GDPR Compliance Statement

1. Our Commitment

Will Carr Sculpture Ltd is committed to full compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This statement outlines our approach to data protection as both a data controller and data processor.

2. Controller and Processor Roles

Will Carr Sculpture Ltd acts as a data processor, processing data solely on the person’s behalf and under their documented instructions.

For website and marketing data: Will Carr Sculpture Ltd acts as data controller for data collected through https://willcarrsculpture.co.uk/ (contact forms, analytics, chat interactions).

3. Data Processing Agreements

We enter into Data Processing Agreements (DPAs) with all subscribing schools, detailing: the nature and purpose of processing; categories of data subjects and personal data; security measures; sub-processor arrangements; and data breach notification procedures.

DPAs are available on request from will@willcarrsculpture.co.uk.

4. Data Protection Impact Assessments

We conduct aim to Data Protection Impact Assessments (DPIAs) for processing activities that are likely to result in high risk to individuals. DPIAs are reviewed annually or when processing activities change materially.

5. Sub-Processors

We use the following categories of sub-processors:

• Cloud hosting and database services
• Payment processing
• AI model providers (for chat features)
• Email delivery services

A current list of sub-processors is available on request. Active clients are to be notified of sub-processor changes with [30] days’ notice.

6. Security Measures

We implement appropriate technical and organisational measures including:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
• Role-based access controls with principle of least privilege
• Regular penetration testing and vulnerability scanning
• Incident response and data breach notification procedures (within 72 hours to the ICO where required)
• Staff training on data protection and information security

7. Your Data Protection Rights

You have the right to request access to the personal information we hold about you, and in certain circumstances to request correction, restriction, erasure, or transfer of that information.

Where we process personal information based on consent, you may withdraw that consent at any time. This will not affect the lawfulness of any processing carried out before consent was withdrawn.

To exercise any of your rights, please contact us using the details provided below. We will respond in accordance with applicable UK data protection legislation.

8. International Transfers

Will Carr Sculpture Ltd is based in the United Kingdom. In some circumstances, personal information may be transferred outside the UK where this is necessary to facilitate international sculpture commissions, shipping, installation projects, website hosting, cloud storage, email services, or other business operations. Given the company’s international commissions and installations, overseas transfers may occasionally be necessary.

Where personal information is transferred outside the UK, we will ensure that appropriate safeguards are in place in accordance with UK data protection law, including the use of UK-approved contractual safeguards, adequacy regulations, or other lawful transfer mechanisms.

9. Personal Data Breaches

Will Carr Sculpture Ltd takes the security of personal information seriously and maintains procedures designed to prevent unauthorised access, loss, disclosure, or misuse of personal data.

In the event of a personal data breach, we will:

·        investigate the nature and scope of the incident;

·        take appropriate steps to contain and remedy the breach;

·        assess any potential risk to affected individuals;

·        notify the Information Commissioner’s Office (ICO) where required by law;

·        notify affected individuals where there is a high risk to their rights and freedoms; and

·        maintain records of the incident and any corrective actions taken.

10. Contact Us

If you have any questions about this Privacy Policy or how your personal information is handled, please contact:

Will Carr Sculpture Ltd
Weobley, Hereford, HR4 8QR, United Kingdom

Email: will@willcarrsculpture.co.uk
Telephone: +44 (0)7792 817950

This wording is much more appropriate for an artist’s website handling enquiries, commission requests, newsletter sign-ups, client communications, sales, and international sculpture projects rather than educational-sector data processing.