to use your personal data for an unrelated or incompatible purpose to that for which it was originally collected, we will inform you and explain the legal basis which allows us to do so.

​

In some circumstances, where permitted or required by law, we may process your personal data without your knowledge or consent. This will only be done within the bounds of the Data Protection Legislation and your legal rights.

​

8. Keeping your personal data

​

We will only process and store your personal data for as long as is necessary taking into account the reasons for which it was first collected.

​

When deciding what the correct time is to keep the data for, we look at its amount, nature and sensitivity, potential risk of harm from unauthorised use or disclosure, the processing purposes, if these can be achieved by other means, and any legal and regulatory requirements.

​

We may keep your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation arising out of our relationship.

​

The law requires us to keep basic information about our clients (including identity, contact and payment information as well as information on the contracts we enter into with our clients) for seven years after they stop being clients.

​

In some circumstances, we may anonymise your personal data for research or statistical purposes. In this case, we may use this information indefinitely without further notice to you.

​

The specific retention periods we apply to each category of personal data are set out in the table below:

​

Category of personal data
Retention period
Communications and correspondence with you
6 years from the date of our last communication with you.
Account information (where you hold an account on Our Site)
For the duration of your account, and for up to 3 years after closure (unless a longer period is required for tax purposes).
Contact information, booking and class history, and payment records
7 years after your last transaction with us, to comply with HMRC requirements.
Health and medical information
For the duration of your client relationship with us, and for 3 years afterwards.
Photographs and images of identifiable individuals
Until you withdraw your consent, after which we will not use any new images of you (although images already published may remain in circulation).
Website usage and analytics information
3 years from your last visit to Our Site.
Information collected through cookies and similar technologies
Up to 3 years from the date you gave your consent, or until you withdraw your consent, whichever is earlier.
Feedback, survey responses, reviews and testimonials
6 years from the date they were given, or (where given under consent) until consent is withdrawn, whichever is earlier.

At the end of the applicable retention period, your personal data will either be securely destroyed or anonymised, unless we are required to keep it in order to comply with our legal obligations.

​

9. Storing your personal data

​

The security of your personal data is essential to us.

​

To protect your personal data, we have put in place appropriate technical and organisational measures, including the following:

​

  • data in transit: personal data you enter on Our Site is encrypted in transit using SSL/TLS (transport layer security). This protects information as it travels between your device and our website platform, and helps guard against interception by third parties.

  • data at rest: personal data stored on our website platform is encrypted at rest by our platform provider, Wix. Personal data held in our other business systems is stored in secure, access-controlled environments.

  • personal data entered by you on Our Site is secured by SSL (secure socket layer) technology in transit and at rest to improve security. SSL secures connections and prevents impersonation or stealing of visitors' information.

  • the payment processor integration on Our Site is compliant with PCI-DSS. Sensitive card data is never handled by us. It goes directly to the payment processor's servers and we do not have access to this information.

  • we store personal data securely, including putting in place access controls, physical security, and secure backup procedures.

  • we collect only the minimum amount of personal data necessary for our purposes.

  • access to your personal data is limited to those employees, agents, contractors, and other third parties with a legitimate need to know and they are subject to duties of confidentiality.

  • we conduct regular data security audits to identify and address any vulnerabilities.

  • we keep our software, systems, and applications up-to-date with security patches and updates to address known vulnerabilities.

  • we have in place procedures for dealing with data breaches. These include notifying you, acting quickly to identify and limit the breach and any consequences of the breach and/or notifying the relevant authorities where we are legally required to do so.
     

10. Transferring and sharing your personal data

​

We may use external third parties to provide systems, technology or support which involves them processing your personal data on our behalf. The main providers we use, and the purposes for which we use them, are:

  • Wix provides our website platform and hosting, online store functionality, client account management, and the integrated online checkout known as Wix Payments. Card payments via Our Site are processed through Wix Payments and/or Stripe, Inc., depending on the payment method selected. Stripe also operates as the underlying payment infrastructure for Wix Payments in the United Kingdom. Card details are encrypted and transmitted directly to Stripe; we do not store or have access to your full card details. Wix's privacy notice is available here: https://www.wix.com/about/privacy. Stripe's privacy notice is available here: https://stripe.com/gb/privacy.

