POLICY STATEMENT

Create98 takes data privacy very seriously and recognises the importance of protecting and respecting your personal data. This Privacy Policy describes the information we collect, how we use that information, to whom we pass the information, your rights, and key contact information.

1. Overview

In order for you to participate in our courses, classes and other services as a student or tutor (collectively “customers”), we need to collect information about you. Our aim is not to be intrusive, and we won’t ask you unnecessary questions. Any information we receive about you will be subject to strict controls to minimise the risk of misuse, including unauthorised access to, or disclosure of, your personal data.

Please read this notice carefully, together with our Terms and Conditions and any other documents referred to in it. Here we set out the basis on which any information we collect about you or from you, or that you provide to us, will be processed by us and other parties in providing you with our services (“Create98 Services”). Create98 is the trading name of
Create 98 Ltd (“our”, “us” and “we”), and we commit to using your information only in accordance with the terms of this Privacy Policy.

For the purposes of this Privacy Policy, the term “information” means any confidential and/or personal data or other information related to customers of Create98 Services.

By visiting this website or providing your personal information to one of our employees, for example by telephone or email, you accept and expressly consent to our use and disclosure of your personal information and direct us to do so in the manner described in this Privacy Policy.

This includes consenting to the processing of any sensitive personal information you provide, as described below in section 2. It also includes information you provide when you browse our social media sites or website, request information, register for a course, speak to us by telephone, enter a competition or promotion, provide feedback and when
you contact us for other reasons.

If you have concerns about any of the terms of this Privacy Policy, please contact us at [email protected] so that we can provide further information.

A special note about children
We offer courses specially tailored for children (persons under the age of 18), however the personal data provided about children must be provided only by and under the authorisation of a responsible adult. We respectfully ask that children browsing our site ask an adult to help them submit any information.

2. What information we collect

Information you provide to us
You may provide us with information when you browse our social media sites or website, request to be added to our newsletter database, speak to us by telephone, apply for or participate in or visit one of our courses, classes or other events, enter a competition or promotion, submit feedback, and when you contact us for other reasons.

Initial information
To register with Create98 or use Create98 Services you must provide your name, email address and phone number.

In order to pay for Create98 Services, you may be asked to provide debit/credit card details, including the long number, start and expiry dates and the card verification value code (CVV/CSC).

If you wish to register as a tutor we may require details of your prior experience and qualifications.

When we communicate
When you communicate with us for customer service or other purposes, including by phone, email or using other methods, we retain that information and our responses to you.

When we speak to you by telephone we collect your name, email address and telephone number and may collect information on the types of courses, classes and other events you are interested in.

Information we collect when you use our website
When you use the Create98 website we place 1st party cookies. Some of the cookies we place are persistent and can be blocked by adjusting your browser settings. Please see our Cookie Policy for more details.

3rd party personal information
If it is necessary for you to provide personal information about other individuals in the course of dealing with us, for example booking courses on behalf of a group, you should do so only where you are authorised by those individuals. You should bring this Privacy Policy to their attention at the earliest opportunity so they aware of how their information will
be processed by us and aware of their rights in relation to that information, including the right to access and correct information.

Sensitive data
Data privacy regulations prohibit the processing of ‘special categories of personal data’, also called ‘sensitive data’ unless you have given your consent.

Sensitive data includes information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, and data concerning health, sex life or sexual orientation. There are also restrictions on processing of criminal convictions and offences.

To avoid infringing these restrictions, it is Create98’s policy that we limit the collection of any of the above data from you or any other party. We will not ask and request that you do not reveal any other sensitive data about yourself or others in any communication with
us other than as explained below.

If you do reveal other sensitive data, for example in an email, you will be giving express consent for us to process that information by storing the email or other communication.
If you have a mental or physical disability or impairment we may ask you for limited details so that we can make suitable adjustments to the set-up of our courses. On those events where we offer refreshments we may ask that you provide information on specialdietary needs.

Where you are a tutor or assistant working with children or vulnerable people, our safeguarding policy requires us to carry out background checks. We will therefore ask you to provide information on criminal convictions or pleadings, for example the results of a DBS (Disclosure and Barring Service) check.

We occasionally take photographs of classes and clubs for promotional purposes, but will always request your permission before taking and using photographs in this way.

3. How we use your information

Our primary purpose in collecting your information is to provide you with a fun, safe, educational, and customised creative experience. We appreciate the sensitivity of your personal information and will ensure it is kept secure and only used when required and disclosed to individuals who need it. By submitting your information to Create98 and using Create98 Services you agree that we may use your information for the following purposes:

Fulfilling your requests
We will use your information to process your registration and payment and to ensure we can provide you with the best experience possible based on your individual needs.

If you reveal a mental or physical disability or impairment we will use this information solely to make suitable adjustments to the set-up of our courses to accommodate your needs. If you provide information on special dietary needs we will use this information solely to provide suitable refreshments.

