The short version

This is a small artist's website. It has no analytics, no advertising, no third-party tracking and no tracking cookies. The only personal information collected is what you type into the contact or booking form, and it is used solely to reply to you and arrange what you asked for.

Who is responsible

Kristina Birkhans, trading as Birkhans Designs, based in Ontario, Canada, is the data controller for information collected through this site. You can reach us through the contact form.

What is collected

Form submissions. Your name, email address, and (if you choose to provide them) your phone number, message, and any photo you attach. Booking reservations also include the class, option, date and number of places you selected.
Server logs. Our host, Cloudflare, records technical information such as IP address, browser type and the time of your request. This is standard practice, used to keep the site online and defend against abuse.

No cookies are set for analytics, advertising or profiling. Nothing you submit is used to build a marketing profile, and nothing is ever sold.

Why it is used, and on what legal basis

To reply to your enquiry and arrange bookings. Under the UK/EU GDPR this is necessary for performance of a contract, or for taking steps at your request prior to a contract (Article 6(1)(b)).
To keep the site secure and working. This relies on our legitimate interests in preventing abuse and maintaining service (Article 6(1)(f)).
To meet record-keeping obligations where a booking results in a payment (Article 6(1)(c)).

Who it is shared with

Only the service providers needed to run the site, and only to the extent required:

Cloudflare: hosting and delivery of the site.
Our email provider: delivers form submissions (and any attached photos) to the artist's inbox.

Payments are currently arranged by Interac e-Transfer directly through your own bank. This site never sees, stores or transmits your banking credentials or card details.

Your information is not sold, rented, or shared for advertising. Under US state privacy laws, we do not "sell" personal information or share it for "cross-context behavioural advertising".

International transfers

The site is hosted on a global network, so your information may be processed on servers outside your country, including in the United States. Where information leaves the UK or EEA, our providers rely on safeguards such as the European Commission's Standard Contractual Clauses.

How long it is kept

General enquiries are kept while we are in conversation and for up to two years afterwards, in case you get back in touch.
Booking records are kept for as long as required for tax and accounting purposes, typically six years.
Server logs are retained by our host on their own short schedule.

Your rights

If you are in the UK or the EEA, you have the right to access a copy of your information, correct it, have it erased, restrict or object to how it is used, and receive it in a portable format. Where we rely on consent, you can withdraw it at any time.

If you are in California or another US state with comparable legislation, you have the right to know what is collected, request deletion or correction, opt out of sale or sharing (we do neither), and not be discriminated against for exercising those rights.

To exercise any of these, send a request through thecontact form. We will respond within one month, or within 45 days for US state requests. You are also entitled to complain to your local data protection authority. In the UK, that is the Information Commissioner's Office.

Security

The site is served over HTTPS only. It applies a strict Content Security Policy and additional protective headers, and it runs no third-party scripts. Form submissions are transmitted over an encrypted connection. The artist's email address is not published in a form that automated scrapers can read.

No system is perfectly secure, so please avoid sending sensitive personal information through the form.

Children

This site is not directed at children, and we do not knowingly collect information from anyone under 16. Where a young person is attending a class, we ask that a parent or guardian makes the booking.

Changes

If this notice changes, the revised version will be posted here with an updated date. Material changes affecting how your information is used will be explained clearly rather than quietly amended.

Contact

Questions about any of the above can be sent through thecontact form, and are usually answeredwithin 1-2 days.

Privacy