Privacy notice

Who we are

Karen Welsh, trading as Karen Welsh Creative Arts, 53 Cornwall Road, Salisbury SP1 3NH. karen@karenwelshworkshops.co.uk.

We decide what happens to the information on this page, which makes us what the law calls the data controller for it. If you want to ask anything about it, email that address or send a message - it comes to Karen, and there is nobody else to be passed to.

What we collect, and why

• When you send a message, we keep your name, your email address and what you wrote, so that we can answer you.
• When you book a place, we keep your name, email address and phone number, which workshop and date you booked, and anything you told us. After a session we may note whether you came, because that is what a register is.
• What you have paid. We keep what you bought, the price and every payment: how much, when and how it reached us. These are our accounting records as much as yours.
• Card payments, which we deliberately do not see. Paying by card takes you to Stripe, the card processor we use. Your card number is typed on their page, not ours, and it never reaches our website. What comes back to us is that a payment of a certain amount succeeded and a reference for it.
• Gift cards. If you buy one, we keep your name and email address and the name, email address and message for the person it's for, so we can send it to them and they can spend it. Please make sure they're happy for you to give us their details.
• Workshop news. If you join our mailing list, we keep your email address and when you joined, so we can send you new workshop dates. Every email says how to leave, and leaving takes one click.

Why we are allowed to hold it

• To do what you asked us to. Answering your message, holding your place, taking your money and running the session. (Lawfully: a contract with you, or steps you asked for before one.)
• Because we have to. Money records, which HMRC requires us to keep. (Legal obligation.)
• Because you said yes. Workshop news, and analytics if you agree to it. You can change your mind at any time.
• To keep the website working and secure. (Legitimate interests.)

If you booked on our previous website

Your bookings and your place on the mailing list from the previous website are brought across to this one, so they carry on as they were. You can still unsubscribe from any email.

What the server records

Each request is recorded with the page asked for, the time, your IP address and your browser's user agent, to keep the site secure and running. Those records are kept for two months and then deleted.

Cookies and analytics

The site needs a few cookies to work - keeping you signed in, keeping the booking you're making while you make it, and remembering your cookie choice. Those are always on.

Analytics is the one you choose. With your agreement, PostHog records which pages you visit and what you click, so we can see what people look for and fix what doesn't work. It sets a cookie to recognise you between visits, and if you're signed in it links what you do to your account. Until you choose, it counts the page you're on without writing anything to your device. If you say no, it records nothing at all. You can change your mind at any time with Manage cookies at the foot of every page.

Karen's paintings site, karenwelshartist.co.uk, uses the same analytics. If you've agreed on both and follow a link from one to the other, the two visits are joined up.

Nothing here follows you to any other website, and there is no advertising.

Two things loaded from somewhere else

The contact page shows a map drawn by OpenStreetMap, which sets no cookie and is given nothing about you beyond the request for the map.

The booking, gift card, message and mailing-list forms are checked by Cloudflare Turnstile, so that a bot can't hold places or fill the inbox. It looks at the browser you're using to decide whether you're a person, and is given nothing you type into the form. Its privacy addendum says what it keeps.

Who else sees it

Nobody sees your information for their own purposes, apart from Stripe below.

The company that built and runs this website for us, under a written agreement that lets them use your information only to run it, keep it secure and do what we ask. They use a small number of services to do that, each under the same kind of agreement: the servers the website and its database run on, in London; and a network that carries the connection between your browser and the website and protects it from attack - your connection passes through it, wherever in the world is nearest, but it keeps nothing. Backups are kept, encrypted, on their own equipment in the UK.

PostHog, if you agree to analytics, for the analytics above, on their servers in the EU and under the same kind of agreement. Your browser sends it to this website first and we pass it on, so it never talks to PostHog directly, and your IP address isn't kept. It's held against a random id rather than your name or email address.

Stripe, if you pay by card. They take the payment and get your card details, your name and your email address to do it - directly from you, on their own page. They also use what they see to spot fraud, which is their own legal duty, so for that part they answer for themselves. Stripe hold data outside the UK; their own terms and safeguards cover that.

What we do not do

We do not sell your information, we do not share it with anyone for their own marketing, and we do not send you anything you did not ask for.

How long we keep it

We keep your details until you ask us to delete them, apart from money records, which we keep for as long as HMRC requires us to. That one is not our choice, so when you ask us to delete your details, your name stays on those payments until then.

Your rights

All of these are free. Email karen@karenwelshworkshops.co.uk or send a message.

We will answer within a month of getting your request. If we need to check who you are first, the month starts when we get what we asked for. If a request is complicated, or you've sent us several, we can take up to two more months - we'll tell you within the first month if we need to, and why.

• See it. Ask for a copy of what we hold about you.
• Correct it. If something is wrong, tell us and we will fix it.
• Delete it. Ask us to, and we delete everything we can straight away and tell you what we have to keep and until when - a booking for a session still to come, money still owed, and our money records.
• Pause it. Ask us to stop using it while something is in dispute.
• Take it elsewhere. Ask for what you gave us in a form you can hand to somebody else.
• Object, or change your mind. If it is about workshop news, we stop, no argument.

Nothing here is decided by a computer. A person decides, every time.

If you are not happy

If you're unhappy with how we've handled your information, or with how we've dealt with a request, you can complain to us. Email karen@karenwelshworkshops.co.uk or send a message and say it's a complaint. We'll acknowledge it within 30 days, look into it, keep you posted while we do, and tell you what we've found and what we've done about it.

You can also complain to the ICO, the UK's data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113. You don't have to come to us first, but the ICO will usually ask whether you have.

Changes to this notice

If we change what we do with your information we will change this page and put the date on it. Last updated: 3 November 2026.