GDPR Privacy Notice

Scope of this notice

This notice adds to our Privacy Policy and applies if you are in the European Economic Area or the United Kingdom. Where the two documents differ, this notice applies to you.

Glow Studio DIY is the controller of the personal data described here. You can reach us through our contact form.

What we process and why

We process only what you give us, plus the technical information a website necessarily receives:

• Contact form — name, email address, chosen topic and message, so that we can read and answer you.
• Email list — first name, email address and the page you subscribed from, so that we can send you the emails you asked for.
• Comments — name, email address, optional website, the comment, your IP address and browser user-agent, so that comments can be published and spam identified.
• Server logs — IP address, requested page, timestamp and user-agent, generated by our hosting provider to run and secure the site.

Our lawful bases

We rely on the following lawful bases under the UK GDPR and EU GDPR:

• Consent (Article 6(1)(a)) for sending you marketing emails and for publishing your comment. You can withdraw consent at any time.
• Legitimate interests (Article 6(1)(f)) for answering messages you send us, for moderating comments, and for keeping the website secure and available. We consider these interests proportionate and not overridden by your rights.
• Legal obligation (Article 6(1)(c)) where we are required to retain or disclose information by law.

Retention

Contact messages and subscriptions are kept while they remain useful for the purpose they were collected for, and are deleted on request. Published comments are kept with the post they belong to. Server logs are retained by our hosting provider for their own limited operational period.

Your rights

You have the right to:

• ask for a copy of the personal data we hold about you;
• ask us to correct data that is inaccurate or incomplete;
• ask us to delete your data;
• ask us to restrict how we use it;
• object to processing that we base on legitimate interests;
• receive the data you gave us in a portable format;
• withdraw consent at any time, without affecting processing already carried out.

To exercise any of these, please use our contact form. We will respond within one month, and we will not charge you for a reasonable request.

Automated decision-making

We do not use your personal data for automated decision-making or profiling.

International transfers

This website is operated with the help of service providers who may process data outside the EEA or the UK. Where that happens, we rely on the safeguards those providers put in place, such as standard contractual clauses or an adequacy decision.

Complaints

If you believe we have handled your personal data incorrectly, please tell us first so that we can put it right. You also have the right to complain to the data protection supervisory authority in the country where you live or work.

Changes

Any change to this notice will be published on this page with an updated date.