What we do with your data

We ask for as little as we can get away with, we tell you what it’s for, and we don’t sell any of it. This page explains exactly what we hold, why, and how to get rid of it.

Who we are

Draw Together CIC, a community interest company registered in England and Wales under company number 17379933. Our registered office is Avondale, Main Street, West Haddlesey, North Yorkshire, YO8 8QA. We are the data controller for the information described here.

For anything about your data, email hello@draw-together.co.uk.

What we collect

When you create an account

• Your name. Your name is never shown publicly alongside your artwork - session galleries show the work on its own. It appears to the volunteers running a session you’ve booked, so they know who’s coming, and it’s shown publicly only if you take on a public role yourself, as a patron running a studio or a muse leading a session.
• Your email address, which is how you sign in and how we send you booking confirmations.
• Confirmation that you’re 18 or over, and the date you confirmed it.
• A password, stored as a one-way hash. We cannot see it, and neither can anybody else with access to our database.
• How you heard about us, if you choose to tell us. This is optional and you can leave it blank.

When you book a seat

• Which session you booked, and when you booked it.
• Whether you asked for a materials kit.
• Whether you attended, cancelled, or didn’t turn up. We keep this because repeated no-shows affect whether you can book, and because the patron needs to know who to expect.
• Your position on the waiting list, if you joined one.

When work is photographed

At the end of a session the muse photographs the work people have made. Those photographs are attached to your account so they build up into your personal gallery over time, and they appear on the session’s page without saying who made what.

We don’t upload photographs to this website that show people. What goes online is the work, not the room and not the people in it. If something does slip through with you visible in it, tell us and we’ll take it down.

When you apply to run a studio

Your name, email address, the venue you have in mind and whatever you tell us about yourself in the application. We keep it while we consider the application and, if we approve it, for as long as you’re a patron.

Checking your age

At a session, a patron or muse may occasionally ask to see something confirming you’re over 18. They look at it and hand it straight back. We don’t photograph it, copy it, or record anything from it.

Why we hold it, and on what basis

Most of what we hold is there because we need it to run the thing you asked us to run - a seat at a session. In data protection terms that’s a contract with you. Without your name, email address and booking record there is no booking.

Announcements about new studios or sessions go out on the basis of consent, which you give by asking for them and can withdraw at any time using the unsubscribe link on any one of them.

Attendance and no-show records are held on the basis of our legitimate interest in running a fair booking system where a small number of people can’t repeatedly take seats they don’t use.

Some of the email we send is transactional rather than promotional: confirming a booking, telling you a seat has come free, letting you know a session has been cancelled. Those don’t carry an unsubscribe link, because they’re the service itself rather than marketing. If you no longer want them, close your account.

We will never sell your data, or pass it to anyone for their own marketing.

Who else sees it

The patron and muse of a session you’ve booked see your name on their attendee list, so they know who to expect and can mark you present. They don’t see your email address or your bookings at other studios.

Nobody else sees your name on the site. There is no public attendee list, and no way to look up who is coming to a session. Other people at a session see the work you make, shown without a name against it, and whatever you choose to tell them in the room.

Our website and database are hosted on servers in the United Kingdom. Photographs of artwork are stored with a cloud storage provider. Both process the data on our behalf, under contract, and do nothing else with it.

Analytics

We use Google Analytics, loaded through Google Tag Manager, to understand how the site is used - which pages people read, which studios they look at, whether anyone actually finds the booking form. It tells us how the site is doing in aggregate. We don’t use it to build a profile of you, and we don’t use it for advertising.

It sets cookies and processes some data, including a shortened form of your IP address, on servers that may be outside the UK. Google acts as our processor and transfers are covered by the UK extension to the EU-US Data Privacy Framework and standard contractual clauses.

It only runs if you agree to it. We ask when you first visit, nothing analytics-related is set until you say yes, and you can change your mind at any time. Saying no doesn’t change how the site works.

We don’t use advertising cookies, tracking pixels or social media plugins.

Cookies

Ones we can’t do without. Our web framework sets a cookie to keep your session secure and to keep you signed in. Without it you couldn’t log in or book a seat. It doesn’t follow you to other sites.

Ones you choose. Google Analytics, described above, only after you agree.

We also store your light or dark theme choice in your browser, so the site looks the way you left it. That never reaches our servers.

How long we keep it

• Your account, until you close it or ask us to delete it.
• Your bookings and attendance, for as long as your account exists. No-show records stop counting against you long before that - see the group rules.
• Photographs of your work, indefinitely, as part of the record of the session they were made at. They’re shown without a name against them. Close your account and they stay up as part of that evening, but they stop being connected to you and leave your personal gallery.
• Announcement subscriptions, until you unsubscribe.
• Patron applications we declined, for a year, so we know we’ve already had the conversation.
• Analytics data, for 14 months, after which Google deletes it.

Delete your account and we remove your personal details. What stays is the anonymous shape of what happened: that a seat was filled at a given session, and the work made that evening. Neither points at you any more. If you’d rather a particular photograph came down as well, ask us and we’ll remove it.

Your rights

UK data protection law gives you rights over your data: to see it, correct it, delete it, or withdraw consent where we rely on it. Email hello@draw-together.co.uk and we’ll sort it out within a month. If you’re unhappy with how we’ve handled it, you can complain to the Information Commissioner’s Office at ico.org.uk.

Changes

We’ll update this page whenever what we do with your data changes, rather than quietly doing something new. The date at the top tells you when it last changed.