  • SumUp is used to process in-person card payments (for example, payments taken at classes or events). SumUp's privacy notice is available here: https://sumup.com/gb/privacy.

  • Mailchimp (operated by Intuit Inc.) is used to create, manage and send marketing emails and newsletters to clients and other persons who have opted in to receive them. Mailchimp's privacy notice is available here: https://www.intuit.com/privacy/statement/.

  • Microsoft provides business email and productivity tools. Microsoft's privacy statement is available here: https://privacy.microsoft.com/en-gb/privacystatement.

  • 123 Reg provides domain and email hosting services. 123 Reg's privacy notice is available here: https://www.123-reg.co.uk/privacy-policy/.

  • Apple (iCloud) is used to synchronise email and contact information to mobile devices. Apple's privacy policy is available here: https://www.apple.com/legal/privacy/en-ww/.

  • Dropbox is used for cloud file storage and backup. Dropbox's privacy policy is available here: https://www.dropbox.com/privacy.

  • Adobe provides creative software used in the preparation of marketing materials. Adobe's privacy policy is available here: https://www.adobe.com/uk/privacy/policy.html. 

  • Meta Platforms Ireland Ltd (Facebook, Instagram and WhatsApp) is used for our social media presence and for client communications where clients contact us via those channels. Meta's privacy policy is available here: https://www.facebook.com/privacy/policy.
     

Some of these external third parties store or process personal data outside the United Kingdom. Where they do, we ensure that a similar degree of protection is afforded to your personal data by relying on one of the following: (a) the country has been deemed to provide an adequate level of protection by UK adequacy regulations; (b) we have entered into the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, with the provider; or (c) for transfers to the United States, the provider is certified under the UK Extension to the EU-US Data Privacy Framework (the UK-US Data Bridge).
 

We may also provide third parties with aggregated but anonymised information and analytics about our customers. Before we do so, we will make sure that the information does not identify you.
 

In addition to the third party IT and systems providers referred to above, we may also:

  • share your personal data with other third parties if you specifically request this and have consented to it.

  • in exceptional circumstances, share personal data if we consider that there is a real risk of harm to you or to others.

  • on occasion, share your personal data with our professional advisers such as lawyers, bankers, auditors and insurers.

  • share your personal data with HM Revenue & Customs, regulators and other authorities based in the United Kingdom if they request this.

  • transfer your personal data to any new owner, if we sell, transfer, or merge parts of our business or assets. Any new owner of our business may continue to use your personal data in the same way(s) that we have used it, as specified in this Privacy Notice.

  • be legally required to share certain personal data, which might include yours, if:

    • we are involved in legal proceedings

    • we are complying with legal obligations, for example as regards safeguarding, terrorism, money laundering or drug trafficking

    • we are complying with a court order

    • we are complying with the instructions of a government authority

  • be required to share certain personal data, which might include yours, by a regulatory body, for example in relation to a client complaint or regulatory breach or investigation.
     

If any of your personal data is shared with a third party, as described above, we will take steps to ensure that your personal data is handled safely, securely, and in accordance with your rights, our obligations, and the third party's obligations under the law.
 

11. Controlling and withholding your personal data

​

In addition to your rights under the Data Protection Legislation, set out in Section 5 above, when you submit personal data via Our Site, you may be given options to restrict our use of your personal data. We aim to give you control over our use of your data for direct marketing purposes (including the ability to opt out of receiving marketing emails from us), which you may do by unsubscribing using the links provided.
 

You may access certain areas of Our Site without providing any personal data. However, to use all features and functions available on Our Site you may be required to submit or allow for the collection of certain data.
 

You may restrict our use of Cookies. For more information, see our Cookie Policy which is available on Our Site.

bottom of page