Privacy Policy

Last updated: March 2026

This Privacy Policy explains how Seren Institute ("we", "us", "our") collects, uses, stores and protects your personal data when you use our website www.seren.institute or contact us. It should be read alongside our Cookie Policy.

We are the data controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Data controller contact details:

Email: [email protected]
Phone: +44 7930 665154
Address: Seren Institute, Ceredigion, Wales, United Kingdom

We do not have a statutory obligation to appoint a Data Protection Officer, but you may contact us at the address above with any data protection query.

1. Personal data we collect

Data you provide directly

When you contact us or submit a booking enquiry, we may collect:

Full name
Email address
Telephone number
Content of your message or enquiry
Booking details and course participation preferences

Data collected automatically

When you visit our website, the following data may be collected automatically:

IP address (anonymised before storage for analytics purposes)
Browser type and version
Device type and operating system
Pages visited, time spent on pages and navigation path
Referring URLs
Server access logs (retained for security purposes)

2. Purposes and lawful bases for processing

Purpose	Categories of data	Lawful basis
Responding to contact form enquiries and email	Name, email address, message content	Legitimate interests (Art. 6(1)(f) UK GDPR) — to respond to communications addressed to us
Processing booking and course enquiries	Name, email, phone, booking and course details	Legitimate interests (Art. 6(1)(f)) and, where a contract is formed, performance of a contract (Art. 6(1)(b))
Website security monitoring and fraud prevention	IP addresses, server access logs	Legitimate interests (Art. 6(1)(f)) — to maintain the security and integrity of our systems
Website analytics to improve our services (GA4)	Anonymised device and usage data	Consent (Art. 6(1)(a)) — opt-in via the cookie consent banner; see our Cookie Policy

We do not use your personal data for solely automated decision-making or profiling that produces legal or similarly significant effects.

3. Legitimate interests assessment

Where we rely on legitimate interests, we have considered the impact on your rights and interests. Our legitimate interests are:

Responding to enquiries from people interested in our courses and events
Maintaining a secure, functioning website for all visitors
Understanding how our website is used so we can improve it

We are satisfied that in each case our interests are not overridden by your rights and freedoms, taking into account the limited and relevant nature of the data processed and the reasonable expectations of people contacting an arts and education organisation.

We do not sell, rent or trade your personal data. We may share it with the following third parties, who act as data processors or independent controllers:

Recipient	Role	Purpose	Location
TidyCal (Lemonsqueezy Inc)	Processor	Embedded booking calendar — receives booking enquiry submissions	United States
Google Ireland Ltd	Independent controller	Google Forms enquiry submissions; Google Analytics 4 when active	EEA / United States
Web hosting provider	Processor	Hosting the website and server log storage	United Kingdom

We do not share your data with any other third parties except where required by law (for example, in response to a valid court order or law enforcement request).

5. International transfers

TidyCal (Lemonsqueezy Inc) and Google LLC are headquartered in the United States. When your data is transferred outside the UK, we ensure appropriate safeguards are in place:

UK adequacy regulations where applicable
UK international data transfer agreements (IDTAs) or the UK addendum to EU standard contractual clauses, approved by the Secretary of State under section 119A of the Data Protection Act 2018
Transfer risk assessments where required

You can request information about the specific safeguards applicable to any transfer by contacting us at [email protected].

6. How long we keep your data

Data category	Retention period	Reason
Contact form and email enquiry data	Up to 2 years from your last communication	To handle follow-up enquiries and maintain a record of correspondence
Booking and course participation records	Up to 3 years from the date of booking or course completion	Legitimate business record-keeping
Server access logs	Rolling 90 days, then deleted automatically	Security monitoring
Google Analytics data	Up to 14 months within Google Analytics	Industry-standard analytics retention
Cookie consent record (`seren_cookie_consent`)	6 months, stored in your browser only	To avoid re-showing the consent banner unnecessarily

Data is erased or anonymised once the applicable retention period has elapsed.

You have the following rights in respect of your personal data:

Right to be informed — this policy fulfils that obligation.
Right of access — you may request a copy of the personal data we hold about you (a Subject Access Request).
Right to rectification — you may ask us to correct inaccurate or incomplete data.
Right to erasure — you may ask us to delete your personal data where we have no overriding legitimate reason to retain it.
Right to restrict processing — you may ask us to pause processing in certain circumstances (for example, while accuracy is contested).
Right to data portability — where we process your data by automated means on the basis of consent or contract, you may ask for it in a portable, machine-readable format.
Right to object — you may object at any time to processing based on legitimate interests; we will cease unless we can demonstrate compelling legitimate grounds.
Right to withdraw consent — where we rely on consent, you may withdraw it at any time without affecting the lawfulness of prior processing. To withdraw cookie consent, use the controls on our Cookie Policy page.
Rights in relation to automated decision-making — we do not carry out any solely automated decision-making with legal or significant effects on individuals.

To exercise any of these rights, contact us at [email protected]. We will respond within one calendar month. There is no charge. We may need to verify your identity before acting on a request.

8. Data security

We implement appropriate technical and organisational measures to protect your personal data, including:

HTTPS encryption for all data in transit
CSRF anti-forgery tokens on all form submissions
Content Security Policy (CSP) headers to reduce injection attack risk
Rate limiting on form and API endpoints
Access controls — personal data is accessible only to those who need it
Regular review of our security practices

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify you directly.

9. Third-party websites and services

Our website may contain links to or embedded content from third-party services (for example, booking pages on tidycal.com or forms hosted on Google). Once you leave our website or interact with third-party embedded services, their own privacy policies govern the processing of your data. We are not responsible for the privacy practices of third-party websites. We encourage you to read their policies.

10. Children's data

Our website and services are not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe we have inadvertently received data relating to a child, please contact us immediately at [email protected] and we will delete it promptly.

11. Your right to complain

If you have concerns about how we handle your personal data, please contact us in the first instance at [email protected]. We will do our best to resolve your concern promptly.

If you remain dissatisfied, you have the right to lodge a complaint with the UK supervisory authority:

Information Commissioner's Office (ICO) Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF ico.org.uk | 0303 123 1113

12. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or legal requirements. The date at the top of this page shows when it was last revised. Where changes are material, we will publish a notice on this website. We encourage you to review this policy periodically.

13. Contact us

For any data protection queries, to make a rights request, or if you have concerns about how we use your data:

Email: [email protected]
Phone: +44 7930 665154
Address: Seren Institute, Ceredigion, Wales, United Kingdom