Project Factory CIC — Privacy Policy

DATE AND VERSION OF THIS PRIVACY NOTICE

16th October 2026 / v2

Who we are

Project Factory CIC is a Community Interest Company registered in England and Wales, company number 12097914. Our registered office and postal address is Launcherley Farm, Launcherley, Wells BA5 1QJ.

We are the controller of personal information we collect and use for the purposes described in this policy. This policy explains how we handle information about people who contact us, subscribe to our updates, or take part in our projects, events and workshops, including children and their parents or carers.

How to contact us

Email: hello@projectfactory.uk
Post: Project Factory CIC, Launcherley Farm, Launcherley, Wells BA5 1QJ

Please use these details for questions about this policy, requests relating to your personal information, or privacy complaints.

Information we collect

Depending on how you interact with us, we may collect:

• Your name, email address and telephone number.

• Enquiries, correspondence and your preferences for receiving updates.

• Booking, registration and attendance details for our events and workshops.

• Children’s participation details and relevant parent or carer contact information.

• Accessibility requirements you choose to tell us about, which may include health or disability information.

• Photographs in which you can be identified, and records of any relevant permissions or objections.

We aim to collect only the information needed for a stated purpose. Where information is necessary to arrange a booking or support participation, we will explain this when asking for it, including the effect of not providing it.

Where information comes from

We collect information directly from you when you contact us, subscribe to updates, register for an activity or provide information during a project. We also receive registration information through Eventbrite, and may receive children’s participation information from their parent or carer.

How and why we use information

We use personal information only where we have an appropriate lawful basis under UK data protection law.

• Enquiries and community activities: we use contact details and correspondence to answer questions and organise our work. Our lawful basis is our legitimate interest in responding to people and delivering community activities.

• Bookings and registrations: we use the information needed to manage your booking and communicate practical details. Our lawful basis is performance of a contract where you book an activity with us, including steps you ask us to take before booking. For participation information not covered by that contract, we rely on our legitimate interest in organising activities safely and effectively, taking particular care with children’s interests.

• Newsletters and future invitations: we use your name, email address and subscription preferences with your consent. Attending a workshop does not automatically subscribe you to promotional emails.

• Accessibility support: we use information you choose to provide to arrange requested support. We rely on consent and, where the information reveals health or disability, explicit consent.

• Publicity photographs: we rely on consent to use identifiable photographs for the publicity purposes explained when permission is requested.

• Legal requirements: where a specific law requires us to retain or disclose information, our lawful basis is legal obligation.

Where we rely on consent, you can withdraw it at any time by emailing hello@projectfactory.uk. You can also unsubscribe using the link in our marketing emails. Withdrawal does not affect processing that was lawful before consent was withdrawn.

You can object to processing based on legitimate interests and can object at any time to direct marketing.

Accessibility and sensitive information

Please provide only the information we need to understand and meet your accessibility requirements; a full medical history is not necessary.

Where information reveals health or disability, we will explain its intended use and ask for explicit consent. Access is limited to those who need the information to arrange support. If you prefer not to provide it, please contact us to discuss what support we can offer.

Children’s information

We collect only the children’s information needed to organise their participation and support. This may be provided by a parent or carer.

We explain how information will be used in language appropriate to the child’s age and understanding. Where consent is needed, we consider whether the child can give informed consent themselves and obtain permission from someone with parental responsibility where necessary. We also respect the child’s wishes and consider their best interests.

We do not add children’s contact details to our promotional mailing list. Invitations about family activities are directed to parents or carers who have subscribed.

Photography

Before taking or publishing identifiable photographs for publicity, we explain the intended uses and ask for appropriate consent. For children, we follow the permission process described above.

Please tell the workshop or event team if you or a child in your care should not be photographed.

You can withdraw consent to future use by emailing hello@projectfactory.uk. We will stop future use and take reasonable steps to remove photographs from channels we control. We may be unable to recall printed materials already distributed or copies shared independently by others.

Who we share information with

We use the following service providers:

• Mailchimp: managing mailing lists and sending subscriber emails. Privacy information: https://mailchimp.com/legal/privacy/

• Google: providing our email service. Privacy information: https://policies.google.com/privacy

• Squarespace: hosting our website and providing website features, including forms where used.
  https://www.squarespace.com/privacy

Providers may process information on our instructions and may also act as independent controllers for their own stated purposes. Their privacy notices explain those uses.

Where we organise an activity with another organisation, we will explain any necessary sharing of identifiable information, including who receives it and why. We do not share information simply because an organisation works in the same community.

Safeguarding information may be shared with appropriate authorities where necessary and lawful to protect a child or adult from harm. We may also disclose information where required by law.

How long we keep information

We keep named workshop attendance and booking records for two years after the activity, unless a specific funding, legal or other documented requirement means we need to retain particular records for longer. We then securely delete or anonymise them.

We may retain anonymous attendance totals for long-term reporting and planning.

Where you have agreed to receive email updates, we keep your name, email address and subscription preferences separately from workshop records. You can unsubscribe at any time. We review our mailing list annually and remove contacts after three years without meaningful engagement, unless they renew their subscription.

When someone unsubscribes, we retain only the minimum information needed to record their preference and prevent further marketing.

We normally delete routine enquiries one year after they are resolved.

We delete accessibility and health information within three months after the activity, unless you explicitly agree that we may retain it for ongoing support. We review any ongoing need annually.

We review publicity photographs annually and normally stop using and delete identifiable photographs after three years, unless continued retention has a documented purpose and appropriate permission. We retain permission records while photographs are in use and afterwards only for as long as needed to demonstrate that use was authorised or handle a dispute.

Financial records are normally retained for six years from the end of the financial year they relate to, or longer where legally required.

Safeguarding, accident, complaint and legal-claim records are assessed separately. Their retention depends on the nature of the matter, relevant legal requirements and advice from the appropriate authorities or insurers. They are not deleted under our routine workshop-record schedule.

These retention arrangements apply to records held in our systems and service-provider accounts, not just paper copies.

Keeping information secure

We use organisational and technical measures appropriate to the information and risks involved. These include access controls to limit who can see personal information and reasonable measures to protect it when transmitted.

Access to sensitive information is limited to people who need it for the relevant purpose.

Your rights

Depending on the circumstances, you have rights to:

• Be informed about how your personal information is used.

• Access your information and receive a copy.

• Have inaccurate information corrected and incomplete information completed.

• Have information erased or its use restricted.

• Object to processing based on legitimate interests, and object at any time to use for direct marketing.

• Receive certain information in a portable format or have it transferred to another organisation where the right to data portability applies.

• Withdraw consent where processing relies on it.

These rights are subject to applicable conditions and exemptions. Contact hello@projectfactory.uk to make a request. We may need proportionate information to confirm your identity. We normally respond within one month; if a lawful extension or other exception applies, we will explain it.

Website cookies

Our website is hosted by Squarespace. We have configured Squarespace to restrict its non-essential cookies. Cookies needed to operate the website may still be used.

For further information about Squarespace’s use of cookies and similar technologies, please see the Squarespace Cookie Policy.

Complaints

If you are concerned about how we handle your personal information, please contact us at hello@projectfactory.uk or write to our postal address above.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator. You do not have to complain to us first.

ICO website: https://ico.org.uk/make-a-complaint/

Changes to this policy

We will review this policy when our activities or information handling practices change. The date and version at the top identify the latest published policy. Where appropriate, we will bring significant changes to your attention.