Privacy notice

1. Who is responsible, and what this notice covers

The data controller for this website and for individual DrawWarm accounts is Myron David Lambert, trading as DrawWarm, United Kingdom. Questions, requests and complaints about personal data go to hello@drawwarm.com with “Data” in the subject line. We are registered with the Information Commissioner’s Office as a data controller. We do not have, and are not required to have, a data protection officer.

This notice covers drawwarm.com, the simulator, the forms and emails we send, and the organisation console. It does not cover other sites we link to or embed, such as YouTube, Stripe’s checkout and billing pages, or social media, which have their own notices. Where you use DrawWarm through a college, training centre or employer, that organisation decides why and how your data is used and is the controller; we process it on its instructions under a data-processing agreement (section 10).

2. The short version

• The website uses no tracking cookies and no advertising networks. Analytics are cookieless and count visits, not people.
• If you give us your email, we use it for what you asked for. Marketing lists are double opt-in and every email has an unsubscribe link.
• Accounts store what the service needs: your sign-in, your progress, your subscription, and session records that keep one person to one account.
• Card details go to Stripe, never to us. Named-learner data for organisations is stored in the United Kingdom.
• We never sell personal data and we do not make automated decisions about you that have legal or similarly significant effects.

3. Where your information comes from

Almost all of it comes from you: the forms you fill in, the account you create, the way you use the simulator, and the emails you send us. Some comes from others: your organisation, when a tutor or manager invites you or creates your seat; Google or Microsoft, when you sign in with them (your email address and a name, nothing else); Stripe, when you pay (the payment outcome, card brand and last four digits); and Cloudflare, which sees the technical details of your connection to keep the site up. We do not buy data, run credit checks or take information from social media.

4. What we collect, why, and the lawful basis

Under UK GDPR we may use personal data only with a lawful basis: to perform a contract with you, to comply with a legal obligation, with your consent, or for a legitimate interest. A legitimate interest is a real business reason that is not outweighed by your own rights and interests; we have weighed each one below.

We do not collect special category data (health, ethnicity, beliefs, biometrics and the like) and we ask you not to send us any. We do not use your data for profiling or automated decision-making. If you do not give us something we need for the service, such as an email address, we cannot provide it.

5. Emails: service, product news and marketing

• Service emails (receipts, order confirmations, renewal reminders, security notices, changes to terms) go to everyone with an account. They are part of the service and cannot be turned off while you have an account.
• Product news (one new fault a month, new lessons and features) goes to customers who did not opt out when they created their account. The law allows this for our own similar services, provided you can refuse at sign-up and in every email, which you can: untick the box at sign-up, use the unsubscribe link in any email, or email us. We do not need your separate consent for this, but we treat a refusal as final until you tell us otherwise.
• Marketing to anyone else, for example the demo list, is sent only with consent, confirmed by clicking the email we send you, and every message has an unsubscribe link.
• We never sell, rent or swap your details, and we never send marketing on behalf of anyone else.

6. Who we share it with

Only the suppliers that run the service (our processors), each under a written contract that limits what they may do with the data, and only as much as each needs:

• Cloudflare (hosting, security, cookieless analytics, the gate that serves the simulator, and the servers that run each simulator session): a global network; data may pass through servers outside the UK. Simulator sessions run in Western Europe, and nothing is stored in them after a session ends.
• Supabase (the database and sign-in): hosted in the United Kingdom or the European Union.
• Stripe (payments, invoices, receipts).
• Resend (service emails) and our email marketing provider (product news and the mailing list).
• Google or Microsoft, if you sign in with them: they know you signed in to DrawWarm.
• Your organisation, if you use one of its seats: its Tutors, Admins and Managers see your progress and your membership.
• Professional advisers, banks and authorities where we must: to defend a chargeback or a claim, to enforce our terms, or where the law or a court requires disclosure.

If DrawWarm is sold or transferred to a successor business, your data transfers with it under the same protections, and you will be told.

7. International transfers

Some suppliers are in, or route data through, the United States or other countries outside the United Kingdom. Where that happens we rely on the UK International Data Transfer Agreement or Addendum, or on the UK Extension to the EU-US Data Privacy Framework where the supplier is certified under it, so that your data has equivalent protection. You can ask us for a copy of the safeguard that applies to a particular supplier.

8. How long we keep it

• Mailing lists and product news: until you unsubscribe, or 24 months after you last opened or clicked anything.
• Enquiries: 24 months after the last message.
• Accounts and progress: while you use them. Accounts that go quiet are archived; archived organisation accounts are deleted 12 months later and archived personal accounts 24 months later. You can ask for earlier deletion at any time.
• Sign-in and session records: 12 months, for security and to evidence account use in a dispute.
• Acceptance records (the terms and the tools’ gates) and tool lookups: six years, the period in which a claim about the work could be brought.
• Payment, invoice and checkout records: six years after the tax year they relate to, as HM Revenue and Customs requires.
• Encrypted backups: nightly copies are deleted after 30 days; a monthly copy and an off-site copy that cannot be altered are kept for 12 months, so a deleted account can persist in a backup for up to 12 months before it is gone everywhere.

After an account is deleted we may keep statistics that no longer identify anyone, such as how many people completed a lesson.

9. Your rights

Under UK GDPR you can ask us to:

• tell you what personal data we hold about you and give you a copy (access);
• correct it (rectification) or delete it (erasure), subject to records we must keep by law;
• restrict or object to how we use it, including objecting at any time to marketing;
• give you your data in a machine-readable form (portability);
• withdraw consent where consent is the basis, without affecting what was done before;
• not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you (we make none).

Some of these rights apply only in certain situations and all of them can be limited by law, for example where we must keep tax records. Email hello@drawwarm.com with enough detail to identify you and your request. We answer within one month, free of charge, and may ask you to confirm your identity first. If you would like this notice in another format, such as large print, ask and we will provide it.

If you are unhappy with our answer you can complain to the Information Commissioner’s Office: ico.org.uk, telephone 0303 123 1113, or Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. We would rather you told us first.

10. Organisations, and the learners in them

For the personal data of an organisation’s members, the organisation is the controller and DrawWarm the processor. We process that data only to provide the service on the organisation’s instructions, under the data-processing agreement in the procurement pack, which sets out the security measures, sub-processors, breach notification, deletion and audit rights. Named-learner data is stored in the United Kingdom. Members should direct rights requests to their organisation, which we will help.

11. Children

Individual accounts are for people aged 18 and over. Learners aged 16 and over may use DrawWarm through an organisation responsible for them. We do not knowingly collect data from anyone under 16; if you think we have, email us and we will delete it.

12. Security

Everything travels encrypted. The database enforces who can read what, row by row; backups are encrypted before they leave the database and stored separately; access to personal data is limited to the person who runs DrawWarm and is logged; suppliers are chosen for their own certifications. No system is perfect: if a breach ever puts you at risk we will tell you and the ICO as the law requires.

13. Cookies and browser storage

See the cookie policy. The short answer: nothing for tracking or advertising.

14. Changes

When this notice changes the date at the top changes with it, and account holders are told by email if the change affects them. Earlier versions are available on request.