Privacy Policy

 

Last updated: September 2026

 

This Privacy Policy explains how I collect, use, store and protect personal information when working with clients, organisations, community participants, suppliers and other people who interact with my business. I am committed to protecting people's privacy and handling personal information responsibly and in accordance with applicable UK data protection legislation, including the UK GDPR and Data Protection Act 2018. 1. Who I am I am an independent artist and creative practitioner providing services including murals, community arts projects, workshops, creative engagement and related artistic services. For the purposes of data protection legislation, I am generally the data controller for personal information that I collect and use in connection with my own business activities. 2. What information I collect Depending on the nature of my work, I may collect and use information such as: Names and contact details, including email addresses, telephone numbers and postal addresses. Organisation and business contact details. Information relating to commissions, projects, bookings and contracts. Invoices, payment and transaction information where necessary for accounting purposes. Information provided when someone contacts me about my services. Information relating to participation in workshops or community arts activities where this is necessary to deliver a project. Photographs, artwork or project documentation where appropriate. Information contained within correspondence relating to a project. I only collect information that is relevant and necessary for the particular purpose. 3. How I use personal information I may use personal information to: Respond to enquiries and communicate with clients and organisations. Provide commissioned artistic and creative services. Organise and deliver workshops, community projects and events. Manage contracts, bookings and project administration. Send invoices and maintain financial records. Communicate about ongoing or future projects where appropriate. Maintain records of business activities. Meet legal, accounting and contractual obligations. Deal with enquiries, complaints or requests relating to personal information. Protect the security of my business, systems and information. I will not use personal information for purposes that are incompatible with the reason it was originally collected. 4. Lawful basis for processing Under UK data protection law, I need a lawful basis for collecting and using personal information. Depending on the circumstances, this may include: Contract: where information is necessary to provide services or fulfil an agreement. Legitimate interests: where processing is necessary for the reasonable operation and administration of my business, provided that these interests do not override an individual's rights. Legal obligation: where I need to keep or provide information to comply with a legal requirement, such as accounting or tax obligations. Consent: where I have specifically asked for permission to use information for a particular purpose, such as certain photography or marketing activities. Where I rely on consent, individuals can withdraw their consent at any time. 5. Photographs and project documentation As an artist, I may photograph completed artwork, workshops or projects for purposes such as documenting my practice, maintaining a portfolio, reporting on commissioned work or promoting my services. Where photographs include identifiable people, I will consider the appropriate legal basis and, where required, obtain appropriate permission before using them publicly. I will take particular care when working with children or vulnerable people and will follow the photography, consent and safeguarding requirements of the organisation or project commissioning the work. 6. Who I share information with I will only share personal information where there is a legitimate reason to do so. Depending on the circumstances, information may be shared with: Organisations or clients commissioning my work where necessary to deliver a project. Professional advisers such as accountants where necessary. Suppliers or subcontractors where information is required to deliver a service. Payment, accounting, email, cloud-storage or other technology providers that I use to operate my business. Public authorities or other organisations where I am legally required to provide information. I will not sell personal information to third parties. Where I use external services to store or process information, I will take reasonable steps to use reputable providers and appropriate security measures. 7. How I keep information secure I take reasonable technical and organisational measures to protect personal information from loss, unauthorised access, accidental disclosure, alteration or destruction. These measures include, where appropriate: Using strong, unique passwords. Using two-factor or multi-factor authentication where available. Keeping computers, phones and software up to date. Using reputable and secure cloud services for business information. Restricting access to personal information to those who need it. Taking care when sending information by email. Keeping paper records securely stored. Locking devices when they are unattended. Taking reasonable precautions when working in public or shared spaces. Regularly reviewing and deleting information that is no longer required. Maintaining appropriate backups of important business information. The ICO recommends measures including strong passwords, multi-factor authentication, secure cloud storage, backups and appropriate access controls for small organisations. 8. How long I keep information I only keep personal information for as long as it is reasonably necessary for the purpose for which it was collected, unless I have a legal or accounting reason to retain it for longer. For example, some financial and business records may need to be retained for a period required by tax or accounting legislation. When information is no longer required, I will take reasonable steps to securely delete, destroy or anonymise it. 9. Your data protection rights Under UK data protection law, individuals may have rights including: The right to be informed about how their personal information is used. The right to request access to personal information held about them. The right to request correction of inaccurate information. The right to request deletion of information in certain circumstances. The right to restrict processing in certain circumstances. The right to object to certain processing. The right to data portability in certain circumstances. Rights relating to automated decision-making and profiling, where applicable. These rights are subject to certain legal conditions and exemptions. If you would like to exercise a data protection right, please contact me using the contact details below. 10. Cookies and my website If my website uses cookies or similar technologies, information about their use will be provided through the relevant cookie notice or website settings. Some cookies may be necessary for the website to function, while others may be used for analytics or other purposes. 11. Changes to this policy I may update this Privacy Policy from time to time to reflect changes to my business, the way I use personal information, or changes in data protection requirements. The latest version will be made available through my website or provided when appropriate. 12. Contact If you have questions about this Privacy Policy or how I handle your personal information, please contact me: Name: Nicole White Email: nicolewhiteart@outlook.com Website: www.nicolewhite.co.uk You also have the right to complain to the Information Commissioner's Office (ICO) if you believe your personal information has not been handled appropriately. Information Commissioner's Office: ico.org.uk