Last updated: 01/10/2026

1. About this Privacy Policy

This Privacy Policy explains how Islington Mill Studios CIC (“Islington Mill”, “we”, “us” or “our”) collects, uses, stores and shares personal data.

It applies to personal data collected through our website, Wi-Fi service, studio and workspace activities, events, communications, enquiries, bookings, memberships, licences, contracts and other interactions with us.

This Privacy Policy does not form part of any contract unless expressly stated otherwise. It should be read alongside any specific privacy information we provide when collecting personal data, including information relating to our Wi-Fi service, events, bookings, employment or studio licences.

Islington Mill is the controller responsible for the personal data covered by this Privacy Policy.

Address:
Islington Mill Studios CIC
1 James Street
Salford
M3 5HW

Email: contact@islingtonmill.com

2. Personal data we collect

The personal data we collect depends on how you interact with us. It may include:

Your name and contact details, including email address, telephone number and postal address.
Information about your organisation, studio, business or creative practice.
Information relating to studio licences, memberships, bookings, events, payments and other services.
Account, login and authentication information.
Communications and correspondence, including enquiries, feedback, complaints and support requests.
Information about accessibility requirements, dietary requirements or other information you choose to provide when attending an event or using our facilities.
Payment, billing and transaction information. Payment card details may be processed directly by our payment providers and may not be stored by us.
Photographs, video recordings or other media captured at our premises or events, where applicable.
Information provided when you apply for employment, volunteering, commissions, residencies or other opportunities.
Information about your preferences, interests and interactions with our communications.
Technical information about devices and use of our website or Wi-Fi service, including IP addresses, device identifiers, browser information, connection times, authentication information, diagnostic information and network activity.
Information contained in documents or correspondence that you provide to us.
Information that is publicly available or provided to us by third parties where lawful and appropriate.

We may also process special category data, such as health or accessibility information, where you choose to provide it and where it is necessary for a specific purpose, such as arranging reasonable adjustments or managing an event. We will only process this information where an appropriate legal condition applies.

3. How we collect personal data

We may collect personal data:

Directly from you, including when you contact us, complete a form, make a booking, enter into an agreement, attend an event or use our facilities.
Automatically when you use our website, Wi-Fi service or other digital systems.
From your organisation, employer, representative or another person acting on your behalf.
From service providers, booking platforms, payment providers, professional advisers and other organisations involved in providing services to us.
From publicly available sources, where lawful and appropriate.
Through CCTV, photography, filming or other recording at our premises or events, where applicable and subject to appropriate notices.

4. How we use personal data

We may use personal data to:

Provide, administer and improve our studios, workspaces, events, programmes and other services.
Manage studio licences, memberships, bookings, contracts, payments and accounts.
Respond to enquiries, requests, complaints and correspondence.
Communicate with you about services, bookings, events, opportunities, changes and operational matters.
Operate, maintain and secure our website, Wi-Fi service, systems and facilities.
Authenticate users and manage access to our premises, networks and services.
Monitor and investigate technical faults, security incidents, misuse and suspected unlawful activity.
Maintain records and comply with legal, regulatory, accounting and reporting obligations.
Protect the safety, security and rights of our users, staff, visitors, contractors and organisation.
Manage emergencies, incidents, safeguarding concerns and insurance matters.
Recruit and manage employees, volunteers, freelancers, artists, contractors and other workers.
Promote Islington Mill, its activities, events, artists and community, including through photography, filming and other media where appropriate.
Understand how our services and communications are used and improve them.
Send information about events, activities, opportunities and services where permitted by law.
Establish, exercise or defend legal claims.
Prevent and detect fraud, crime, misuse and other unlawful activity.
Carry out any other purpose explained to you when your personal data is collected.

We will not use your personal data for a new purpose that is incompatible with the original purpose unless we have a lawful basis to do so and, where required, provide further information.

5. Lawful bases for processing

We process personal data only where we have a lawful basis under applicable data-protection law. Depending on the circumstances, this may include:

Contract: where processing is necessary to enter into or perform an agreement with you.
Legal obligation: where processing is necessary to comply with a legal or regulatory requirement.
Legitimate interests: where processing is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and interests.
Consent: where you have given consent, such as for certain marketing communications, photography or filming.
Vital interests: where processing is necessary to protect someone’s life or prevent serious harm.
Public task: where applicable, where processing is necessary for a task carried out in the public interest or under official authority.

Where we rely on consent, you may withdraw it at any time. Withdrawal will not affect the lawfulness of processing carried out before consent was withdrawn.

Where we process special category data, we will also rely on an applicable additional condition under data-protection law.

6. Marketing and communications

We may send you information about Islington Mill’s events, activities, opportunities, services and community where permitted by law.

You can opt out of marketing communications at any time by using the unsubscribe link in the message or contacting us at contact@islingtonmill.com.

You may continue to receive essential service communications, such as information about bookings, studio licences, payments, safety, security or changes to our services.

7. Wi-Fi and technical information

When you use Islington Mill’s Wi-Fi service, we may process limited technical information to operate, maintain and secure the network, investigate faults, prevent misuse and respond to lawful requests.

This may include:

Device identifiers, including MAC addresses.
IP addresses assigned to or used by connected devices.
Connection, disconnection and authentication times.
Technical diagnostic, security and network performance information.
Information about network traffic or attempted access where necessary for security, troubleshooting or investigation.

