Legal
Dot Art Services CIC is a community interest company limited by guarantee, registered in England and Wales, No: 7088227.
Registered address: Jan McDermott and Co Chartered Accountants, 56 Hamilton Square, Birkenhead, Wirral, CH41 5AS
VAT Number: 255404320
Privacy Policy
Version: July 2026 | Replaces all previous versions
1. Introduction and Who We Are
dot-art Services CIC (company number 7088227, registered address: Jan McDermott and Co Chartered Accountants, 56 Hamilton Square, Birkenhead, Wirral, CH41 5AS) operates the Art Bytes programme. In this notice, “Art Bytes”, “we”, “us” and “our” refer to dot-art Services CIC acting as data controller for the Art Bytes programme.
We are committed to protecting the personal data of everyone who interacts with Art Bytes, including teachers, school staff, students, families, and members of the public. This privacy notice explains what personal data we collect, why we collect it, how we use it, and your rights under UK data protection law.
If you have any questions about this notice, or wish to exercise your data protection rights, please contact our Data Protection Lead: Lucy Byrne, dot-art Services CIC, 14 Queen Avenue, Castle Street, Liverpool, L2 4TX | hello@artbytes.co.uk | 0345 017 6660.
You have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at www.ico.org.uk at any time. We would, however, welcome the opportunity to address any concerns directly before you contact the ICO.
2. The Data We Collect and Why
We only collect personal data that is necessary for the purposes described below. The categories of data we process are set out in the table in Section 3.
2.1 School registration and programme administration
When a school registers for Art Bytes, the teacher or school administrator provides contact details (name, job title, school name, email address, telephone number) so that we can approve their account, communicate about the programme, and invoice for the registration fee. The lawful basis for this processing is
performance of a contract (Article 6(1)(b) UK GDPR), as well as our legitimate interests (Article 6(1)(f)) in administering the programme effectively.
2.2 Student artwork and names
Teachers upload photographs of students’ artwork and student details to the Art Bytes website. We suggest artwork is accompanied by a first name and surname initial only (e.g. “Kit P”) and the student’s school. We do not collect dates of birth, addresses, or any other directly identifying information about students. Teachers are responsible for uploading the correct information for each student and if they upload student surnames they must have been given permission to do so by a parent / guardian.
Acceptable artwork: Art Bytes accepts 2D artwork in any media. Photographic portraits of students are not accepted as submissions. This policy is in place on safeguarding grounds and to ensure that no images capable of identifying a child are published on the Art Bytes website or in the virtual gallery. Schools are asked to ensure submitted photographs show artwork only, not the students themselves.
Children’s data: Art Bytes is designed for Year 5 (ages 9–10) and Year 9 (ages 13–14) students. As these are children, we apply heightened care to their data. Schools act as the primary point of contact with families and are responsible for obtaining any necessary permissions from parents or guardians before submitting student artwork. We process student artwork and names on the basis of our legitimate interests in running a national arts education programme (Article 6(1)(f) UK GDPR), subject to appropriate safeguards, and where relevant on the basis of public task (Article 6(1)(e)) in supporting arts education.
Artwork submitted to Art Bytes will be published publicly on the Art Bytes website as part of each school’s portfolio page, in the virtual gallery, and may be shared via social media and printed materials to promote the programme. Schools are responsible for ensuring families are informed of this and consent is obtained where required by the school’s own policies.
2.3 The public vote
The public vote is an open, anonymous process. We do not collect personal data from voters beyond the vote itself. If cookies or session data are used to prevent repeat voting, these are managed in accordance with Section 4 of this notice.
2.4 Celebration events and invitations
We collect contact details for teachers to send invitations to shortlisted students and their families for celebration events. We share venue-specific information with shortlisted schools but do not directly hold or process the personal data of students’ families. Schools communicate with families directly.
2.5 Enquiries, feedback and research
If you contact us with an enquiry or take part in research conducted by our partner Liverpool Hope University, we collect only the data needed to respond or carry out the research. Research data may be held anonymously or in aggregated form for publication in our impact report.
2.6 Marketing communications
We may send programme news, updates, and relevant information to teachers and other contacts who have registered with Art Bytes or expressed an interest in the programme. The lawful basis for this is our legitimate interests (Article 6(1)(f)) in promoting arts education. You can opt out at any time by contacting us or clicking the unsubscribe link in any email.
