Privacy Policy

Data controller

1. Purpose of this policy

We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, store and protect your personal information when you visit our website or use our services.

This policy applies to www.councilculture.uk and all associated subdomains.

By using our website, you acknowledge this policy.

2. Personal data we collect

We may collect and process the following information, depending on how you interact with us:

• Full name
• Email address
• Telephone number
• Postal address
• Company or council name
• Payment information, processed securely by third-party providers and not stored by us
• IP address
• Browser type, device and operating system
• Website usage data and analytics
• Any information you voluntarily provide through forms, emails or bookings

We do not collect special category data.

3. How we use your personal data

We use your personal data to:

• Respond to enquiries
• Deliver training, courses, events and consultancy services
• Manage bookings, contracts and invoices
• Communicate essential service information
• Send marketing communications where you have actively opted in
• Improve our website, services and user experience
• Comply with legal, regulatory and professional obligations

We do not sell personal data and we do not send unsolicited marketing.

4. Lawful bases for processing

We process personal data under one or more of the following lawful bases:

Consent

For newsletters, updates and marketing communications where you have opted in.

Contract

Where processing is necessary to deliver a service you have requested or booked.

Legal obligation

Where required for tax, accounting or regulatory compliance.

Legitimate interests

For running and improving our business, including website analytics, service improvement, fraud prevention and administrative management. These interests are balanced against your rights and freedoms.

5. Data sharing and third-party processors

We share personal data only where necessary and proportionate. This may include:

All third-party providers are required to comply with UK GDPR and use your data only for agreed purposes.

6. International data transfers

Some third-party providers may process personal data outside the UK.

Where this occurs, we ensure appropriate safeguards are in place, including:

• UK adequacy regulations
• Standard contractual clauses
• Data protection agreements with providers

These measures are designed to ensure your data receives an equivalent level of protection.

7. Data retention

We retain personal data only for as long as necessary:

• Marketing subscribers: until you unsubscribe
• Enquiries with no ongoing relationship: up to 12 months
• Client and booking records: up to 7 years to meet legal and accounting requirements
• Website analytics data: up to 26 months

Data is securely deleted when no longer required.

8. Your data protection rights

Under UK GDPR, you have the right to:

• Access your personal data
• Correct inaccurate or incomplete data
• Request erasure
• Restrict processing
• Object to processing
• Request data portability
• Withdraw consent at any time

We will respond to valid requests within one month. Requests can be made by emailing becky@beckywalsh.com.

If you are unhappy with how your data is handled, you may complain to the Information Commissioner's Office.

9. Cookies and tracking technologies

Our website uses cookies to ensure functionality and measure performance. These include:

• Essential cookies required for site operation
• Analytics cookies to understand website use

Analytics cookies are used only where consent is provided. You can manage or disable cookies through your browser settings. Disabling cookies may affect website functionality.

10. Children's data

Our services are not directed at children and we do not knowingly collect personal data from individuals under 16 years of age.

If you believe a child's data has been provided to us, please contact us and we will delete it promptly.

11. Automated decision-making

We do not use automated decision-making or profiling that produces legal or significant effects.

12. Data security

We take appropriate technical and organisational measures to protect personal data, including:

• Secure systems and password protection
• Limited access to authorised personnel
• Secure payment processing through trusted providers

Despite these measures, no online transmission is entirely secure.

13. Changes to this policy

We may update this Privacy Policy from time to time. Updates will be published on this page with a revised effective date.