1. Who we are
Art Engine Limited (trading as Expansion Works), a company registered in England and Wales (company number 14851930) with its registered office at 30 Russell Street, Woburn Sands, Milton Keynes, England, MK17 8NX (“we”, “us”, or “our”), is the ‘Data Controller’ for the personal information collected on this website.
Contact: [email protected]
2. The types of personal data we collect
We currently collect and process the following information:
- Identity & Contact Data: Name, email address, and phone number (if provided via forms).
- Special Category Data: Information regarding your mental health, stress levels, or interest in MAP services, which you may provide to us voluntarily.
- Technical Data: IP address, browser type, and usage data collected via cookies and similar technologies.
3. Lawful basis for processing
Under the UK GDPR, we rely on the following legal bases:
- Consent: You have given clear consent for us to process your data for a specific purpose (e.g., signing up for a newsletter).
- Legitimate Interests: Processing is necessary for our legitimate interests in providing and improving our services, provided these do not override your rights.
- Special Category Data: We process health-related data only with your Explicit Consent or for the provision of health or social care.
4. Where your data is held and how long we keep it
We do not store your personal information on our own computers. It is held securely by specialist providers who process it on our behalf under written data-processing agreements (“processors”). Our core membership database is hosted in the United Kingdom / EU, and we never hold your card details — these are handled entirely by Stripe.
The specialist providers we use, and what each handles:
- Supabase — accounts, profiles, community and the membership database (name, email, profile, posts, membership status). UK / EU.
- Stripe — payments, subscriptions and VAT (billing details and card data, held by Stripe, not us). UK/EU and US, with safeguards.
- Bunny / Cloudflare — video hosting and delivery (video content and viewing requests). EU / global CDN.
- Resend — service and account emails (name, email). US, with safeguards.
- Flodesk — our marketing and newsletter emails (name, email, and the interest group you joined). US, with safeguards (Standard Contractual Clauses).
- Cal.com — call and session booking (name, email, booking details).
- Zoom — live group sessions (name, and your presence during sessions). US / global, with safeguards.
- Telegram — our members’ community group (your Telegram user ID, to add and remove you from the group). International, with safeguards.
- Google / Apple — optional secure sign-in (sign-in identity). US, with safeguards.
Where a provider is outside the UK/EU, appropriate safeguards (such as Standard Contractual Clauses or the UK International Data Transfer Addendum) are in place. Exact locations follow each provider’s current data-processing agreement.
How long we keep it: only as long as needed to provide your membership. The community feed is deleted on a rolling 30-day cycle; inactive accounts are closed after around 12 months with notice; and you can delete your account and its data at any time. Limited transaction records are kept where the law requires (for example, tax records held by Stripe).
5. Your data protection rights
Under UK law, you have the right to:
- Access: Request copies of your personal data.
- Rectification: Ask us to correct inaccurate information.
- Erasure: Request that we erase your personal data (the ‘right to be forgotten’).
- Restriction: Ask us to restrict the processing of your data.
- Object: Object to the processing of your data in certain circumstances.
6. How to complain
If you have concerns about our use of your personal data, you can contact us at [email protected]. You can also complain to the ICO if you are unhappy with how we have used your data:
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
Helpline: 0303 123 1113 | Website: www.ico.org.uk