A clear thread through your data.

2. Hosting and server logs

The website is intended to use a hosting provider identified here as [Hosting provider – PLEASE ADD] . A web host may technically receive request information such as IP address, browser details, date and time, requested path and response status. This template does not claim that particular logs are retained: confirm what is collected, why, and for how long with the host.

Server-log retention: [Server log retention – PLEASE ADD] .

Site security may provide a legitimate-interest basis under Article 6(1)(f) UK/EU GDPR where applicable, subject to a documented balancing assessment and verification of the actual implementation. Do not rely on this wording without checking the deployed host and local law.

3. Forms and enquiries

The contact form is designed to submit only after a valid setup and a deliberate user submission. The intended Formspree contracting entity is [Formspree contracting entity – PLEASE ADD] .

• Contact form: name, email, topic and message.
• Group enquiry: name, email, preferred date, programme, group size and age range, plus any practical access needs you choose to include. Please do not submit health information or other sensitive details.
• Newsletter: email address and a record of consent.

Enquiry processing may rely on Article 6(1)(b) GDPR where processing is necessary to handle a request or prospective arrangement, where that basis applies. Newsletter processing relies on Article 6(1)(a) consent. Confirm the final basis and any provider terms before publication.

Recipients, storage location and retention: [PLEASE ADD] .

International-transfer safeguards for the host, Formspree and any newsletter processor: [International transfer safeguards – PLEASE ADD] . Verify the providers, their data-processing agreements and current transfer mechanisms.

5. Local assets and no tracking

Fonts are intended to be self-hosted. The site is designed not to use tracking cookies, analytics or localStorage. Re-check the production host, plugins and consent configuration so that this remains true after deployment.

6. Optional OpenStreetMap map

The map is designed as a two-step interaction. No map request is made before consent and an explicit Load map click. The iframe should load only when valid coordinates have replaced the placeholders; if coordinates are not configured, the button must make no network request.

When loaded, the browser and the map provider may receive IP address, referrer and browser/operating-system information. The page uses a minimized referrerpolicy="no-referrer" ; cookies and other provider-side processing remain provider-dependent. Map consent is intended to use Article 6(1)(a) GDPR where applicable.

OpenStreetMap service operator: [OpenStreetMap service operator – PLEASE ADD] .

Read the provider policy as an ordinary external text link: OpenStreetMap Foundation Privacy Policy . This page does not load a third-party script.

7. Your rights

Subject to applicable GDPR rules and exceptions, you may request access, correction, erasure or restriction; object to processing; request portability where applicable; and withdraw consent for future processing. Withdrawal does not affect processing carried out before withdrawal. Rights are not absolute and may depend on the legal basis and circumstances.

You may complain to [Data protection authority – PLEASE ADD] . Requests will be handled within the response period required by applicable GDPR law; no fixed outcome or response time should be promised here without review.