1. Information We Collect

1.1 Information You Provide Directly

• Name and email address (newsletter subscription and account registration)

• Billing information: name, billing address, and payment card details — processed securely by Stripe (we do not store full card numbers on our servers)

• Account login credentials (username/email and password, stored in encrypted form)

• Artwork and portfolio files you voluntarily upload as part of a mentorship program or course exercise

• Messages, feedback, and support enquiries you send to us

1.2 Information Collected Automatically

When you visit our website, we and our third-party partners automatically collect:

• IP address and approximate geographic location

• Browser type, operating system, and device type

• Pages visited, time spent, and navigation path

• Referring URLs and search terms

• Cookie identifiers and advertising IDs (see Section 5)

1.3 Information from Third Parties

We may receive information about you from the following platforms when you interact with our ads or integrations:

• Meta / Instagram — if you interact with our advertisements on Facebook or Instagram, Meta may share anonymised engagement data with us via the Meta Pixel

• Google — analytics and advertising data via Google Analytics and Google Ads tags

2. How We Use Your Information

We use your personal information for the following purposes, and only where we have a lawful basis to do so:

To deliver our services:
Fulfil your course or mentorship purchase; provide access to course content; send receipts and booking confirmations.

To send marketing communications:
Send our newsletter and promotional emails (with your consent, which you may withdraw at any time).

To improve our content and website:
Analyse how users interact with our site via Google Analytics so we can improve the learning experience.

To run targeted advertising:
Show relevant ads to you and similar audiences on Meta and Google platforms (you can opt out — see Section 6).

To manage your account:
Authenticate logins, maintain your course progress, and store uploaded portfolio work.

To process payments:
Transmit billing data securely to Stripe for payment processing.

To comply with legal obligations:
Retain transaction records as required by applicable tax and consumer protection laws.

To protect our platform:
Detect fraud, abuse, and security incidents.

3. Legal Basis for Processing (GDPR & POPIA)

For users in the EU, UK, and South Africa, we process your personal information on the following legal bases:

• Consent — newsletter subscriptions, marketing emails, and non-essential cookies

• Performance of a contract — processing purchases, delivering course access, managing your account

• Legitimate interests — fraud prevention, website security, and improving our services (where these interests are not overridden by your rights)

• Legal obligation — retaining financial records as required by law

Where we rely on consent, you have the right to withdraw it at any time without affecting the lawfulness of prior processing.

4. Sharing Your Information

We do not sell your personal information. We share it only in the following limited circumstances:

4.1 Service Providers

We share data with trusted third-party providers who assist in operating our business:

• Stripe (payment processing) — stripe.com/privacy

• Google LLC (analytics and advertising) — policies.google.com/privacy

• Meta Platforms, Inc. (advertising) — facebook.com/privacy/policy

Each provider is contractually bound to use your data only for the services they provide to us and in accordance with applicable privacy laws.

4.2 Legal Requirements

We may disclose your information if required to do so by law, court order, or governmental authority, or where necessary to protect the rights, property, or safety of 1on1artschool.com, our students, or others.

4.3 Business Transfers

In the event of a merger, acquisition, or sale of all or part of our business, your personal information may be transferred as part of that transaction. We will notify you via email and/or prominent notice on our website before your data becomes subject to a different privacy policy.

5. Cookies & Similar Technologies

5.1 What Are Cookies?

Cookies are small text files placed on your device when you visit our website. We also use related technologies such as pixels, web beacons, and local storage.

5.2 Types of Cookies We Use

Strictly Necessary Cookies:
Required for the website to function — e.g. maintaining your login session, remembering your shopping cart, and enabling secure checkout. These cannot be disabled.

Analytics Cookies (Google Analytics):
Help us understand how visitors use our site — pages visited, time on site, and traffic sources. The data is aggregated and anonymised. We use IP anonymisation.

