Privacy Policy

Who we are

Brush Past Community Arts CIC is a Community Interest Company based in the United Kingdom. We operate brushpast.org - a creative platform and social enterprise combining storytelling, workshops, and The Archive Shop.

We are the data controller for personal data collected through this website. Our activities are focused on supporters, customers, and partners in the UK.

For questions about these policies, contact us at hello@brushpast.org or 07710 022 677.

What data we collect

We may collect:

• Identity and contact details (name, email, phone) when you contact us, share your story, or place an order
• UK delivery and billing details for shop orders
• Order history and payment references (card payments are processed by Stripe in GBP; we do not store full card numbers)
• Technical data (IP address, browser type, device) via cookies and server logs
• Communications you send us (messages, story submissions, workshop enquiries)

How we use your data

We use personal data to:

• Process and fulfil shop orders and donations (where applicable)
• Respond to enquiries and story submissions
• Send operational emails (order updates) where relevant
• Improve our website and comply with UK legal obligations
• Protect against fraud and misuse

Legal bases (UK GDPR)

We rely on:

• Contract - to fulfil orders and provide services you request
• Legitimate interests - to operate our social enterprise, improve the site, and communicate with supporters (balanced against your rights)
• Consent - for non-essential cookies and optional marketing (where offered)
• Legal obligation - where law requires us to retain or disclose data

Sharing and processors

We use trusted service providers who process data on our behalf, including hosting (Vercel), database (Supabase), payments (Stripe), email (Resend), and image hosting (Cloudinary). They act under contract and only as instructed.

We do not sell your personal data.

International transfers

Some providers may process data outside the UK. Where this occurs, we ensure appropriate safeguards (e.g. UK adequacy decisions or standard contractual clauses) are in place.

Retention

We keep data only as long as needed for the purposes above, including statutory retention for tax and accounting where orders are placed.

Your rights

Under UK data protection law you may have the right to:

• Access, rectify, or erase your personal data
• Restrict or object to certain processing
• Data portability (where applicable)
• Withdraw consent (for consent-based processing)
• Lodge a complaint with the ICO (ico.org.uk)

Security

We implement appropriate technical and organisational measures to protect personal data. No method of transmission over the internet is 100% secure.

Children

Our shop and forms are not directed at children under 16. If you believe we have collected a child's data, please contact us.

Changes

We may update this policy from time to time. The date at the top shows when it was last revised.