We will not routinely inspect the content of your private communications. However, limited technical information may be processed where reasonably necessary for network operation, security, troubleshooting, investigation or compliance with legal obligations.

Wi-Fi is a shared communication service and cannot be guaranteed to be completely secure. You are responsible for taking reasonable steps to protect your devices, accounts and information.

8. Cookies and similar technologies

Our website may use cookies and similar technologies to operate effectively, remember preferences, understand website usage and improve our services.

Some cookies may be placed by third-party service providers, such as analytics, booking, payment, video, social-media or embedded-content providers.

Where required by law, we will ask for your consent before placing non-essential cookies. You can manage cookies through your browser settings or any cookie-management tool we provide.

Disabling cookies may affect the functionality of our website.

9. Photography, filming and publicity

Photography, filming or other recording may take place at our premises, events and activities.

We may use images or recordings for purposes such as documenting, promoting and reporting on Islington Mill’s work, events, community and activities, including on our website, social-media channels, publications, funding reports and promotional materials.

Where appropriate, we will provide notices or seek consent. If you do not wish to be photographed or filmed, please speak to a member of staff or the event organiser. We will take reasonable steps to respect your request, subject to the circumstances and any legal or operational requirements.

If you believe an image or recording has been used inappropriately, please contact us at contact@islingtonmill.com.

10. Who we share personal data with

We may share personal data with:

Service providers who support our operations, including IT, hosting, communications, booking, payment, accounting, insurance, security and facilities providers.
Professional advisers, including lawyers, accountants, auditors and insurers.
Event partners, funders, commissioners, artists, contractors and organisations involved in delivering a service or programme.
Employers, organisations or representatives where necessary to administer a booking, licence, programme or other arrangement.
Law enforcement authorities, regulators, courts or public bodies where required or permitted by law.
Emergency services or other organisations where necessary to protect someone’s vital interests or safety.
Buyers, advisers or other parties involved in a merger, restructuring, sale or transfer of all or part of our organisation or assets.
Other recipients where you have asked us to share information or have otherwise agreed.

We require service providers processing personal data on our behalf to protect it and use it only for authorised purposes.

We do not sell personal data.

11. International transfers

Some of our service providers may process personal data outside the United Kingdom.

Where personal data is transferred internationally, we will ensure that appropriate safeguards are in place as required by applicable data-protection law. These safeguards may include an adequacy decision, approved contractual protections or another lawful transfer mechanism.

You can contact us for further information about the safeguards used for a particular transfer.

12. How long we keep personal data

We retain personal data only for as long as necessary for the purposes for which it was collected, including to meet legal, accounting, reporting, insurance and dispute-resolution requirements.

Retention periods vary depending on the type of information and the reason it is held. For example:

Enquiry and correspondence records may be retained for as long as necessary to manage the enquiry and any related relationship or dispute.
Contract, licence, booking and payment records may be retained for the duration of the relationship and for an appropriate period afterwards.
Marketing information may be retained until you unsubscribe or it is no longer necessary.
Wi-Fi and security logs may be retained for as long as necessary for network operation, security, troubleshooting, investigation and legal compliance.
Recruitment and application records may be retained in accordance with our recruitment and employment retention arrangements.
Images and recordings may be retained for as long as necessary for the relevant documentation, publicity, archival or reporting purpose.

When personal data is no longer required, we will securely delete it, anonymise it or otherwise dispose of it in accordance with our retention arrangements.

13. Security

We use appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

These measures may include access controls, authentication, secure storage, backups, staff training, supplier due diligence and procedures for responding to security incidents.

No method of transmission or storage is completely secure. You should take reasonable steps to protect your own accounts, devices and information.

14. Your rights

Subject to applicable law, you may have the right to:

Request access to the personal data we hold about you.
Request correction of inaccurate or incomplete personal data.
Request deletion of personal data in certain circumstances.
Request restriction of processing in certain circumstances.
Object to processing based on legitimate interests or for direct marketing.
Request transfer of certain personal data to you or another organisation.
Withdraw consent where we rely on consent.
Complain to the Information Commissioner’s Office.

These rights are subject to legal exceptions and may not apply in every circumstance.

To exercise your rights, contact us using the details in section 17. We may need to verify your identity before responding.

We aim to respond within the time required by applicable law. We will not normally charge a fee, but we may charge a reasonable fee or refuse a request where the law permits this, including where a request is manifestly unfounded or excessive.

15. Children and young people

Our services and activities may be attended or used by children and young people.

Where we collect personal data about a child or young person, we will take reasonable steps to provide appropriate information and obtain consent or authorisation where required.

Parents, guardians or carers should contact us if they have questions about personal data relating to a child or young person.

16. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in our activities, services, technology, legal requirements or data-processing practices.

The current version will be published on our website or otherwise made available to you. Where a change is material, we will take reasonable steps to bring it to your attention.

17. Contact us

If you have questions about this Privacy Policy, wish to exercise your rights or have a concern about how we process personal data, please contact:

Islington Mill Studios CIC
1 James Street
Salford
M3 5HW

Email: contact@islingtonmill.com

18. Complaints

If you are unhappy with how we have handled your personal data, please contact us first so that we can investigate and try to resolve your concern.

You also have the right to complain to the Information Commissioner’s Office:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Website: https://ico.org.uk/make-a-complaint/
Telephone: 0303 123 1113

19. Governing law

This Privacy Policy is governed by the law of England and Wales, subject to any mandatory rights or protections that apply under applicable law.

Privacy Policy