Privacy & Cookies Policy

Who we are

Evoke is the name used by these two organisations:

• Evoke Creative Wellness Limited, company number 15527605, registered in England and Wales. Registered office: 4 Capricorn Centre, Cranes Farm Road, Basildon, England, SS14 3JJ.
• Evoke Creative Legacy CIC, company number 16305465, a Community Interest Company registered in England and Wales. Registered office: 4 Cranes Farm Road, Basildon, England, SS14 3JJ.

Evoke Creative Wellness Limited is the data controller for the website generally, the corporate enquiry form and emails about corporate programmes. Evoke Creative Legacy CIC is the data controller for the community partner form and community enquiries. A data controller is the organisation responsible for deciding how and why your personal information is used.

You can contact either organisation about this policy at hello@evokewithevoke.com.

What information we collect

• Corporate enquiry form: first name, last name, organisation, work email, programme type, team size and the goals you describe in the free-text field.
• Community partner form: first name, last name, organisation, email, your role and the interest you describe in the free-text field.
• Email: your email address and any information you choose to include in messages and attachments you send us.
• Technical information: our hosting provider records server logs for security and operation. These may include your IP address, browser and device information, pages requested, and the date and time of requests.
• Analytics (only if you accept): if you accept analytics in our cookie banner, Google Analytics 4 collects the pages you visit, how you arrived (the referrer), your approximate location (country or city, derived by Google), your device, browser and operating system, and interactions such as scrolls and link clicks. Google Analytics 4 does not log or store IP addresses. We see aggregated reports, not who you are.
• Your cookie choice: a record of whether you accepted or rejected analytics, saved in your browser only when you make a choice (see Cookies below).

Please do not include sensitive personal information, such as health details or other special category information, in the forms or their free-text fields. We do not need this information to respond to an initial enquiry.

How and why we use your information

Under the UK GDPR, we use the following lawful bases:

• Responding to and following up enquiries: our legitimate interests in communicating with people who contact us and understanding their needs. Where you ask us to take steps before entering into a contract with you, we may instead rely on those pre-contractual steps.
• Operating and protecting the website: our legitimate interests in keeping the site secure, available and working properly.
• Understanding how the website is used: your consent (UK GDPR Article 6(1)(a)), given through the cookie banner. We also need your consent under the Privacy and Electronic Communications Regulations (PECR) to set the Google Analytics cookies. We use the reports to see which pages are visited and to improve the site. We do not use analytics for advertising.
• Remembering your cookie choice: this record is strictly necessary to respect your choice, so it does not need your consent.

Sending an enquiry does not add you to a marketing list. We will not send you marketing emails without your consent. We do not use your information for automated decision-making or profiling, and we never sell personal information.

Who we share information with

We use service providers to help run the website and handle enquiries. They process information on our instructions for these purposes:

• Resend: delivers form submissions by email.
• Vercel: hosts the website and handles technical logs.
• Google Workspace: hosts our email inbox and correspondence.
• Google (Google Analytics): provides website analytics, only if you accept analytics in our cookie banner.

Form submissions are sent to our inbox at hello@evokewithevoke.com. Your email address is used as the reply address so that we can respond directly. We do not send an automatic reply.

Some providers, including Google if you accept analytics, may process personal information outside the UK, for example in the United States. Where this happens, we rely on applicable safeguards offered by the provider under UK data protection law. These may include the UK-US Data Bridge, where applicable, or contractual safeguards such as the UK International Data Transfer Addendum. The appropriate mechanism depends on the provider and the transfer. You can email hello@evokewithevoke.com for more information about the safeguards that apply and, where available, a copy of them.

How long we keep information

We keep form messages and related enquiry correspondence for up to 24 months from our last contact, then delete them. If an enquiry becomes a client or partner relationship, we keep relevant records for as long as that relationship and our legal obligations require.

Technical server logs are kept for the short retention period applied by our hosting provider, rather than the enquiry retention period.

Google Analytics event data is kept for the period set in our Google Analytics account, which is no longer than 14 months. This is separate from how long the cookies last in your browser (see Cookies below). We keep your cookie choice in your browser for 12 months, after which we ask again.

Keeping information secure

We take reasonable technical and organisational steps to protect personal information against unauthorised access, loss or misuse. However, no website, email service or method of transmission is completely secure. Please avoid sending information we do not need.

Your data protection rights

Depending on the circumstances and the lawful basis for processing, you have rights under the UK GDPR to:

• Access your personal information and receive a copy.
• Have inaccurate or incomplete information corrected.
• Ask for your information to be erased.
• Ask us to restrict how we use your information.
• Object to processing based on legitimate interests.
• Receive or transfer information in a portable format where the right to data portability applies.
• Withdraw consent at any time where we rely on consent, without affecting processing already carried out lawfully. For analytics, use the “Cookie settings” link at the bottom of any page.

To exercise a right, email hello@evokewithevoke.com. We may need to confirm your identity before responding. These rights are not absolute, and we will explain if an exception applies.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator. Visit ico.org.uk for information about making a complaint.

Cookies

Cookies are small files that a website stores on your device. We also use local storage, which keeps a small item of data in your browser. We use the following, and nothing else:

• _ga
  • Provider: Google Analytics, set on our own domain (first-party).
  • Purpose: distinguishes visitors so that we can count them.
  • Duration: 2 years.
  • Set only after you accept analytics.
• _ga_EVT692CQBE
  • Provider: Google Analytics, set on our own domain (first-party).
  • Purpose: keeps session state.
  • Duration: 2 years.
  • Set only after you accept analytics.
• evoke-consent
  • Provider: Evoke (our own item in your browser’s local storage).
  • Purpose: remembers whether you accepted or rejected analytics.
  • Duration: 12 months, after which we ask again.
  • Strictly necessary to remember your choice. We save it only when you make a choice.

Your choice. When you first visit, a banner asks whether you accept analytics. Google Analytics is loaded only after you accept. Until then, and if you reject, nothing from Google Analytics is loaded and no analytics cookies are set.

Changing your mind. You can change your choice at any time with the “Cookie settings” link at the bottom of every page. If you withdraw consent, we delete the Google Analytics cookies and stop analytics.

Privacy settings for Google Analytics. We have switched off Google signals and ad personalisation, and we always deny ad-related consent. We do not use analytics for advertising. Google acts as our service provider for analytics (see Who we share information with above).

Other cookies and storage. We set no other cookies and use no other local storage. Fonts, images and videos are served from our own site. Following a social link takes you to a third-party website, which has its own privacy and cookies policies that we encourage you to read. Without JavaScript, neither the banner nor analytics run.

You can also delete cookies and site data, or block cookies, in your browser settings. If you delete the consent record, we will ask for your choice again on your next visit.

If we change how we use cookies or similar technologies, we will update this policy and ask for consent where PECR requires it.

Children

Our enquiry forms are intended for adults acting for themselves or on behalf of an organisation. Children should not use these forms to send us personal information. If you believe a child has submitted personal information, please contact us so we can address it.

Changes to this policy

We may update this policy as the website or our practices change. The date at the top shows when it was last updated. Please check this page for the current version, or email hello@evokewithevoke.com if you have a question.