Privacy Policy

Last updated: 13 September 2026.

Identity and Role of the Data Controller

glowstarly acts as the data controller for the purposes of this privacy policy. We are responsible for determining the purposes and means of processing personal data collected through our website and course services. Our operations focus on delivering specialised training in live production decks, control rooms, multi-camera switching, live broadcasting techniques, real-time video operation and professional management of television and streaming productions. All processing activities comply with the UK General Data Protection Regulation and the Data Protection Act 2018.

Scope of This Notice and the People It Covers

This notice applies to all visitors to our website, individuals who enquire about or enrol in our courses, and anyone who interacts with our services from within the United Kingdom. It covers personal data processed when you browse our site, submit enquiries via the contact form, register for courses or receive communications from us. The notice does not cover third-party websites linked from our pages.

Categories of Personal Data and Sources

We collect identification details such as your name, contact information including email address and telephone number, and any address you provide. Course-related data includes enrolment information, payment details processed securely by third parties, and records of your progress or attendance. Technical data such as IP address, browser type and device information is gathered automatically. Data is obtained directly from you through forms, from cookies and similar technologies, or from publicly available sources where relevant for verification purposes.

Purpose-by-Purpose Explanation of Processing and Legal Basis

We process your data to respond to enquiries and manage course bookings under the legal basis of contract performance or legitimate interest. Marketing communications are sent only with your consent, which can be withdrawn at any time. Analytics and service improvement rely on legitimate interests, balanced against your rights. Legal obligations require us to retain certain financial records. Each purpose is documented internally with corresponding lawful bases under UK GDPR.

Whether Providing Data Is Required and Consequences of Not Providing It

Supplying contact and enrolment details is necessary to process course registrations and respond to queries. If you do not provide this information we may be unable to deliver the requested services or communicate effectively. Optional fields such as additional preferences can be left blank without affecting core service delivery.

Cookies and Similar Technologies

Our site uses cookies and similar tracking technologies to enhance functionality and analyse usage. Essential cookies are required for basic operation while analytics cookies help us understand visitor behaviour. Details of the specific cookies deployed, their purposes and your choices for managing them are set out in our separate Cookie Policy, which is accessible via the site-wide cookie banner.

Processors, Service-Provider Categories, Recipients and Disclosures Required by Law

We engage service providers such as hosting platforms, payment processors and email delivery services to support our operations. These processors act under our instructions and are bound by appropriate contracts. Personal data may be disclosed to regulators or law enforcement where required by law. We do not sell personal data to third parties.

International Transfers and the Safeguards Used

Some service providers may process data outside the United Kingdom. In such cases we ensure appropriate safeguards are in place, including standard contractual clauses approved under UK GDPR or reliance on adequacy regulations where applicable. We assess the level of protection in the destination country before any transfer occurs.

Specific Retention Periods or Defensible Criteria

Enrolment records are retained for six years after course completion to meet accounting and legal obligations. Enquiry data is kept for up to two years unless you become a customer. Marketing consent records are maintained until consent is withdrawn. Technical logs are deleted after twelve months unless needed for security investigations. Retention decisions are reviewed annually against legal and operational requirements.

Security and Data-Minimisation Practices

We implement technical and organisational measures including encryption, access controls and regular security reviews to protect personal data. Data collection is limited to what is necessary for the stated purposes. Staff receive training on data protection responsibilities and access is granted only on a need-to-know basis.

All Applicable Data-Subject Rights and Practical Method for Exercising Them

You have the right to access, rectify, erase, restrict processing, port your data and object to processing in certain circumstances. To exercise these rights please contact us using the details on our Contacts page or by emailing [email protected]. We will respond within one month and may request identification to verify your identity before actioning requests.

Right to Withdraw Consent and Object to Direct Marketing or Profiling

Where processing is based on consent you may withdraw it at any time by contacting [email protected] or using unsubscribe links in emails. You can object to direct marketing and any profiling for marketing purposes by the same methods. Withdrawal does not affect processing carried out before the withdrawal.

Right to Complain to the Competent Supervisory Authority

If you are dissatisfied with our handling of your personal data you may lodge a complaint with the Information Commissioner’s Office, the UK supervisory authority. Contact details and guidance are available on the ICO website. We encourage you to contact us first at [email protected] so we can address your concerns directly.

Children or Age Restrictions

Our courses are intended for adults aged eighteen and over. We do not knowingly collect personal data from individuals under eighteen. If we become aware that data has been collected from a child without appropriate consent we will take steps to delete it promptly.

Automated Decision-Making and Profiling

We do not engage in automated decision-making or profiling that produces legal or similarly significant effects. Any analytics used are for internal service improvement and do not result in automated decisions about individuals.

Policy Changes and Effective Date

We may update this policy to reflect changes in law or practice. The current version will always be available on our website with the last-updated date clearly shown. Continued use of the site after changes constitutes acceptance of the revised policy. For questions please reach us via the contact form on our Contacts page or by calling 01494 671234.