Privacy Policy
CASTLE ART SUPPLIES LIMITED PRIVACY POLICY
1. INTRODUCTION
1.1 Welcome to Castle Arts Supplies Limited privacy policy.
1.2 Castle Arts Supplies Limited (“Castle Arts Supplies”) respects your privacy and is
committed to protecting your personal data. This privacy policy will inform you as to how
we look after your personal data and tell you about your privacy rights and how the law
protects you. We ask that you read this privacy policy carefully as it contains important
information about what to expect when Castle Arts Supplies collects personal
information about you and how Castle Arts Supplies will use your personal data.
1.3 Castle Arts Supplies is a UK limited company, registered in 2011 at Companies House,
(CRN: 07482186).
1.4 This policy applies to information we collect about:
1.4.1 our customers;
1.4.2 those who register as members of the Castle Club;
1.4.3 those who sign up via social media platforms;
1.4.4 visitors to our website;
1.4.5 artists via our Ambassador Scheme and their interviews on our Blog; and
1.4.6 other users and those who enquire about our products and services.
2. PURPOSE OF THIS PRIVACY POLICY
2.1 This privacy policy aims to give you information on how Castle Arts Supplies collects
and processes your personal data when you enquire about our products and services
or from your use of our website.
2.2 This privacy policy is not intended for children, and we do not knowingly collect data
relating to children when processing personal data of our customers and visitors to our
site. However, where this inadvertently happens, such data will usually be limited only
to that required to complete a purchase transaction and no other information will be
processed about them.
3. WHO WE ARE
3.1 This privacy policy is issued on behalf of the Castle Arts Supplies (see below) so when
we mention "we", "us" or "our" in this privacy policy, we are referring to Castle Arts
Supplies.
3.2 Castle Arts Supplies is a data controller in respect of data collected in running its
business and is responsible for your personal data.
3.3 If you have any questions about this privacy policy or our privacy practices, please make
contact in the following ways:
3.3.1 By email to: info@castlearts.com.
Last Reviewed 30 January 2025
SN-7224382_4
3.3.2 Website contact address: www.uk.castlearts.com/pages/contact-us.
3.3.3 Postal address: 1 St James Gate, Newcastle upon Tyne, NE1 4AD, United
Kingdom.
3.4 You have the right to make a complaint at any time to the Information Commissioner's
Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk).
We would, however, appreciate the chance to deal with your concerns before you
approach the ICO so please contact us in the first instance.
4. THE DATA WE COLLECT ABOUT YOU
4.1 Personal data, or personal information, means any information about an individual from
which that person can be identified. It does not include data where the identity has been
removed (anonymous data).
4.2 When you visit our website, enquire about our products and services or make a purchase
from our online shop, we may collect, use, store and transfer the different kinds of
personal data about you. Personal data collected includes those in all formats (i.e. paper
copy and digital).
4.3 We also collect personal information from our artists, during telephone calls or when you
contact us using our website contact page. Castle Arts Supplies collects personal data
via social media channels, such as Meta, Instagram, TikTok and Pinterest.
4.4 Don’t wish to provide us with your personal data?
This is, of course, your prerogative. However, we do need to collect your personal data
to perform our contract with you, and without it, we may not be able to provide you with
our services or products. In this case, we may have to cancel your order. We hope that
this is not the case, but we will notify you if this becomes necessary.
4.5 The different kinds of data we may process are as follows:
Contact Data includes first name and last name, postal address including country,
email address [and telephone numbers, including mobile numbers] and social
media channels including Meta, Instagram, TikTok and Pinterest.
Profile Data includes purchase and product history, date of subscription (if any),
source, language and time zones.
Finance Data includes bank account, card payment information and credit
reference information (where using third party payment options such as Klarna) in
respect of product purchases.
Technical Data includes internet protocol (IP) address, your login data, browser
type and version, time zone setting and location, browser plug-in types and
versions, operating system and platform and other technology on the devices you
use to access our website or communicate with us (please see our Cookie Policy
for further information about this).
Marketing and Communications Data includes your preferences in receiving
marketing from us such as our newsletters, emails, SMS and your communication
preferences.
Last Reviewed 30 January 2025
SN-7224382_4
4.6 We gather this information to allow us to provide our products and services to you. As
part of our products and services, we will use this information to communicate with you
and to analyse our data to identify patterns, enabling us to provide targeted support and
marketing to enhance your experience with us.
4.7 We also collect and use Aggregated Data such as statistical or demographic data for
any purpose. Aggregated Data could be derived from your personal data but is not
considered personal data in law as this data will not directly or indirectly reveal your
identity. For example, we may aggregate your Profile Data to calculate the percentage
of users interested in a particular product line.
