Privacy Policy

1. Who We Are (Data Controller)

The Paintertainer is operated by Wendy Holroyd as a sole trader offering face painting, body art, and entertainment services across Hertfordshire, Essex, London, and surrounding areas.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Wendy Holroyd is the Data Controller responsible for your personal data.

2. Data Collection via the Contact Form

When you submit a booking enquiry through the contact form on our website, we collect the following personal information:

• Name: To address you and know who is making the enquiry.
• Email address: To reply with quotes, check availability, and send booking confirmations and details.
• Telephone number: To discuss event details or reach you regarding your enquiry.
• Date and time of event: To confirm our availability for your requested date and time.
• Postcode / Event location: To determine travel requirements and ensure we can attend your venue.
• Message details: Any specific requirements, themes, or details you provide about your event.

We only collect information that is relevant and strictly necessary to respond to your enquiry and deliver our services. We do not use third-party marketing tracking cookies or invasive profiling scripts.

3. Lawful Basis for Processing

Under UK GDPR Article 6, we rely on the following lawful bases to process your personal data:

• Contract / Pre-Contractual Steps (Article 6(1)(b) UK GDPR): Processing is necessary in order to take steps at your request prior to entering into a contract (such as providing an event quote, checking dates, and responding to your booking enquiry), and subsequently to perform our contract if you make a booking.
• Legitimate Interests (Article 6(1)(f) UK GDPR): Processing is necessary for our legitimate interests in operating our entertainment business, responding to client correspondence, and ensuring efficient booking administration, balanced against your individual privacy rights.
• Legal Obligation (Article 6(1)(c) UK GDPR): Where an enquiry proceeds to a confirmed booking and payment, we must retain financial and transaction records to satisfy legal, accounting, and tax compliance obligations (e.g. HMRC requirements).

4. Third-Party Data Processors

We do not sell, rent, or trade your personal information. We share your data only with trusted third-party service providers (data processors) who assist us in operating our website and delivering communications:

• Mailgun (Mailgun Technologies, Inc. / Sinch): We use Mailgun as our transactional email delivery service. When you submit our contact form, your enquiry details are securely transmitted via Mailgun to deliver the enquiry notification to us and a confirmation copy to you. Mailgun processes data securely in compliance with applicable data protection laws.
• Cloudflare Turnstile (Cloudflare, Inc.): We use Cloudflare Turnstile on our contact form to protect our site against spam, automated abuse, and bots. Turnstile verifies that visitors are human without relying on invasive tracking cookies or harvesting user profile data.

5. Data Retention

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected:

• Enquiries without a confirmed booking: Contact form enquiries and email correspondence are retained for up to 12 months in case of follow-up questions, after which they are deleted, or deleted sooner upon your request.
• Confirmed bookings: For clients who book our services, booking confirmations, invoices, and payment records are retained for up to 6 years following the end of the relevant tax year in accordance with UK statutory accounting and tax regulations.

6. Your Rights (SAR & Erasure)

Under the UK GDPR and Data Protection Act 2018, you have individual rights regarding the personal data we hold about you:

• Right of Access (Subject Access Request - SAR): You have the right to request a copy of the personal information we hold about you and to verify the lawfulness of our processing.
• Right to Erasure ("Right to be Forgotten"): You have the right to request that we delete or remove your personal data where there is no compelling or legal reason for its continued retention.
• Right to Rectification: You have the right to have inaccurate or incomplete personal information corrected.
• Right to Restriction of Processing: You have the right to ask us to suspend the processing of your personal data under certain circumstances (e.g. while accuracy is verified).
• Right to Object: You have the right to object to the processing of your personal data where we rely on legitimate interests.
• Right to Data Portability: You have the right to request the transfer of your personal data to you or a third party in a structured, commonly used format.

How to Exercise Your Rights: If you wish to make a Subject Access Request (SAR), request erasure, or exercise any of your rights, please email Wendy Holroyd at [email protected]. We will respond within one calendar month, free of charge.

7. Right to Lodge a Complaint

If you have concerns about how we handle your personal data, we encourage you to contact us first so we can resolve the matter. You also have the right to lodge a complaint at any time with the UK supervisory authority:

8. External Links

Our website includes links to external websites, such as our Facebook page. Please note that external websites are governed by their own privacy policies, and we do not accept responsibility or liability for their practices.