Privacy Policy
Last updated: 18 April 2026
South West Community Studios CIC, trading as South West Studios ("we", "us", "our"), is committed to protecting your privacy. This policy explains what personal data we collect, why we collect it, how we use it, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Who we are
South West Community Studios CIC is a Community Interest Company registered in Scotland and trades publicly as South West Studios.
- Registered office: Unit 9, Montgomery Place, Irvine, North Ayrshire, KA12 8EG
- Company number: SC851353
- Contact: website contact form
We are the "data controller" for the personal data described below.
The data we collect
When you register an account, we collect:
- Name
- Email address
- Authentication data handled by our account provider Supabase. We do not receive or store your plaintext password.
- Role (e.g. customer, staff)
- Account timestamps (created, last updated)
- Records of when you accepted our Terms of Use and Privacy Policy
When you book a rehearsal session, we additionally collect:
- The rooms, dates, and times you book
- Your booking status (pending, confirmed, cancelled)
- Payment status, amount, and transaction or reference details needed to confirm your booking, support you, and keep our accounts.
- Where online card payments are offered, payment information is processed by Stripe. We do not receive or store your full card details.
When you sign up to our mailing list, we collect:
- Name
- Email address
- The date you gave consent
When you use the website, we automatically collect:
- IP address, browser type, pages visited, and similar technical data, used for security and to keep the site running. See the Cookie Policy for details.
Why we use your data and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Creating and managing your account | Contract — so we can provide the service you signed up for |
| Processing rehearsal bookings | Contract |
| Sending booking confirmations and service emails | Contract |
| Sending marketing emails (newsletter, events) | Consent — you opt in, and can opt out any time |
| Keeping the website secure and functional | Legitimate interests |
| Keeping accounting records | Legal obligation — UK tax law requires us to keep records for 6 years |
| Safeguarding children and adults at risk | Legitimate interests / legal obligation, as set out in our Safeguarding Policy |
Who we share data with
We use the following processors. Each one is contractually required to keep your data secure and only use it for our purposes.
| Processor | What they do |
|---|---|
| Supabase | Hosts user accounts and our booking database |
| Vercel | Hosts this website and related application infrastructure |
| Zoho | Sends transactional emails such as confirmation links and service emails |
| Stripe | Processes online card payments when card checkout is enabled on the website |
Some of these suppliers, or their sub-processors, may process personal data outside the UK. Where that happens, we rely on a lawful transfer mechanism such as an adequacy regulation or approved contractual safeguards, including the UK International Data Transfer Addendum or equivalent protections.
We never sell your personal data. We do not share it with anyone else unless we are required to by law (for example, a court order), or it is necessary to protect someone's safety (see the Safeguarding Policy).
How long we keep your data
- Account data: while your account is active, then deleted within 30 days of closure.
- Booking records: 7 years, to meet UK tax and accounting requirements.
- Marketing consents and mailing list data: until you unsubscribe, then deleted within 30 days.
- Website logs: up to 90 days.
- Safeguarding records: as required by our Safeguarding Policy and applicable law.
Your rights
Under UK GDPR you have the right to:
- Access a copy of the data we hold about you.
- Rectify data that is inaccurate or incomplete.
- Erase your data ("right to be forgotten"), unless we need to keep it for legal reasons.
- Restrict how we use it.
- Port your data to another service.
- Object to processing based on our legitimate interests.
- Withdraw consent at any time, where we rely on consent.
To exercise any of these rights, use the website contact form. We will respond within one month.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or 0303 123 1113.
Children
Our services are primarily aimed at adults. Where we deliver workshops or events that include children or young people under 18, we collect additional consent from a parent or guardian. See our Safeguarding Policy.
Changes to this policy
We may update this policy from time to time. The "Last updated" date at the top shows when it last changed. For significant changes, we'll email registered account holders and mailing-list subscribers.