Privacy Policy
AVOLCA Studios — AVOLCA Group Limited Clapton, London | admin@avolca.com
AVOLCA Group Limited ("AVOLCA Studios", "we", "us") is the Data Controller for personal data collected through our booking system and premises. This policy explains what we collect, why, how long we keep it, and your rights under UK GDPR.
What We Collect and Why
Booking details — your name, professional/artist name, email, phone number, and social media handle. Used to process and manage your booking (legal basis: contract).
Photo ID — a government-issued photo ID uploaded at booking. Used solely to verify your identity before your session (legal basis: legitimate interest in venue security and accountability). Stored in encrypted private storage, never publicly accessible, and automatically deleted 30 days after your session, unless required for a live dispute, damage claim, fraud concern, chargeback, or legal matter. Once we have verified you, we keep only the outcome of that check — your name, date of birth, and verification status — as a business record, so that as a returning client you do not need to upload your ID again for future bookings. We do not keep the ID image itself beyond the retention period.
Payment information — payments are processed by Stripe. We never see or store your card number. Stripe securely retains your payment method so that charges permitted under our Terms (for example overruns or damage) can be applied; we hold only Stripe's reference codes.
Marketing preferences — if you tick the optional mailing-list box, we store your consent record (what you agreed to, when, and how) as required by the ICO. You can unsubscribe at any time using the link in any marketing email. Unsubscribing adds you to a suppression list so you are never accidentally re-added.
CCTV — CCTV operates throughout the premises at all times for security and safety. Footage is retained for up to 30 days, unless required in connection with an incident, dispute, insurance claim, or legal matter.
Session records — booking and payment records are retained for up to 7 years to meet legal and accounting obligations.
Who We Share Data With
We share personal data only with the service providers needed to run the booking system: Stripe (payments), Supabase (secure data hosting), Resend (transactional email), and Vercel (website hosting). We never sell your data or share it with third parties for their own marketing.
Your Rights
Under UK GDPR you have the right to access, correct, or request deletion of your personal data, to object to or restrict processing, to data portability, and to withdraw consent at any time (for consent-based processing such as marketing).
To exercise any right, email admin@avolca.com. We respond within one month. Note that some records (such as payment records) must be retained where we have a legal obligation, even after a deletion request — where full deletion is not possible we anonymise instead.
If you are unhappy with how we handle your data you may complain to the Information Commissioner's Office (ico.org.uk).
Changes
We may update this policy from time to time. The version published on this page applies to all bookings made while it is live.