Advertising & Retargeting Cookies (Meta Pixel, Google Ads):
Track your activity on our site so we can show you relevant ads on Meta (Facebook/Instagram) and Google platforms, and measure the effectiveness of those ads.

Functionality Cookies:
Remember your preferences (such as language or region) to personalise your experience.

5.3 Managing Cookies

You can control and manage cookies in the following ways:

• Cookie consent banner: When you first visit our site, you will be prompted to accept or decline non-essential cookies.

• Browser settings: Most browsers allow you to refuse or delete cookies. Please note this may affect site functionality. Visit your browser's help section for instructions.

• Google Analytics opt-out: Install the Google Analytics opt-out browser add-on at tools.google.com/dlpage/gaoptout

• Meta ad preferences: Manage your ad settings at facebook.com/ads/preferences

• Google ad settings: Visit adssettings.google.com

6. Your Rights

Depending on your location, you may have the following rights regarding your personal information. We will respond to all verified requests within 30 days.

6.1 Rights Available to All Users

• Unsubscribe from our newsletter at any time using the unsubscribe link in any email

• Request access to the personal information we hold about you

• Request correction of inaccurate information

• Request deletion of your personal information (subject to legal retention requirements)

• Withdraw consent for marketing communications at any time

6.2 Additional Rights for EU/UK Users (GDPR)

• Right to data portability — receive your data in a structured, machine-readable format

• Right to restrict processing — in certain circumstances

• Right to object — to processing based on legitimate interests or for direct marketing

• Right to lodge a complaint with your local data protection authority (e.g. the ICO in the UK, or your national supervisory authority in the EU)

6.3 Additional Rights for South African Users (POPIA)

• Right to object to the processing of your personal information

• Right to lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za

6.4 Additional Rights for California Users (CCPA/CPRA)

• Right to know what personal information is collected and how it is used

• Right to opt out of the sale or sharing of personal information (we do not sell personal information)

• Right to non-discrimination for exercising your privacy rights

To exercise any of these rights, contact us at:

[email protected]

7. Data Retention

We retain your personal information only for as long as necessary for the purposes described in this policy, or as required by law:

• Account and course data: for the duration of your account, plus up to 3 years after closure

• Transaction and billing records: 7 years (standard financial record-keeping requirement)

• Newsletter subscriber data: until you unsubscribe

• Uploaded artwork/portfolio files: for the duration of your mentorship engagement, then deleted within 90 days of programme completion unless you request earlier deletion

• Analytics data: as configured in Google Analytics (typically 26 months)

8. Data Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, or misuse, including:

• SSL/TLS encryption for all data transmitted to and from our website

• Encrypted storage of passwords — we never store plain-text passwords

• Payment card data is processed exclusively by Stripe and is never stored on our servers

• Access controls limiting who within our organisation can access personal data

No method of internet transmission or electronic storage is 100% secure. While we take reasonable precautions, we cannot guarantee absolute security.

9. International Data Transfers

As a global business, your personal information may be processed in countries other than your country of residence — including the United States, where some of our service providers (Stripe, Google, Meta) are based. Where we transfer data from the EU/UK, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission, or equivalent mechanisms.

10. Children's Privacy

Our courses and services are intended for adults aged 18 and over. We do not knowingly collect personal information from children under the age of 13 (or 16 in the EU/UK). If you believe a child has provided us with personal information, please contact us immediately and we will delete it.

11. Third-Party Links

Our website may contain links to third-party websites. This policy applies only to 1on1artschool.com. We are not responsible for the privacy practices of other websites and encourage you to read their privacy policies before providing any personal information.

12. Changes to This Policy

We may update this Privacy & Cookie Policy from time to time. When we make material changes, we will notify you by email (if you have an account) and by posting a prominent notice on our website, with the updated effective date. Your continued use of our services after any changes constitutes acceptance of the revised policy.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy & Cookie Policy or how we handle your personal data, please contact us at:

1on1artschool.com

[email protected]

We aim to respond to all enquiries within 5 business days.