Last updated: 20 June 2026

Artilly Studio ("we", "us", "our") is committed to protecting the privacy of the children who attend our classes and workshops and of their parents and guardians. This policy explains what personal information we collect, how we use it, who we share it with, and the rights you have under UK data protection law (the UK GDPR and the Data Protection Act 2018).

Who we are

Artilly Studio is an art studio for children based at The Salisbury Centre, 2 Salisbury Road, Edinburgh EH16 5AB. For the purposes of data protection law, we are the data controller for the personal information described in this policy. If you have any questions, contact us at hello@artilly.co.uk.

The information we collect

When you register for our classes or workshops, or manage your account, we collect:

Parent/guardian details: name, email address, phone number, and emergency contact details.
Student details: the child's name, date of birth, any medical conditions, allergies or needs you tell us about, and their previous art experience.
Booking and payment information: the classes or workshops booked. Card payments are processed securely by our payment provider — we do not store your card details.
Policy acceptances: a record of which version of our policies you have accepted, with the date and time.
Account and sign-in information: if you use the guardian portal, we store a secure sign-in token and session so you can access your account.

Special category data (children's health information)

Information about a child's medical conditions, allergies or needs is "special category" data under data protection law. We collect it only so that we can keep children safe and provide appropriate care during our classes. We rely on your explicit consent, given when you provide this information, and (where necessary in an emergency) the protection of someone's vital interests. You can ask us to update or remove this information at any time.

How we use your information and our lawful bases

To provide and manage your bookings and our classes — performance of a contract.
To contact you about your bookings, including confirmations and important updates — performance of a contract / legitimate interests.
To keep children safe and respond to emergencies — explicit consent / vital interests.
To take payment for workshops — performance of a contract.
To keep a record that you have accepted our policies — legitimate interests / legal obligation.
To send you our newsletter, where you have asked us to — consent (you can unsubscribe at any time).

We do not sell your information. We share it only with trusted service providers who help us run the studio, and only as far as needed, including:

a secure database and hosting provider that stores your account, booking and policy records and serves our website;
an email provider that sends our booking confirmations, account emails and (if you opt in) our newsletter;
a payment provider that processes workshop payments — we do not store your card details; and
a customer-management provider that helps us keep track of our contacts and communications.

These providers act as our processors under contract and may only use your information to provide their service to us. We do not share children's medical information with our payment or marketing providers.

How long we keep your information

We keep your information for as long as you have an active relationship with the studio and for a reasonable period afterwards, so we can meet our legal and operational obligations. Sign-in tokens and expired sessions are removed automatically. Records we are required to keep (such as proof of policy acceptance) may be retained for longer.

Your rights

Under UK data protection law you have the right to access the personal information we hold about you, to ask us to correct or delete it, to object to or restrict how we use it, and to withdraw consent where we rely on it. To exercise any of these rights, email us at hello@artilly.co.uk. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

Cookies

Our website uses a small number of essential cookies, including a secure cookie to keep you signed in to the guardian portal, and privacy-friendly analytics to understand how the site is used. We do not use advertising cookies.

Keeping your information secure

We take appropriate technical and organisational measures to protect your information, including restricting access to it and storing sign-in credentials only in a hashed form.

Changes to this policy

We may update this policy from time to time. When we make significant changes, we will ask you to review and accept the updated version the next time you sign in.

Privacy Policy