Privacy Policy
Who We Are
This privacy policy applies to Lucy’s Aurora Arts, a sole trader providing inclusive, one-to-one performing arts sessions based in Thirsk, North Yorkshire.
Data controller: Lucy Barwick-ward trading as Lucy’s Aurora Arts
Website: lucysauroraarts.co.uk
Phone / WhatsApp: +44 7494 072612
Email: contact.auroraarts@gmail.com
As a sole trader, Lucy’s Aurora Arts is the data controller responsible for your personal information. This policy explains what data is collected, why, and how it is handled — in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
What Data We Collect
We collect personal data through the enquiry form on this website. The table below sets out exactly what is collected, why, and on what legal basis.
| Data collected | Required? | Purpose |
|---|---|---|
| Full name | Required | To address you correctly and identify your enquiry |
| Email address | Required | To respond to your enquiry |
| Phone number | Optional | To contact you directly if you prefer a call or WhatsApp |
| Sessions interested in | Required | To understand which creative discipline(s) are relevant |
| Who the session is for | Required | To tailor the response appropriately |
| Age of participant | Required | To ensure the correct session approach is offered |
| Any relevant needs or diagnosis Special Category | Required | To prepare an appropriate, safe session plan before first contact |
| Location / nearest town | Required | To confirm whether Lucy can travel to your area |
| What you’re looking for (free text) | Optional | To allow you to give context in your own words before a call |
| How you heard about us | Optional | Internal business insight only — not shared or used for marketing |
We do not collect any data through this website other than what is listed above. We do not use your data for marketing, and we do not send newsletters or promotional emails.
Special Category Data — Health and Diagnosis Information
The enquiry form includes a field asking about any relevant needs or diagnosis. Under UK GDPR, information relating to health conditions, disabilities, and diagnoses is classified as special category data and receives a higher level of legal protection.
Why we collect this
This information is collected solely to allow Lucy to prepare an appropriate, safe, and properly adapted session plan before first contact. Without a basic understanding of a participant’s needs, it is not possible to provide genuinely inclusive, one-to-one performing arts sessions that meet each individual’s requirements.
Lawful basis for special category data
We rely on explicit consent as our lawful basis for processing special category data. By submitting the enquiry form, you are explicitly consenting to Lucy’s Aurora Arts processing this information for the purpose of preparing and delivering personalised sessions.
You may withdraw this consent at any time by contacting us. Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal.
How this data is handled
Health and diagnosis information submitted through the enquiry form is:
— Accessible only to Lucy (the sole data controller and practitioner)
— Stored in a private, password-protected spreadsheet
— Never shared with third parties except where required by law
— Retained only for as long as necessary
How We Use Your Data
We use the personal data collected through the enquiry form for the following purposes only:
1. Responding to your enquiry — to get back to you via email, phone, or WhatsApp within 24 hours of receiving your message.
2. Preparing initial session planning — to prepare an appropriate session structure before a first conversation, using the information you have shared about the participant’s needs, interests, and comfort.
3. Ongoing session administration — if you proceed with sessions, your contact details and relevant participant information are retained to support the ongoing relationship, session planning, and communication.
4. Internal record keeping — for basic business administration purposes, including tracking enquiries and session participants.
We do not use your data for automated decision-making, profiling, or any form of direct marketing. We will never sell, rent, or share your data with any third party for commercial purposes.
Lawful Basis for Processing
Under UK GDPR, we must have a lawful basis for processing your personal data. The following bases apply to Lucy’s Aurora Arts:
| Processing activity | Lawful basis |
|---|---|
| Responding to enquiries | Legitimate interests — responding to a direct request you have made |
| Session planning and delivery | Contract — necessary to deliver the service you have requested |
| Health / diagnosis information Special Category | Explicit consent — given at point of form submission |
| Internal record keeping | Legitimate interests — standard business administration |
| Website analytics (Google Analytics) | Consent — via cookie consent (see Section 8) |
How Long We Keep Your Data
We retain personal data only for as long as necessary for the purpose it was collected.
| Enquiry data (no sessions booked) | Deleted within 6 months of the enquiry if no sessions are arranged |
| Active participant data | Retained for the duration of the session relationship |
| Former participant data | Deleted within 12 months of the last session |
| Health / diagnosis information Special Category | Deleted in line with the above — not retained beyond the above periods |
| Google Analytics data | Retained by Google for up to 26 months (see Google’s own privacy policy) |
If you wish to have your data deleted before these periods expire, please contact us — we will comply with any deletion request promptly and within 30 days.
How Long We Keep Your Data
We retain personal data only for as long as necessary for the purpose it was collected.
| Enquiry data (no sessions booked) | Deleted within 6 months of the enquiry if no sessions are arranged |
| Active participant data | Retained for the duration of the session relationship |
| Former participant data | Deleted within 12 months of the last session |
| Health / diagnosis information Special Category | Deleted in line with the above — not retained beyond the above periods |
| Google Analytics data | Retained by Google for up to 26 months (see Google’s own privacy policy) |
If you wish to have your data deleted before these periods expire, please contact us — we will comply with any deletion request promptly and within 30 days.
Who We Share Your Data With
Lucy’s Aurora Arts does not sell, trade, or share your personal data with third parties for commercial purposes. Data may be shared only in the following limited circumstances:
Google Analytics
This website uses Google Analytics to understand how visitors use the site (pages visited, time on site, general location by region). Google Analytics does not receive your name, email address, or any form data. Data is collected via cookies and is subject to Google’s own privacy policy.
Legal disclosure
We may disclose personal data if required to do so by law, court order, or a regulatory authority. We will notify you of any such disclosure where we are legally permitted to do so.
No other sharing
Cookies
Cookies are small text files placed on your device when you visit a website. This website currently uses cookies for analytics purposes via Google Analytics.
Your Rights Under UK GDPR
Under UK GDPR, you have the following rights in relation to your personal data. To exercise any of these rights, contact us using the details in last section. We will respond within 30 days.
- Right of access
You can request a copy of the personal data we hold about you.
- Right to rectification
You can ask us to correct inaccurate or incomplete data.
- Right to erasure
You can ask us to delete your personal data in certain circumstances.
- Right to restrict processing
You can ask us to limit how we use your data while a dispute is resolved.
- Right to data portability
You can request your data in a structured, machine-readable format.
- Right to object
You can object to processing based on legitimate interests.
- Right to withdraw consent
Where processing is based on consent, you can withdraw it at any time.
- Rights re: automated decisions
We do not carry out automated decision-making or profiling.
If you believe your data rights have not been respected, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) — the UK’s data protection authority.
ICO website: ico.org.uk
ICO helpline: 0303 123 1113
Contact Us & How to Make a Complaint
If you have any questions about this privacy policy, wish to exercise your data rights, or have a concern about how your information has been handled, please contact Lucy directly.
Phone / WhatsApp: +44 7494 072612
Email: contact.auroraarts@gmail.com
Post: Lucy’s Aurora Arts, Thirsk, North Yorkshire
We aim to respond to all data-related requests within 30 days of receipt.
This policy was last reviewed and updated in June 2026. We will update this page whenever our data practices change — please check back periodically.