Privacy Policy for Indigo Story Arts

Last updated: 20 March 2026

1. Introduction

This Privacy Policy explains how Indigo Story Arts ("we", "us", or "our") collects, uses, discloses and protects your personal information when you use our services, visit our website, interact with our online content, or otherwise engage with us. We are committed to safeguarding your privacy and handling your data in a transparent and lawful manner.

We operate in England and process personal data in accordance with applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

By using our services or accessing our website, you agree to the terms of this Privacy Policy.

2. Who we are

Indigo Story Arts Category: Art Region: England

We create, present and promote artistic content, projects and related services. For the purposes of applicable data protection law, we are the "data controller" in respect of your personal data.

3. Personal data we collect

We may collect and process the following categories of personal data:

3.1 Information you provide to us

• Contact details: name, email address, telephone number, postal address
• Account details (if applicable): username, password and profile information
• Communication data: content of emails, messages or other correspondence you send to us
• Payment and billing information: payment method, billing address and transaction details (processed via secure payment providers; we do not store full card details)
• Project and submission information: materials, artwork, texts, proposals or other content you submit to us
• Event-related information: registrations, attendance details, preferences and feedback

3.2 Information collected automatically When you visit our website or interact with our online services, we may automatically collect:

• Usage data: pages visited, time and date of visit, time spent on pages, links clicked, referring/exit pages
• Device and technical data: IP address, browser type and version, device type, operating system, language settings
• Cookies and similar technologies: small data files stored on your device that help us recognise you and improve our services (see "Cookies and similar technologies" below)

3.3 Information from third parties We may receive personal data about you from:

• Payment processors and service providers
• Social media platforms, if you interact with our pages or content there
• Event partners, collaborators or platforms used to organise events, exhibitions or performances

4. How we use your personal data

We process your personal data only when we have a legal basis to do so. We may use your information for the following purposes:

4.1 To provide and manage our services

• To operate and maintain our website, platforms and online content
• To manage your account, if you register with us
• To process orders, payments, subscriptions or donations
• To organise and manage events, exhibitions, workshops or other artistic activities

4.2 To communicate with you

• To respond to your enquiries, requests and feedback
• To send you administrative messages, such as service notifications, updates, or changes to our terms and policies
• To send you marketing communications (such as newsletters, updates on projects and events, or promotional offers) where permitted by law or with your consent

4.3 To improve and develop our services

• To analyse how our website and services are used
• To develop new content, features and offerings
• To personalise your experience and present content tailored to your interests where allowed by law or with your consent

4.4 To ensure security and comply with legal obligations

• To protect the security and integrity of our systems, website and services
• To prevent, detect and investigate fraud, misuse or other illegal activities
• To comply with legal obligations, court orders or requests from competent authorities

5. Legal bases for processing

We rely on the following legal bases under UK GDPR to process your personal data:

• Performance of a contract: where processing is necessary to provide services you have requested, or to take steps at your request before entering into a contract
• Legitimate interests: where processing is necessary for our legitimate artistic, operational and business interests, and your interests or fundamental rights do not override those interests (for example, to improve our services, maintain security, or communicate with you about similar services)
• Consent: where you have provided your clear consent (for example, for certain marketing communications or particular types of cookies)
• Legal obligation: where processing is necessary for compliance with a legal obligation to which we are subject

6. Cookies and similar technologies

We use cookies and similar technologies on our website to:

• Enable basic site functionality
• Remember your preferences
• Understand how visitors use our website
• Improve performance and user experience

Where required by law, we will ask for your consent before using non-essential cookies. You can control cookies through your browser settings, but disabling certain cookies may affect the functionality of our website.

7. How we share your personal data

We do not sell your personal data. We may share your personal data with:

• Service providers and contractors who perform services on our behalf (such as hosting providers, payment processors, email service providers, analytics providers, event platforms and technical support)
• Professional advisers (such as lawyers, accountants or auditors) where necessary
• Partners, collaborators or institutions involved in joint events or projects, where necessary for participation or organisation and where allowed by law
• Authorities, regulators or law enforcement, where required by law or necessary to protect our rights or the rights and safety of others

We require all third parties who process personal data on our behalf to protect your data in accordance with this Privacy Policy and applicable law.

8. International data transfers

Your personal data may be transferred to and processed in countries outside the United Kingdom. Where we transfer personal data to a country that has not been deemed to provide an adequate level of data protection, we will implement appropriate safeguards, such as standard contractual clauses approved by relevant authorities, or other lawful mechanisms, to ensure your data is protected.

9. Data retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to meet legal, accounting or reporting requirements. Retention periods may vary depending on the type of data and the nature of our relationship with you.

When we no longer need personal data, we will delete or anonymise it in a secure manner.

10. Your rights

Under UK data protection law, you may have the following rights (subject to certain conditions and exceptions):

• Right of access: to obtain confirmation of whether we process your personal data and to receive a copy of that data
• Right to rectification: to request correction of inaccurate or incomplete personal data
• Right to erasure: to request deletion of your personal data where there is no compelling reason for us to continue processing it
• Right to restriction: to request that we restrict the processing of your personal data in certain circumstances
• Right to data portability: to receive the personal data you provided to us in a structured, commonly used and machine-readable format and, where technically feasible, to have it transmitted to another controller
• Right to object: to object to processing based on our legitimate interests or for direct marketing purposes
• Right to withdraw consent: where processing is based on your consent, you may withdraw that consent at any time. This will not affect the lawfulness of processing based on consent before its withdrawal.

To exercise your rights, please contact us using the contact details provided in the "Contact us" section below. We may need to verify your identity before responding to your request.

11. Security

We employ appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. While we strive to protect your personal data, no method of transmission or storage is completely secure. You use our services at your own risk.

If you have created an account with us, you are responsible for choosing a strong password and keeping it confidential.

12. Children’s privacy

Our services are generally not directed at children under the age of 13, and we do not knowingly collect personal data from children under 13 without appropriate consent as required by law. If you believe that a child has provided us with personal data without such consent, please contact us so that we can take appropriate steps.

13. Third-party websites and services

Our website or communications may contain links to third-party websites, services or social media platforms. We are not responsible for the privacy practices or content of those third parties. We encourage you to review the privacy policies of any third-party sites or services you visit.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements or other factors. When we make significant changes, we will indicate the date of the latest update at the top of this document and, where appropriate, notify you by email or by a notice on our website.

Your continued use of our services after an updated Privacy Policy is posted will indicate your acceptance of the changes.

15. Contact us

If you have any questions, concerns or requests regarding this Privacy Policy or our handling of your personal data, please contact Indigo Story Arts using the contact details provided on our official website or through the communication channels you normally use to reach us.

We will do our best to respond to your enquiry promptly and to address any concerns you may have about your privacy.