4.8 It is important that the personal data we hold about you is accurate and current. Please
keep us informed if your personal data changes during your relationship with us.
5. SPECIAL CATEGORIES OF PERSONAL DATA
5.1 We do not intend to collect (and we ask that you do not disclose) any particularly
sensitive data to us such as information relating to your race or ethnicity, religious or
philosophical beliefs, sex life, sexual orientation, political opinions, genetic and biometric
data and information about your health.
6. HOW WE USE YOUR PERSONAL DATA
6.1 We will only use your personal data when the law allows us to. Most commonly, we will
use your personal data in the following circumstances:
6.1.1 Where you are a Castle Arts Supplies customer, and we need to perform the
contract we are about to enter into or have entered into with you.
6.1.2 Where it is necessary for our legitimate interests (or those of a third party)
and your interests and fundamental rights do not override those interests.
6.1.3 Where we need to comply with a legal or regulatory obligation.
6.1.4 Where you have consented to the processing of the personal data so that we
may provide details about our products and services to you.
6.2 We will use your personal data to perform the following activities:
6.2.1 to register you and respond to your enquiry on our website or via the various
social media channels available to contact us;
6.2.2 to provide our products and services to our members;
6.2.3 to inform our members and customers about conferences and events;
6.2.4 to tell you about our products and services (unless you have asked us not to
contact you);
6.2.5 to undertake training and quality assurance to help us continuously provide the
best possible service; or
6.2.6 to report, assess and learn from any feedback that we receive.
Last Reviewed 30 January 2025
SN-7224382_4
7. WHO WE MAY PROVIDE YOUR PERSONAL DATA TO
7.1 We do not generally share your personal data outside of Castle Arts Supplies as we
understand that this information is private. However, in limited circumstances, we may
need to provide your personal data to certain third parties such as:
our suppliers (acting as data processors or separate data controllers) who
support our business and enable us to provide our products and services (this
information will only be that which they require to deliver their products and
services to us or on our behalf);
Online advertising related service providers providing social media platforms and
advertising networks to deliver, tailor and measure advertising to you (including
platforms such as Shopify, Meta, Instagram, TikTok and Pinterest);
HM Revenue & Customs, regulators and other public authorities based in the UK
who require reporting of processing activities in certain circumstances;
professional advisers including lawyers, bankers, auditors, pension providers
and insurers who provide consultancy, banking, legal, pension, insurance and
accounting products and services;
service providers acting as processors who provide website, IT, system
administration products and services and data analytic providers;
providers of financial transaction and payment products and services, acting as
data processors (including Klarna); and
third parties to whom we may choose to sell, transfer or merge parts of our
organisation or our assets. Alternatively, we may seek to acquire other
businesses or organisations, or merge with them. If a change happens to Castle
Arts Supplies, then the new owners may use your personal data in the same way
as set out in this privacy policy.
7.2 We require all third-party data processors to respect the security of your personal data
and to treat it in accordance with the law. We do not allow our third-party service
providers to use your personal data for their own purposes and only permit them to
process your personal data for specified purposes and in accordance with our
instructions.
7.3 Castle Arts Academy and Creative Origins Limited
We are telling our customers and members about the exciting new Castle Arts Academy
for aspiring new artists and those interested in developing their artistic talent. Castle
Arts Academy is the trading name for Creative Origins Limited, a separate data
controller. Where our customers and members are interested in joining Castle Arts
Academy and want to register this interest we will, with your consent, share your Contact
Data with Creative Origins Limited. For further details about how Creative Origins
Limited will use your personal data, please see its privacy policy which is available at
www.castlearts-academy.com.
7.4 Where we are required to transfer your personal data to other data controllers, such as
regulators as set out in paragraph 7.1, we do so in accordance with the law. Details as
to how these third-party organisations process this personal data should be obtained
Last Reviewed 30 January 2025
SN-7224382_4
directly from their privacy policies. Your right to object directly to any data controllers
in relation to the processing of personal data remains intact.
8. MARKETING
8.1 We strive to provide our customers and members with choices regarding certain
personal data uses, particularly around marketing and advertising.
8.2 We may use personal information of our customers and members to form a view on
what we think they may be of interest to them. However, we do not contact you with
marketing communications where you have indicated to us that you do not wish us to
do this.
8.3 We won’t ever share your personal data with any company outside of Castle Arts
Supplies for marketing purposes without your consent.
8.4 Opting out - you can ask us to stop sending you messages by contacting us at any time,
using the details contained in this privacy policy.
