Privacy Policy.

The short version

• We only collect what we need to run your course and to answer you.
• We never see your card details. Stripe takes the payment.
• We do not sell your information. We do not send marketing emails.
• Our website does not use cookies, analytics or adverts.
• You can ask to see or delete your information at any time.

Who we are

Deaf Spaces is a deaf-led British Sign Language (BSL) school and community service in Highbury and Islington, London.

[Legal name of the organisation] is responsible for your personal information. In data protection law this is called the "data controller".

• Address: Northway House, 257 Upper Street, Highbury and Islington, London, N1 1RU
• Email: [email protected]
• ICO registration number: [number]

What we collect and why

When you book a course

We collect your first name, last name and email address. Your phone number is optional: give it only if you prefer us to contact you by text. You also confirm that you are 18 or over.

We keep the course and group you chose, your booking reference, the amount you paid and whether you paid or had a refund.

We use this to give you a place, to send your confirmation, receipt and reminder, and to contact you about your course. The law allows this because we need it to provide the course you booked (a contract).

We do not ask about health or access needs. If you tell us something that would help you take part, we use it only for that.

When you pay

You pay on Stripe's secure page. Stripe collects your card details. We never see them and they never reach our website. Stripe tells us only that you paid, with a payment reference.

When you join the waiting list

We collect your first name, your email address and the course you are interested in (optional). We use them only to email you when new dates are announced. The law allows this because you asked us to (consent). You can change your mind at any time: email us and we will remove you.

When you send a message on the Contact page

We collect your name, email address, phone number (optional), what your message is about and your message. Your message is emailed to our inbox so we can reply. The website does not keep a copy. The law allows this because we have a good reason to answer you (legitimate interests).

Please tell us only what we need to help you.

Keeping our forms safe

When you send a form, Cloudflare Turnstile checks that you are a person and not a computer program. Cloudflare uses some information about your browser and device for this check.

To stop the same visitor trying many times, we keep a code made from your internet (IP) address for up to 10 minutes. The code cannot be turned back into your address.

The law allows this because we have a good reason to protect the website and our team from spam (legitimate interests).

When you visit the website

Cloudflare runs our website. To show you the pages and to protect the website from attacks, Cloudflare uses your internet (IP) address and basic information about your browser. We do not use analytics, adverts or tracking.

The map on the Contact page

The map comes from Google. It only loads if you press "Show the map". Google may then collect information and set cookies, as described in Google's Privacy Policy.

Who else handles your information

These companies work for us. They may only use your information to provide their service to us.

• Cloudflare runs the website, stores our database (in Western Europe) and checks our forms for spam.
• Stripe takes card payments. Stripe also has its own legal duties, for example to prevent fraud.
• Resend sends our emails: booking confirmations, receipts, reminders, refunds and messages to our team.
• Google runs our email inbox (Gmail), where booking notices and Contact page messages arrive.

Some of these companies are based in the United States or use services there. When your information leaves the UK, it is protected by the safeguards that UK law requires. [Check the safeguard each company uses.]

We never sell your information or share it for marketing.

How long we keep it

• Bookings that were not paid: deleted after 30 days.
• Paid and refunded bookings: deleted 6 years after the course ends. The law says we must keep financial records for this long.
• Waiting list: deleted 1 year after you join.
• Contact page messages: not kept on the website. They stay in our email inbox for [how long].
• The spam-check code: up to 10 minutes.

The website deletes these by itself. Stripe and Resend keep their own records for as long as their own rules say.

Your rights

You can ask us to:

• show you the information we hold about you, and give you a copy
• correct information that is wrong
• delete your information
• stop or limit how we use it
• remove you from the waiting list

To ask, email [email protected]. We may need to check that it is you. We will reply within one month. It is free.

If you ask us to delete your information, we remove your details from your bookings. We still keep a record of each payment, without your name or contact details, because the law says we must keep financial records. We also ask Stripe and Resend to delete what they hold, where they are allowed to.

If you are not happy

Please tell us first, so we can try to put it right. You can also complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint.

Adults only

Our courses are for adults aged 18 and over. We do not knowingly collect information about children.

Changes to this policy

If we change how we use your information, we will update this page.