3. Summary of Data Processing Activities
Purpose | Data collected | Lawful basis (UK GDPR) |
School registration and account management | Teacher name, school name, email, phone number | Performance of contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) |
Programme delivery (artwork upload, judging, voting) | Student first name + surname initial, school, artwork image | Legitimate interests (Art. 6(1)(f)) with heightened safeguards for children’s data |
Publication of artwork in virtual gallery and on website | Student first name + surname initial, school, artwork image | Legitimate interests (Art. 6(1)(f)); school responsible for parental permissions |
Celebration event invitations and logistics | Teacher contact details; shortlisted student first names passed to schools only | Performance of contract (Art. 6(1)(b)) |
Invoicing and financial records | School name, teacher/administrator name, email, address | Legal obligation (Art. 6(1)(c)); performance of contract (Art. 6(1)(b)) |
Research and impact evaluation (Liverpool Hope University) | Aggregated or anonymised data; interview data with consent | Legitimate interests (Art. 6(1)(f)); consent where required (Art. 6(1)(a)) |
Marketing and programme communications | Teacher name, email address | Legitimate interests (Art. 6(1)(f)); opt-out available at any time |
Website analytics and cookies | IP address, browser type, usage data (see Section 4) | Consent (Art. 6(1)(a)) for non-essential cookies; legitimate interests for necessary cookies |
4. Cookies and Website Analytics
The Art Bytes website uses cookies. Cookies are small text files placed on your device when you visit our site.
Necessary cookies are essential for the website to function (for example, to allow teacher login and maintain session data). These are placed automatically and do not require your consent.
Analytics cookies (such as those provided by Google Analytics) help us understand how visitors use the website. These are only placed with your consent, given via our cookie consent banner when you first visit the site. You can withdraw consent at any time by adjusting your browser settings or using the cookie settings panel on our website.
We use Google Analytics, which may transfer data to servers outside the UK. Where data is transferred internationally, we ensure appropriate safeguards are in place in accordance with UK GDPR requirements.
We do not use advertising cookies or share cookie data with third parties for marketing purposes.
5. Who We Share Your Data With
We do not sell personal data. We share personal data only where necessary for the programme to function:
- Venue partners (for celebration event logistics — school and attendee names only).
- Our judging panel members (school names and artwork files).
- Liverpool Hope University (for research purposes, under a data sharing agreement; data is anonymised or aggregated for publication).
- IT and website service providers (such as our web host Cyberfrog Design, WPForms, and Eventbrite) who process data on our behalf as data processors under appropriate contracts.
- The Arts Society and other programme sponsors, where schools have been sponsored by them (school name and registration status only; no student data is shared).
- HM Revenue & Customs and other regulatory bodies where legally required.
All third-party processors are required to handle personal data in accordance with UK GDPR and our instructions.
6. Our CRM System (HubSpot)
We use HubSpot as our Customer Relationship Management (CRM) system to organise and manage contact data across our programme. HubSpot is operated by HubSpot, Inc., headquartered in the United States, and processes data on our behalf as a data processor under a data processing agreement. As HubSpot may transfer personal data outside the UK, we ensure appropriate safeguards are in place, including HubSpot’s standard contractual clauses and UK IDTA-compatible mechanisms, in accordance with UK GDPR Chapter V.
The following categories of contact are held in HubSpot:
- School and teacher contacts: names, school names, job titles, email addresses, and telephone numbers of teachers and administrators who have registered for Art Bytes or expressed an interest in the programme. This data is processed on the basis of our legitimate interests (Article 6(1)(f) UK GDPR) in managing programme registrations and communications, and where applicable performance of a contract (Article 6(1)(b)).
- Corporate sponsor and prospect contacts: names, job titles, company names, email addresses, and notes relating to conversations with current or prospective corporate sponsors and partners. This data is processed on the basis of our legitimate interests (Article 6(1)(f)) in developing partnerships and securing sponsorship that supports the programme’s sustainability.
- Arts Society (TAS) contacts: names, society names, and contact details for TAS society coordinators and representatives involved in sponsoring schools. This data is processed on the basis of our legitimate interests (Article 6(1)(f)) in administering the TAS partnership. As noted in Section 7, TAS contact data is reviewed annually and legacy data will be cleaned up within 12 months of this notice taking effect.
