How I collect, use and look after your personal information, in plain English.
Last updated: 23 October 2026Hi lovely. This policy explains what personal information I collect when you visit my websites, buy from my shop, join a membership, take a course, come to a live workshop or join me on retreat, and how I look after it.
It follows the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR) and the changes made by the Data (Use and Access) Act 2025. Tap any section below to open it.
I am Bev Jessup, a sole trader based on the Isle of Wight, UK, trading as Christian Art Journaling and Creative Sanctuary. I am the "data controller", which means I decide how your information is used and I am responsible for keeping it safe. In this policy, "I", "me", "we" and "us" mean me and my small team of assistants who help me run the business.
I am not required to appoint a Data Protection Officer, so please contact me directly. I will reply personally.
I only collect what I need to deliver what you have asked for and to keep in touch with you if you want me to. You never have to give me personal information just to browse my websites or watch my YouTube videos.
UK law says I must have a lawful reason (a "lawful basis") for each way I use your information. I never sell, rent or trade your personal information.
| What I use it for | Information used | Lawful basis |
|---|---|---|
| Delivering digital products, courses, memberships and live workshops you have bought | Name, email, order, account details | Contract |
| Posting physical kits and products | Name, postal address, order | Contract |
| Taking payments, issuing refunds, managing payment plans and cancellations | Name, email, order, payment confirmation | Contract |
| Running retreats and in-person events safely | Booking details, emergency contact, health details you choose to share | Contract, and your explicit consent for health details (section 4) |
| Answering your questions and giving support | Contact details, messages | Legitimate interests (helping you) |
| Running my members' community and moderating it so it stays safe and kind | Profile, posts, comments | Contract and legitimate interests |
| Sending my newsletter, devotional emails and offers | Name, email, email activity | Consent, or the "soft opt in" for customers (section 6) |
| Showing my ads to people likely to be interested, and measuring them | Cookie and pixel data | Consent (section 7) |
| Understanding how my websites are used so I can improve them | Analytics data | Legitimate interests, with the right to opt out (section 7) |
| Using photos or videos from workshops and retreats in my marketing | Your image and voice | Consent, which you can withdraw at any time |
| Sharing testimonials | Your words and first name | Consent |
| Keeping business and tax records for HMRC | Orders, payments, invoices | Legal obligation |
| Preventing fraud, handling payment disputes and protecting my business | Order and payment records, messages | Legitimate interests |
Where I rely on legitimate interests, I have weighed my interests against yours and only go ahead where your privacy is not overridden. You can object at any time (section 11).
I do not make decisions about you using fully automated processes, including profiling, that have legal or similarly significant effects on you. I sometimes use AI writing and design tools to help me create content for my business, but I do not use them to make decisions about you.
When you book a retreat, Experience Day or other in-person event, I need a little more information so I can look after you well:
Health information is a "special category" of data under UK GDPR, so I only collect it with your explicit consent, which you give on the booking form. I share it only with the people who need it to look after you, for example our chef for dietary needs or a massage therapist for health checks before a treatment. I delete it within 3 months after the event ends.
My business is Christian, but I never ask you about your religious beliefs. If you choose to share your faith, prayers or personal stories in my community or at events, I treat that with care and never use it for advertising or share it outside the space you posted it in.
Some of my workshops touch on grief, loss and life changes. What you share in a live session or a members' community stays there. Please only share what you are comfortable with other members seeing.
I take photos at retreats and events and record some live workshops so members can watch the replay. I ask before using any image of you in my marketing. If you would rather not appear in a replay, keep your camera off or tell me, and I will do my best to remove you.
My websites, memberships, courses and retreats are for adults aged 18 and over. I do not knowingly collect information from anyone under 18 through them. If you think a child has given me their details, please email me and I will delete them promptly.
When I coach a young person, I work with their parent or guardian, who books and pays for the sessions and gives consent for their child to take part. I collect only what I need: the young person's name and age, the parent's contact details, the social communication questionnaire, session notes and homework. I share these only with the parent or guardian and keep them for the time set out in section 10. I hold an Enhanced DBS certificate.
