Legal
Privacy policy
Last updated: 9 November 2026
More Than Making looks after personal data under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR). We never sell personal data.
1. Who we are
More Than Making runs supervised practical workshops for kids in the UK. The data controller is Luke Barry, trading as More Than Making. Email: hello@morethanmaking.com. Use that email for any privacy question or request.
2. What we collect
When you register interest: your name, email address, phone number, town and area, your children’s age group and how many children, the date you registered, and your consent to be emailed about workshops.
When you book a workshop: the parent or guardian’s name, email and mobile number; an emergency contact’s name and number; each child’s name, age and class; any medical needs or allergies you tell us about; your consent choices (including a separate Yes or No for photography and for workshop updates); and the booking and payment record (amount, date, booking reference). Card details are entered on Stripe’s secure page. We never see or store your card number.
When a business asks about sponsoring a workshop: the business name, trade, town and website, and the contact’s name, email address and phone number, with any message they send.
When you email us: what you send us.
When you visit the website: the server keeps short technical logs (such as IP address and pages requested) for security. If you accept analytics cookies, Google Analytics records how the website is used (pages viewed, the type of device and roughly where in the country the visit came from, and steps such as starting a booking). We never send it names, emails, phone numbers or children’s details, and Google Signals and advertising features are switched off. If you reject, it doesn’t run at all. We don’t use advertising cookies. See the cookie policy.
3. How we use it, and our lawful basis
| What we do | Lawful basis under UK GDPR |
|---|---|
| Take and manage your booking, send your confirmation and essential messages about the workshop (such as a reminder or a change of time) | Contract: we need it to provide the workshop you booked |
| Keep children safe on the day: medical needs, allergies and emergency contacts | Explicit consent, which you give when you book (health information is “special category” data). You can ask us to update or remove it at any time. |
| Email you about new workshops near you, if you registered interest or said Yes to workshop updates | Consent. Every such email has an unsubscribe link, and you can unsubscribe at any time. |
| Take photos or videos at a workshop for our website or social media | Consent, only where you chose Yes. Children whose parent chose No are not photographed for publication. |
| Keep accounting records, handle refunds, insurance claims or incidents, and meet legal duties | Legal obligation and legitimate interests |
| Reply to businesses that ask about sponsoring a workshop, and manage sponsorships | Legitimate interests: running and funding the workshops |
| Count how many times each sponsor is shown and how many people click a sponsor’s link, to report to that sponsor. These are totals only: no cookie is used and nothing about you is recorded. | Legitimate interests |
| Keep the website secure and stop spam or abuse | Legitimate interests |
| Measure how the website is used with Google Analytics, so we can plan workshops and improve the site | Consent, given with Accept on the cookie choice. Change it any time with Cookie settings at the bottom of every page. |
4. Who we share it with
Only with people who need it, and only what they need:
- Stripe, to take payments securely (Stripe is an independent controller for payment data).
- Google (Google Analytics), only if you accept analytics cookies, to measure how the website is used. Google acts as our processor, may handle the data in the United States under its data processing terms, and the data is kept for 14 months.
- Our web host and email provider (Hostinger), who store the website and send our emails.
- Workshop staff and the venue, who see the class register, and medical and emergency details, so they can run the class safely.
- Our insurer, a first aider or the emergency services, if there is an incident.
- Anyone we must share with by law.
- We never share parents’ or children’s details with our sponsors. A sponsor’s link takes you to their own website, where their privacy policy applies.
Some of these providers may store data outside the UK. Where they do, they use safeguards approved under UK law, such as the UK International Data Transfer Agreement or adequacy regulations.
5. How long we keep it
| Data | How long |
|---|---|
| Interest list | Until you unsubscribe or ask us to delete it, or 2 years after your last contact with us |
| Bookings and registers | Up to 3 years after the workshop, for insurance, safeguarding and incident handling |
| Medical and allergy information | Deleted or anonymised within 3 months after the workshop, unless an incident means we must keep it longer |
| Payment and accounting records | 6 years, as HMRC requires |
| Sponsor enquiries | Until we have dealt with them, and no more than 2 years after our last contact; for sponsors we work with, as long as the sponsorship lasts plus 6 years for accounts |
| Photos and videos (Yes only) | Until you ask us to remove them; we’ll take them down from our own pages |
| Google Analytics data (if you accepted) | 14 months, then deleted by Google automatically. The analytics cookies themselves last up to 6 months. |
6. Children’s data
We collect children’s details only from their parent or guardian, and only what we need to run a safe workshop. We don’t send marketing to children or ask them for any details.
7. Your rights
- Access: ask for a copy of the data we hold about you.
- Rectification: ask us to correct anything wrong.
- Erasure: ask us to delete your data, where we don’t need to keep it by law.
- Restriction and objection: ask us to limit or stop using your data.
- Portability: ask for your data in a portable format.
- Withdraw consent at any time, for example by unsubscribing or changing your photography choice.
Email hello@morethanmaking.com and we’ll reply within one month. If you’re unhappy with how we’ve handled your data, you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113. We’d appreciate the chance to put things right first.
8. Security
The website uses an encrypted connection (HTTPS). Booking records are stored in a private area of our server that the web can’t reach, and only the organiser can sign in to the admin. Payments are handled by Stripe.
9. Changes
If we change this policy, we’ll update the date at the top. If a change affects how we use data you’ve already given us, we’ll tell you first.