Scam Alert – Fraudsters are attempting to exploit the changing public health situation.

If you are unsure who is contacting you, phone your local council to check.

NHS Contact Tracers will never:

  • ask for bank details or payments
  • ask for details of any other accounts, such as social media
  • ask you to set up a password or PIN number over the phone
  • ask you to call a premium rate number, such as those starting 09 or 087 COVID19

Privacy policy

Colourfull Arts (Loxley Arts t/a) has a duty to collect contact data for Track and Trace purposes:

Why and who:

To support NHS Test and Trace (which is part of the Department for Health and Social Care) in England, we have identified the need to collect and keep a limited record of staff, customers and visitors who come onto our premises or attend our events for the purpose of contact tracing.

What data is collected?

By maintaining records of staff, customers and visitors, and sharing these with NHS Test and Trace where requested, we can help to identify people who may have been exposed to the Coronavirus. As a customer/visitor of Colourfull Arts Ltd you will be asked to provide some basic information and contact details. The following information will be collected:

  • The names of all customers or visitors, or if it is a group of people, the name of one member of the group.
  • A contact phone number for each customer or visitor, or for the lead member of a group of people.
  • Date of visit and arrival and departure time. In addition, if you only interact with one member of staff during your visit, the name of the assigned staff member will be recorded alongside your information. 

How is this personal data processed? 

NHS Test and Trace have asked us to retain this information for 21 days from the date of your visit, to enable contact tracing to be carried out by NHS Test and Trace during that period. We will only share information with NHS Test and Trace if it is specifically requested by them. For example, if another customer at the venue reported symptoms and subsequently tested positive, NHS Test and Trace can request the log of customer details for a particular time period (e.g.: this may be all customers who visited on a particular day or time-band, or over a two-day period). We may require you to pre-book appointments for visits and/or to complete a form on arrival. 

Under government guidance, the information we collect may include information which we would not ordinarily collect from you and which we therefore collect only for the purpose of contact tracing. Information of this type will not be used for other purposes (such as surveillance of an individual’s movements or marketing activities), and NHS Test and Trace will not disclose this information to any third party unless required to do so by law (e.g. as a result of receiving a court order). In addition, where the information is only collected for the purpose of contact tracing it will be destroyed by us 21 days after the date of your visit. However, the government guidance may also cover information that we would usually collect and hold onto as part of our ordinary dealings with you (perhaps, for example, your name, date of birth and phone number). Where this is the case, this information only will continue to be held after 21 days and we will use it as usually would, unless and until you tell us not to. Your information will always be stored and used in compliance with the relevant data protection legislation. 

What legislation this is covered by: 

The use of your information is covered by the General Data Protection Regulations Article 6 (1) (f) – legitimate interests of the venue/establishment. The legitimate interest in this case is the interest of the venue/establishment in co-operating with NHS Test and Trace in order to help maintain a safe operating environment and to help fight any local outbreak of coronavirus. 

Resolving complaints and concerns: 

If you do not wish your contact information to be passed to NHS Test and Trace if requested, please speak to the COVID Manager at the premises or event in question. By law, you have a number of rights as a data subject, such as the right to access information held about you. If you are unhappy or wish to complain about how your information is used, you should contact a member of staff in the first instance to resolve your issue. If you are still not satisfied, you can complain to the Information Commissioner’s Office. Their website address is 

Changes to our Privacy Policy & Covid19 guidance The public health situation can change at any time – Keep alert to updates from the UK government. 

This policy was last modified on 2 September 2020

What information do we collect?

We collect personal information from you (the Data subject) when you register on our site, place an order, subscribe to our newsletter or fill out a form.  We may link such data to your browsing activity and other such insights gathered by web analytics.  By providing any personal information you are giving us your explicit consent to store this securely within the EU/UK region and to use it for any relevant legal purposes.  At any time you can withdraw your consent, request a copy of your stored data or ask for your data to be erased (“be forgotten”) by sending your wishes to The Data Controller in writing.

You may, however, visit our site anonymously by using an incognito browser window.  

What do we use your information for?

Any of the information we collect from you may be used in the following ways:

  • To personalize your experience
    (your information helps us to better respond to your individual needs)
  • To improve our website
    (we continually strive to improve our website offerings based on the information and feedback we receive from users)
  • To improve customer service
    (your information helps us to more effectively respond to your customer service requests and support needs)
  • To process transactions
  • Your information, whether public or private, will not be sold, exchanged, transferred, or given to any other company for any reason whatsoever, without your consent, other than for the express purpose of delivering the purchased product or service requested
  • To administer a contest, promotion, survey or other site feature,  a contest, promotion, survey or other site feature that you wish to use.
  • To send periodic emails (where your consent for such use is explicitly given)

Note: If at any time you would like to unsubscribe from receiving future emails, we include detailed unsubscribe instructions at the bottom of each email.  You can also unsubscribe by using our Contact Us page

  • To detect and prevent fraud.
  • The email address you provide for order processing, may be used to send you information and updates pertaining to your order, so as to meet our contractual obligations.  It may also be shared with responsible delivery couriers who are bound by the same UK and EU Laws and Regulations, solely for the purpose of fulfilling that order.

How do we protect your information?

We implement a variety of security measures to maintain the safety of your personal information when you place an order or enter, submit, or access your personal information.

We offer the use of a secure server. All supplied sensitive information is transmitted via Secure Socket Layer (SSL) technology and then encrypted into our Payment gateway providers database only to be accessible by those authorized with special access rights to such systems, and are required to keep the information confidential, under the GDPR Regulations and English law.

Do we use cookies?

Yes (Cookies are small files that a site or its service provider transfers to your computer’s hard drive through your Web browser (if you allow) that enables the sites or service providers systems to recognize your browser and capture and remember certain information).

We use cookies to help us remember and process the items in your shopping cart, understand and save your preferences for future visits and measure the relevancy of site content displayed.

Do we disclose any information to outside parties?

We do not sell, trade, or otherwise transfer to outside parties your personally identifiable information. This does not include trusted third parties who assist us in operating our website, conducting our business, or servicing you, so long as those parties are bound by the same Regulations and confidentiality as ourselves. We may also release your information when we believe release is appropriate to comply with the law (our Legal obligations or the Vital interests of others).  However, non-personally identifiable visitor information may be provided to other parties for assistance with marketing or improving our products and services.

Third party links

Occasionally, at our discretion, we may include links to third party products, services or blogs on our website. These third party sites have separate and independent privacy policies. We therefore have no responsibility or liability for the content and activities of these linked sites. Nonetheless, we seek to protect the integrity of our site and welcome any feedback about such links.

Online Privacy Policy Only

This online privacy policy applies only to information collected through our confidential dealings with the Data subject and does not apply to publically available information.

Your Consent

By using our site, you consent to our privacy policy.

Changes to our Privacy Policy

If changes are made to our privacy policy, we will post those changes on this page, and/or update the Privacy Policy modification date below.

This policy was last modified on 6 August 2018