Crafting by Steph is run by Stephanie Baker, who is responsible for the personal information described here. For privacy questions or to exercise your rights, email steph@craftingbysteph.co.uk.
Bookings and enquiries
When you book a workshop, we keep your name, email address, contact details you supply, event, number of places, booking reference, booking and payment status, and any message you provide. We use these to arrange your workshop, manage places, take or record payment and contact you about your booking. This is needed to provide the service you request. Please avoid putting sensitive personal information in booking notes; contact Steph directly if you need to discuss an adjustment.
Contact form enquiries are saved privately in the website and notified by email so Steph can respond. We use this information to answer your request and, where relevant, arrange a service. Booking access uses an emailed security code and a short private session. Codes expire after 10 minutes and booking sessions after 30 minutes. Short-lived rate limits help protect forms against abuse.
Newsletters
We use MailPoet to manage newsletter subscriptions, email addresses, subscription status and consent records. Newsletter marketing is based on your consent. You can unsubscribe through the link in a newsletter or by contacting Steph. Withdrawing newsletter consent does not stop essential messages about a booking you have made.
Who helps us provide the service
Steph Events manages the event information. WooCommerce holds booking and order records, and WooPayments provides online payment processing where offered. Payment providers process payment details under their own privacy information; our booking forms do not ask you to put card details in a message. DrayBird Designs provides website management and may access records when needed for support. 365i hosts the website and its database. MailPoet’s Sending Service delivers newsletters; the website’s configured email service delivers booking and enquiry messages. WooPayments uses Stripe for payment processing, with security and fraud-prevention services such as Sift and hCaptcha. These providers process the contact, transaction and technical information needed for their services. We do not sell your personal information.
If the optional Google Calendar connection is enabled, it receives event titles, dates, times, public venue information and an event link. It receives no attendee list, booking contact details or private event notes. Private engagements are shown only as booked time. Following an external booking or social link takes you to that provider’s website, where its privacy information applies.
Some service providers may process information outside the UK. Their privacy information explains their processing locations and safeguards: MailPoet / Automattic, Stripe, Sift and hCaptcha. Contact Steph if you need more information about a particular service or transfer.
Existing records and retention
Historic records from the previous Amelia and Mage systems, earlier orders and customer accounts are retained as business archives for booking verification, support and relevant financial records. Those old booking plugins are no longer needed to take new bookings. We keep information for as long as needed to fulfil the booking, deal with enquiries or disputes, meet applicable record-keeping obligations and maintain necessary suppression records after an unsubscribe. Retention depends on the purpose and the record; contact Steph for details relating to your information.
Authorised administration, hosting and security services may record technical information such as IP addresses and access or error logs to keep the website secure and investigate faults. This supports our legitimate interest in running a reliable, secure service. Relevant financial records may also be retained to meet legal obligations. Access to records is restricted to those who need it.
Your choices and rights
Depending on the circumstances, you can ask to access or correct your information, have it erased, restrict or object to its use, or receive a portable copy. Some records may need to be kept for legal reasons. You can withdraw consent where we rely on it. Contact Steph first if you have a concern; you can also complain to the Information Commissioner’s Office.
See our Cookie Policy for website storage. This notice will be updated when our services or data use change.