Privacy Policy

PLAI Jewellery is the data controller for the personal information described in this policy. We operate from Cambridge, Cambridgeshire, and provide workshops in Cambridge, London and across the United Kingdom.

For privacy questions or requests, email us at plai.jewellery@gmail.com.

When you send an enquiry, we may collect:

• your name and email address;
• your phone number, which we request for workshop enquiries;
• preferred location, date and group size;
• occasion details and anything you include in your message;
• organisation, location and proposal details when you contact us about a collaboration; and
• our correspondence with you about the enquiry or booking.

We also process limited technical information needed to operate and protect the website, such as an IP address used for short-term rate limiting and anti-bot verification. Please do not include sensitive personal information in the free-text message field.

On the production website, our privacy-friendly analytics may collect the page path and title, referrer, browser and device category, approximate country, screen size, language, anonymous interaction events and page-performance measurements. Analytics events never contain your name, email address, phone number or enquiry message.

To respond to enquiries and arrange workshops

We use your details to reply, check availability, prepare a quote, confirm a booking and provide the workshop. Our lawful basis is taking steps at your request before entering into a contract and performing a contract where a booking is confirmed.

To send marketing you ask for

If you actively tick the optional marketing box, we use your name and email address to send occasional workshop offers and PLAI news. Our lawful basis is consent. The box is not pre-selected and booking does not depend on agreeing. Every marketing email includes an unsubscribe link, and you can withdraw consent at any time.

To communicate and run our business

We may assess collaboration proposals, keep appropriate correspondence, resolve questions and improve our customer service. Our lawful basis is our legitimate interest in operating and improving PLAI Jewellery.

To keep the website secure

We use spam checks, rate limiting and anti-bot verification to prevent abuse. Our lawful basis is our legitimate interest in protecting our website, communications and customers.

To understand website use

We use anonymous, aggregate analytics to understand which pages and booking options are useful, measure successful enquiries and monitor Core Web Vitals. Our lawful basis is our legitimate interest in improving the website and our services without identifying visitors.

To meet legal obligations

We may retain or disclose information where reasonably necessary to comply with tax, accounting, legal or regulatory requirements.

Enquiries are available to the PLAI Jewellery team members who need them to respond or arrange a workshop. Depending on the booking channels configured on the website, an enquiry may also be processed by:

• our website hosting and infrastructure provider;
• Umami Cloud, for cookie-free website analytics;
• Resend, for transactional email and, with consent, marketing email;
• Telegram, for internal booking notifications;
• CallMeBot and WhatsApp, for WhatsApp notifications; and
• Cloudflare Turnstile, for anti-bot verification.
• Upstash, if enabled, for shared abuse prevention and aggregate site statistics. It receives short-lived hashed rate-limit keys and anonymous per-tab session identifiers, not raw IP addresses, names, email addresses or telephone numbers. Aggregate analytics are kept for up to 90 days.

If you contact us directly through Instagram, WhatsApp, Telegram or another third-party service, that provider will process information under its own privacy terms. We disclose information to professional advisers, regulators or law enforcement only where reasonably necessary or required by law.

Some service providers may process information outside the United Kingdom. Where UK data-protection law requires it, we rely on the provider's applicable transfer safeguards, such as an adequacy regulation or approved contractual protections. Contact us if you would like more information about the safeguards relevant to your data.

• Routine enquiries that do not become bookings are normally kept for no longer than 12 months after our last contact.
• Booking and transaction records may be kept for up to six years where needed for tax, accounting, contractual or legal purposes.
• Marketing contact and consent records are kept until you unsubscribe or ask us to delete them, subject to a minimal suppression record that prevents further marketing.
• Website rate-limit entries expire after about ten minutes and are not used to build customer profiles. If shared rate limiting is enabled, only a one-way hash derived from the request key is sent to that provider; otherwise entries remain in the web-server memory.
• Anonymous analytics are kept in our Umami Cloud account only while they remain useful for measuring website performance and enquiries.

We may retain information for longer where a dispute, legal requirement or safeguarding concern makes that necessary. Third-party communication services may retain copies according to their own settings and policies.

On the production website we use Umami Cloud to collect anonymous, aggregate page views, interaction events and Core Web Vitals. Umami does not use cookies, local storage, cross-site tracking or device fingerprinting, and we do not use it to identify individual visitors.

The booking form may also use Cloudflare Turnstile, a strictly necessary security service that processes browser and device signals and may use short-lived cookies or similar technologies to distinguish people from automated traffic. We do not use advertising cookies. We will update this policy and request consent before adding non-essential cookies, advertising technologies or identifiable profiling.

Depending on the circumstances, you may have the right to:

• ask for a copy of your personal information;
• correct inaccurate or incomplete information;
• ask us to delete or restrict the use of your information;
• object to processing based on legitimate interests; and
• receive certain information in a portable format.

To exercise a right, email plai.jewellery@gmail.com. We may need to verify your identity. These rights can be limited in some situations, including where we must retain records by law.

You can also complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint. We would appreciate the opportunity to address your concern first.

We use reasonable technical and organisational measures to protect personal information. No internet service is completely secure, so please contact us if you believe information has been compromised.

We may update this policy when our services, providers or legal obligations change. The latest version and its update date will always appear on this page.