Communication and customer service
We communicate with our users on a regular basis via email, phone and SMS to provide requested services. These activities include:

• Responding to customer comments and enquiries;
• Communicating with you regarding your interest or registration in one of our classes, courses or other services;
• Sending information and follow-on communications to those who have requested more information;
• Providing updates and reminders about classes, courses and other events you have booked;
• Responding to requests for customer service;
• Resolving customer complaints; and
• Requesting feedback.

We use your email and physical address to:

• confirm your booking;
• send a payment receipt to you;
• send pre-class/course/event information to you;
• send you information about important changes to classes, courses and other events that you have booked, including notice of any previous unforeseeable cancellations;
  and
• send any notices and other disclosures required by law.

Users cannot opt out of these communications, but they will be primarily service-oriented rather than promotional. If you do not wish to receive them in a particular way, please contact us to advise us of your preferred communication method.

If you contact us via our blog or social media sites, we will respond to any queries and provide marketing materials on request.

Marketing
We also use your email address to send you other types of communications that you can control, including information about up-coming classes, courses and events, requests for feedback and special promotions. These communications are to:

• provide information about up-coming classes, courses and events that are similar to those that you have already enquired about or purchased;
• make suggestions and recommendations to you about classes, courses and other services that may interest you, which may be based on your activity on our website;
  and
• provide our newsletter and links to blog posts on our site.

You can choose whether to receive some, all or none of these communications and the methods by which you receive them by emailing us at [email protected] and requesting an amendment of your preferences. One of our administrators will respond to your request in person, usually within 5 business days.

Tutor assessment
Create98 sets the highest standard for tuition. If you apply to join us as a new tutor we will assess the information you provide on your skills and experience to ensure it meets our high standards and the needs of our customers. We also use the results of your DBS check to verify that you meet our safeguarding standards.

Customer feedback
From time to time we may ask you to provide feedback, which is always optional. If you choose to provide feedback, we may use your information to improve Create98 Services and send you marketing information.

4. Cookies
Our website uses cookies to distinguish you from other users of our website. This helps us to provide you with a good experience when you browse our website. You may adjust the settings on your browser to refuse cookies but some of the services on our website may not work if you do so. For detailed information on the cookies we use and the purposes for which we use them see our Cookie Policy.

5. Sharing information with third parties

To provide tutor services
Create98 uses a combination of in-house and external tutors to host our classes courses. To facilitate the event, we share the names of the attendees with the tutor for that event.

To support our business and provide services to you
Create98 works with third-party service providers who provide important functions that allow us to safely and securely store the data you send us, and to administer your involvement in our classes, courses and other services.

By accepting this Privacy Policy and ordering services from Create98, you expressly consent to the transfer of your data to those third parties for the purposes listed.

• Squareup International Ltd (“Square”) provides card payment services. When we take a card payment from you we provide your name, address, CCV/CSC number and card details to Square.
• HSBC provides card and business banking services. When you make a card payment or direct payment to us, we will share that information with the bank.
• Our website is hosted externally. Any information submitted to the website will be held on the host’s servers.

Credit card associations and legal process
We may also disclose necessary information in response to the requirements of credit card associations or a civil or criminal legal process.

We may disclose or share your information in order to enforce or apply the Terms and Conditions – and other agreements – between you and us, or to investigate potential breaches to protect the rights, property, or safety of Create98, our customers, or others.

This includes exchanging information with other companies and organisations and, if required, to obtain professional advice.

Where required by law
We may disclose necessary information to the police and other third-party organisations where we are legally compelled and/or permitted to do so.

Mergers and acquisitions
As with any business, it is possible that in the future Create98 could buy, merge with, or be acquired by, another company. We may disclose your information to the prospective seller or buyer of such business or assets, along with its professional advisers. If Create98 or a substantial proportion of its assets are acquired by a third party, information held by us about our customers will be one of the transferred assets, and such successor company would continue to be bound by this Privacy Policy unless and until it is amended.

6. Transferring data overseas

Create98 is committed to adequately protecting your information regardless of where the data resides and to providing appropriate protection for your information where such data is transferred outside of the EEA.

The information that we collect from you may be transferred to, and stored in, a country outside the European Economic Area (EEA). It may also be processed by staff operating outside the EEA who work for us or for our suppliers. These staff may be engaged in the fulfilment of your request, the processing of your payment details and the provision of support services. We will take all steps reasonably necessary to ensure that your data is
treated securely and in accordance with this privacy policy.

The laws in some countries may not provide as much legal protection for your information as in the EEA. In these circumstances, our policy to protect your data is to rely on findings of adequacy by the European Commission (for countries in scope of those findings), the EU-US Privacy Shield (for transfers to the USA), and/or standard contractual clauses
adopted by the European Commission or the UK Information Commissioner (for all countries outside the EEA).

Each time you order a service from us, Create98 may transfer the data to service providers as described above. By submitting your information and making use of Create98 Services, you agree to such transfers, storing or processing. We will take all steps reasonably necessary to ensure that your information is treated securely and in accordance with this
Privacy Policy.