I never pass your email address to other businesses for their own marketing.
Cookies are small files placed on your device when you visit a website. I use 3 kinds:
| Type | What it does | Your choice |
|---|---|---|
| Essential | Keeps you logged in to the members' area, remembers your basket and makes checkout work | Always on, because the site cannot work without them |
| Analytics | Counts visits and shows which pages are useful, so I can improve my sites | On by default under the Data (Use and Access) Act 2025 low risk rules. You can switch them off in the cookie settings at any time |
| Advertising | The Meta (Facebook and Instagram) Pixel and similar tools measure my ads and show them to people likely to be interested | Only with your consent. Off until you click Accept |
You can change your choices at any time through the cookie settings link at the bottom of my websites, or by clearing cookies in your browser. Turning off advertising cookies does not stop you seeing ads, but they will be less relevant.
My websites also include embedded content such as YouTube videos. These services may set their own cookies, covered by their own privacy policies.
I only share what each service needs to do its job. They act on my instructions and must keep your information secure.
| Who | Why | Where |
|---|---|---|
| GoHighLevel (LeadConnector) | Hosts my websites, checkout, emails, members' area and community | USA |
| Stripe | Takes card payments | UK, EU and USA |
| PayPal | Takes PayPal payments | UK, EU and USA |
| Meta (Facebook and Instagram) | Advertising, Pixel measurement, messages and comments | USA and Ireland |
| Google (YouTube, Google Forms, Google Drive, Gmail) | Livestreams, booking forms, file storage and email | USA |
| Zoom | Live online workshops and events | USA |
| Royal Mail or another courier | Delivering physical kits | UK |
| My assistants | Help me with customer support, technical setup, social media and video editing | India and the Philippines |
| Retreat and event suppliers (venue, chef, transport, therapists) | Looking after you at in-person events, sharing only what each needs | UK |
| My accountant | Bookkeeping and tax returns | UK |
I may also share information if the law requires it (for example with HMRC or the police), to protect my rights or someone's safety, or if my business is sold or becomes a limited company, in which case your information would move to the new owner under this same policy.
Some of the services in section 8, and my assistants, are based outside the UK. When your information goes abroad, I make sure it stays protected in one of these ways:
You can email me for more detail on how a particular transfer is protected.
I keep information only as long as I need it, then delete it or make it anonymous.
| Information | How long |
|---|---|
| Orders, payments and invoices | 6 years after the end of the tax year they relate to, as HMRC requires |
| Membership and course accounts | While your access is active, then 2 years after it ends, unless you ask me to delete it sooner |
| Community posts and comments | While the community runs, unless you delete them or ask me to |
| Email list | Until you unsubscribe. I also regularly remove people who have not opened my emails for a long time |
| Retreat health, dietary and emergency contact details | Deleted within 3 months after the event |
| Retreat and event bookings | 6 years, as financial records |
| Coaching notes and questionnaires | 2 years after the last session |
| Photos and video used in marketing | Until you withdraw consent, after which I stop using them in new material |
| Workshop replays | While the course or membership they belong to is available |
| Emails and messages | 2 years after our last contact, unless linked to an order |
Email [email protected], or simply ask me in a message. There is no fee in most cases. If I cannot confirm who you are from the email address you use with me, I may ask for a little more information to check it is really you.
I will respond within 1 month. If your request is complex, I may extend this by up to 2 more months and will tell you why. If I need more information from you to find what you are asking for, the time limit pauses until you reply. I will carry out a reasonable and proportionate search for your information.
If you are unhappy with how I have handled your personal information, please tell me first so I can put it right.
If you are still not satisfied, you have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator:
Other websites I link to, including social media platforms, have their own privacy policies, which I encourage you to read.
I review this policy at least once a year and whenever I change how I use your information. The latest version will always be on my website with the date it was updated. If I make a significant change, I will email you or let you know when you next log in.
Last updated: 23 October 2026