- Existing partner and venue contacts: names and contact details for individuals at partner organisations (including cultural venues, Multi-Academy Trusts, and other programme partners) with whom we have an ongoing working relationship. This data is processed on the basis of legitimate interests (Article 6(1)(f)) and, where a formal agreement is in place, performance of a contract (Article 6(1)(b)).
We do not hold student data in HubSpot. No special category data is stored in our CRM. Contacts held in HubSpot have the right to access, correct, or request deletion of their data at any time by contacting hello@artbytes.co.uk. Further information about HubSpot’s own privacy practices is available at legal.hubspot.com/privacy-policy.
7. International Transfers
Some of our service providers (including Google Analytics and Eventbrite) may process data outside the UK. Where this occurs, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA) or equivalent mechanisms, in accordance with UK GDPR Chapter V.
8. Data Retention
We retain personal data only for as long as necessary:
- School and teacher contact data: retained for the duration of the school’s participation in Art Bytes and for six years thereafter, to meet our legal and financial record-keeping obligations.
- Student artwork and names: retained on the Art Bytes website for 24 months from the date of the celebration event for the relevant academic year, after which artwork and associated student names are deleted. Schools may request earlier removal at any time by contacting hello@artbytes.co.uk.
- Financial records: retained for six years as required by HMRC.
- Marketing contact data (including teacher and school contacts): reviewed annually; contacts who have not engaged in the previous 24 months are removed from our mailing list.
- Arts Society (TAS) society and coordinator contact data: treated as marketing data and reviewed every 24 months. Where contacts relate to individuals rather than organisations (for example, personal email addresses), we will seek to confirm continued engagement and delete data that is no longer current. Any TAS contact data held prior to the introduction of this policy will be reviewed and, where appropriate, deleted within 24 months of this notice taking effect.
- Research data: anonymised or aggregated data may be retained indefinitely for publication purposes; identifiable interview data is deleted once the research report is finalised.
- Website analytics: retained in accordance with Google Analytics default retention settings (typically 14 months); reviewed periodically.
9. Your Rights
Under UK data protection law, you have the following rights. To exercise any of them, please contact us at hello@artbytes.co.uk.
- Right of access: you may request a copy of the personal data we hold about you.
- Right to rectification: you may ask us to correct inaccurate or incomplete data.
- Right to erasure: you may ask us to delete your personal data where there is no longer a lawful basis for us to hold it.
- Right to restrict processing: you may ask us to pause processing of your data in certain circumstances.
- Right to data portability: where processing is based on consent or contract and carried out by automated means, you may request your data in a structured, machine-readable format.
- Right to object: you may object to processing based on legitimate interests, including for direct marketing. We will cease marketing communications immediately on request.
- Rights relating to children’s data: parents or guardians may exercise these rights on behalf of children. Schools should contact us to request removal of a student’s artwork or name.
We will respond to all requests within one month. We may ask you to verify your identity before processing your request.
If you are not satisfied with our response, you have the right to complain to the Information Commissioner’s Office (ICO): www.ico.org.uk | 0303 123 1113.
10. Data Security
We take appropriate technical and organisational measures to protect personal data against accidental loss, unauthorised access, alteration, or disclosure. These include password-protected systems, limited staff access on a need-to-know basis, and secure data hosting. We have procedures in place to detect, investigate, and report personal data breaches to the ICO and affected individuals where required by law.
11. Third-Party Links
The Art Bytes website contains links to third-party websites (including venue partner sites and The Arts Society). We are not responsible for the privacy practices of those sites and encourage you to read their own privacy notices.
12. Changes to This Notice
We may update this privacy notice from time to time. The current version will always be published on the Art Bytes website at artbytes.co.uk/legal. We will notify registered schools of any material changes by email.
This notice was last updated: July 2026.
dot-art Services CIC is a community interest company limited by guarantee, registered in England and Wales, No: 7088227. VAT No: 255404320. Registered address: Jan McDermott and Co Chartered Accountants, 56 Hamilton Square, Birkenhead, Wirral, CH41 5AS.
If you have any questions/comments about privacy or security, you should e-mail hello@artbytes.co.uk.
