Privacy Policy

We collect and use personal information only to the extent needed to confirm bookings, send session materials, and respond to enquiries. We do not sell your data, share it with third parties for marketing, or use it in ways unrelated to our services. We are committed to handling information with care and discretion — values that run through everything we do at Hearthway.

• To respond to your enquiry and discuss which programme may suit your situation
• To confirm bookings and send session preparation materials
• To process payment and issue receipts
• To send session summaries or follow-up materials after a programme
• To improve our website and understand how it is used (only if analytics consent is given)

We do not use your information for automated decision-making or profiling.

We process your information on the basis of:

• Contract: to fulfil a booking or enquiry you have made
• Legitimate interests: to operate and improve our educational services
• Consent: for optional analytics cookies (which you can withdraw at any time)

Enquiry and booking records are retained for up to 24 months after your last interaction with us. Session summaries sent to participants are not stored on our systems after dispatch. Analytics data, if collected, is retained for up to 14 months before being aggregated or deleted.

We use a small number of third-party services to operate this website and process bookings. These include:

• A website analytics provider (if analytics cookies are accepted)
• A payment processing provider (for secure payment handling)
• An email service provider (to send confirmation and session materials)

Each of these services has its own privacy practices. We select providers who meet appropriate data protection standards.

We use essential cookies to make the site work and optional analytics cookies to understand how it is used. You can manage your preferences at any time via our Cookie Policy page.

We take reasonable technical and organisational steps to keep your information secure, including using encrypted connections (HTTPS) and limiting access to personal data to those who need it to carry out their work. In the event of a data breach that poses a risk to your rights, we will notify you as required by applicable law.

You have the right to:

• Access the personal information we hold about you
• Ask us to correct inaccurate or incomplete information
• Ask us to delete your information (subject to legal obligations)
• Withdraw consent for optional processing (such as analytics cookies)
• Object to processing based on legitimate interests
• Request that we restrict how we use your information while a concern is resolved

To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days.

Our website may include links to external resources. We are not responsible for the privacy practices of those sites and recommend reviewing their policies independently.

Our services are intended for adults aged 18 and over. We do not knowingly collect personal information from anyone under 18.

We may update this policy from time to time. If we make material changes, we will update the date at the top of this page. Continued use of our services after any changes constitutes acceptance of the updated policy.