Privacy and data protection

Who we are

eXchange (East Sussex Arts Education Network) is a registered charity in England and Wales, number 1179740. For data protection law we are the data controller for the personal data collected through this website. You can reach us at any time through the Say hello contact form on this site.

What we collect

Contact forms: your name, email address, the audience group you choose, and your message, so we can reply and route your enquiry to the right person.

Newsletter signup: your email address and a record of your confirmation, because the list uses double opt in. The confirmation email contains a single use link that expires after 48 hours.

Event RSVPs and submissions: the details you provide so we can run events and publish network supplied bulletin items.

Technical metadata: when you submit a form we store a one way hash of your IP address and browser type. A hash cannot be turned back into your IP address. We use this only to stop spam and abuse.

Our hosting provider also keeps standard web server logs for security and reliability.

What we never do

We do not use advertising or tracking cookies, we do not run third party analytics, and we do not build profiles of you. We do not sell, rent or trade your personal data, and we do not send your data outside the United Kingdom unless a supplier we name below requires it.

Our lawful bases

Consent: newsletter subscriptions, which you can withdraw at any time by unsubscribing or contacting us.

Legitimate interests: replying to your messages, running network events, and keeping the website secure from spam and abuse.

Legal obligation: charity records we must keep, for example governance and financial records.

Who processes data for us

This website is built and hosted by Holograph on servers in the United Kingdom. Email is delivered through our hosting mail service. When newsletter sending begins, the sending service will be named here before the first issue is sent.

How long we keep it

Contact form messages are kept for up to 24 months so we can follow conversations properly, then deleted. Newsletter subscription data is kept until you unsubscribe; we keep a record of your consent for up to 12 months afterwards so we can demonstrate it. Form metadata hashes are kept for up to 12 months.

How we protect it

The site runs over HTTPS only, with strict security headers and a content security policy. Secrets and credentials are stored outside the public web area, sensitive identifiers are stored only as hashes, and access to systems follows least privilege. Admin actions are logged.

Children

This website is aimed at professionals in schools and arts organisations, funders and parents. It is not designed to collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

Your rights

You can ask for a copy of your data, ask us to correct or delete it, ask us to restrict or stop using it, object to our use of it, and ask for a portable copy. You can withdraw consent at any time, which does not affect what we did before you withdrew.

To use any of these rights, contact us through the Say hello form. We will answer within one month.

You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

Changes to this notice

If we change what we collect or how we use it, we will update this page and change the review date above. Material changes will be flagged on the site for a reasonable period.