7. Data Retention Policy

We typically retain all data for 7 years. In some circumstances, such as an enquiry from a law enforcement agency, we may have to hold it longer. We may also retain information if required to protect our interests, for example in case of litigation. When data falls outside those retention periods we will take steps to delete it from our system. Where you have asked us not to contact you, we will retain that information on a ‘do not contact’ list to
reduce the risk of us contacting you in the future.

8. Systems Security Policy

Create98 has security measures in place designed to prevent data loss, to preserve data integrity, and to control access to the data. Only authorised employees of Create98 and our business partners processing data on our behalf have access to your personal data. All Create98 employees and affiliates who have access to your personal data are required to
comply with our privacy policy. All business partners are requested by Create98 to ensure that any of their employees who have access to your personal data have signed nondisclosure agreements. Contracts with business partners acting as data processors for Create98 involving personal data require an adequate level of security and require that personal data is processed only as instructed by Create98.

We will do our best to protect your information, however we cannot guarantee the security of your information transmitted to our site or sent to us by email or other nonsecure electronic methods; any such transmission is at your own risk. Once we have received your information, we will use protective procedures and security features to try to prevent unauthorised access.

System security and monitoring
Our server is protected with an SSL certificate. Where we use hosted services (such as Square for card payments) we rely on their integrated security measures and you can read their security policies for added reassurance.

Customer responsibilities
We keep our security technology up-to-date to protect your information, but we do not have control over the devices you use to access Create98 Services.
It is your responsibility to safeguard your online information and transactions by taking all reasonable measures which may include the following:

• Do not share your information or provide any opportunities for anyone to gain access to your information through your devices, including tablets, phones, watches or laptops.
• Do not click on any internet link contained in an email or SMS which directs you to a Create98 website. Always manually type our address www.create98.co.uk into your internet browser.
• Log out and close your browser before visiting other websites once you have completed any transactions on our website.
• Ensure that you use the latest version of your internet browser and that you have upto-date anti-virus, firewall and other security software installed on your device.

9. Customer rights

You have the following rights:
To ask us to correct any information we hold about you if it is incorrect.

Whilst we endeavour at all times to keep your information accurate, we welcome your corrections. You can correct your details at any time by contacting us at the email address below.

To ask us to erase your information if we no longer have any reason to hold it, also known as the ‘right to be forgotten’.

Our Data Retention Policy (see section7) explains the circumstances when we can or are obliged to retain information, however outside of those periods we will delete your information in line with our data retention policy and on request. We will maintain a record that you made an erasure request to reduce the likelihood of us contacting you in the future but we will use that information for no other purpose.

To ask us to return to you information you provided to us, also known as ‘data portability’.

You can ask us to send you in electronic format the information you provided to us under our Terms and Conditions or under consent.

To ask us not to process your information where you previously gave consent or where we are exercising our legitimate interest.

If you make a request for us to stop processing your information, we will investigate to see if there is a compelling reason for processing to continue and will discuss the conclusion of the investigation with you.

You cannot object to processing which is a legal obligation or where we must process your information to satisfy a contract to which you are a party. If you previously gave consent and we processed your data on the basis of that consent, you cannot object to that past processing, however you can ask us to stop processing it in the future.

To ask not to be subjected to automated decision making and profiling.

Create98 puts the human factor at the heart of our customer service, so there are no circumstances when profiling or other automated decision-making will have a legal impact on you. If you feel you may have been unfairly impacted by profiling, our team can manually assess whether the decision is fair and discuss the situation with you.

To ask for a copy of the information we hold about you.

We will endeavour to respond to your request within 30 days, however at time of high demand we may need 90 days to compile a full response.

To ask us not to process your information for marketing purposes.

You can do this by checking or unchecking certain boxes on the forms we use to collect your information, or by contacting us by email, or by clicking on the ‘unsubscribe’ link(s) at the foot of every marketing or promotional email.

You may exercise any of the above rights by contacting us at [email protected] or by calling us.

10.Contacting us

The Data Controller
The Data Controller is Create98 Ltd, Registered Office 98 Broadway, Leigh-On-Sea, Essex, England, SS9 1AB, Company Number 11431127.

Contacting us with questions or requests
If you want to exercise your right to access your information or have any questions about this Privacy Policy, Create98’s information practices, or your dealings with Create98, you can contact us by emailing us at [email protected], or by calling the customer service number located on our website, or by writing to us at the address above.

Complaints to us
If you believe that we have breached a privacy law with which we should comply, please send an email to [email protected]. We aim to respond in a reasonable time, normally within 30 days. Our administration team will look after your complaint and will give you additional information about how it will be managed.

Complaints to the UK Information Commissioner
You have the right to complain to the UK Information Commissioner’s Office if you believe we have not handled your request in an appropriate manner. For information on contacting the Information Commissioner please see their website.

11.Changes to this Privacy Policy
We may amend this Privacy Policy at any time, as new features are added to Create98 Services or as we incorporate suggestions from our customers. Any changes we may make will be posted on the Create98 website, so please check back frequently.

Your continued use of our website and Create98 Services after a posting of a new version of this Policy will constitute your acceptance of, and agreement to, any changes.