9. COOKIES
9.1 Cookies are text files placed on your computer to collect standard Internet log
information and visitor behaviour information. The information is used to track visitor use
of the website and to compile statistical reports on website activity. For further
information about cookies visit www.aboutcookies.org or www.allaboutcookies.org.
9.2 We refer you to our Cookie Policy which sets out our practices in relation to our website.
10. CHANGE OF PURPOSE
10.1 We will only use your personal data for the purposes for which we collected it, unless
we reasonably consider that we need to use it for another reason and that reason is
compatible with the original purpose. If we need to use your personal data for an
unrelated purpose, we will notify you and we will explain the legal basis which allows us
to do so.
10.2 Please note that we may process your personal data without your knowledge or consent,
in compliance with the above rules, where this is required or permitted by law.
11. INTERNATIONAL TRANSFERS
11.1 The data that we collect from you is stored on servers based in the UK. Where your
personal data is held in a destination outside the UK and/or the European Economic
Area (“EEA”), we have recognised safeguards in place to protect your personal data in
accordance with the Data Protection Legislation. Please contact us at
www.uk.castlearts.com/pages/contact-us if you have any questions.
12. DATA SECURITY
12.1 We have put in place appropriate security measures to prevent your personal data from
being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.
In addition, we limit access to your personal data to those employees and suppliers who
have a business need to know. They will only process your personal data on our
instructions, and they are subject to a duty of confidentiality.
Last Reviewed 30 January 2025
SN-7224382_4
12.2 We have put in place procedures to deal with any suspected personal data breach and
will notify you and any applicable regulator of a breach where we are legally required to
do so.
13. DATA RETENTION
13.1 We will only retain your personal data for as long as necessary to fulfil the purposes we
collected it for, including for the purposes of satisfying any legal, accounting, or reporting
requirements.
13.2 To determine the appropriate retention period for personal data, we consider the
amount, nature, and sensitivity of the personal data, the potential risk of harm from
unauthorised use or disclosure of your personal data, the purposes for which we process
your personal data and whether we can achieve those purposes through other means,
and the applicable legal requirements.
13.3 Where we process personal data of our members, visitors and customers, we will delete
this information after a period of 6 years in accordance with our policies in relation to
data retention or you otherwise indicate that you would like us to delete it. We will only
retain personal data for longer if we feel that this is in our legitimate interests or if
required in compliance with our statutory or regulatory obligations.
13.4 To ask Castle Arts Supplies to delete your data, please see below for further information.
14. YOUR LEGAL RIGHTS
14.1 Under certain circumstances, you have rights under data protection laws in relation to
your personal data. If you wish to exercise any of these rights, please contact us.
14.2 You will not have to pay a fee to access your personal data (or to exercise any of the
other rights). However, we may charge a reasonable fee if your request is clearly
unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your
request in these circumstances.
14.3 We may need to request specific information from you to help us confirm your identity
and ensure your right to access your personal data (or to exercise any of your other
rights). This is a security measure to ensure that personal data is not disclosed to any
person who has no right to receive it. We may also contact you to ask you for further
information in relation to your request to speed up our response.
14.4 We try to respond to all legitimate requests within one month. Occasionally it may take
us longer than a month if your request is particularly complex or you have made a
number of requests. In this case, we will notify you and keep you updated.
14.5 You have the legal right:
14.5.1 To request access to your personal data (commonly known as a "data subject
access request"). This enables you to receive a copy of the personal data we
hold about you and to check that we are lawfully processing it.
14.5.2 To request correction of the personal data that we hold about you. This enables
you to have any incomplete or inaccurate data we hold about you corrected,
though we may need to verify the accuracy of the new data you provide to us.
Last Reviewed 30 January 2025
SN-7224382_4
14.5.3 To request erasure of your personal data. This enables you to ask us to delete
or remove personal data where there is no good reason for us continuing to
process it. Note, however, that we may not always be able to comply with your
request of erasure for specific legal reasons which will be notified to you, if
applicable, at the time of your request.
14.5.4 To object to processing of your personal data where we are relying on a
legitimate interest (or those of a third party) and there is something about your
particular situation which makes you want to object to processing on this ground
as you feel it impacts on your fundamental rights and freedoms.
14.5.5 To request restriction of processing of your personal data. This enables you to
ask us to suspend the processing of your personal data in certain
circumstances.
14.5.6 To request the transfer of your personal data to you or to a third party. We will
provide to you, or a third party you have chosen, your personal data in a
structured, commonly used, machine-readable format.
14.5.7 To withdraw consent at any time where we are relying on consent to process
your personal data.
15. CONTACT US
15.1 If you have any questions in relation to this privacy policy, please contact our Data
Privacy Manager by email at info@castlearts.com.