This Privacy Policy explains what personal information Portfolio to A Star collects, why it is used, who it may be shared with and the choices you have. It applies when you visit portfoliotoastar.co.uk, contact us, buy a portfolio-feedback service or submit work for review.
Last updated: 2 August 2026
Portfolio to A Star privacy policy: The short version
- We collect only the information needed to answer enquiries, process orders and provide portfolio feedback.
- Your artwork is treated as private. It is not published, used as an exemplar, used to train artificial-intelligence systems or sold to anyone.
- Uploaded portfolio files and working copies are deleted within 28 days after your completed feedback is sent.
- Card payments are handled securely by Stripe. We do not receive or store your full card number.
- You can ask what information we hold about you, ask us to correct it or request its deletion where the law allows.
- If you are under 13, a parent or guardian must contact us and make any submission for you.
1. Who is responsible for your information – Portfolio to A Star privacy policy?
Ian Bradbury, trading as Portfolio to A Star, is the data controller for the personal information described in this policy.
Contact: help@portfoliotoastar.co.uk
Location: Swinton, Manchester, United Kingdom
Website: https://portfoliotoastar.co.uk
2. Information we may collect
Depending on how you use the website, we may collect:
- Contact details: your name, email address and any contact details you choose to provide.
- Student and course details: for example, whether the work is GCSE or A Level, the subject, examination board, Assessment Objectives selected and information needed to understand the feedback request.
- Portfolio material: artwork, sketchbook pages, photographs, design work, written annotations and other files submitted for review.
- Order and payment records: the service purchased, price, payment status, billing details and Stripe transaction reference. We do not receive your complete payment-card details.
- Messages: information included in contact forms, emails, feedback requests and follow-up correspondence.
- Technical information: IP address, browser and device information, security logs, cookie choices and basic information about how the site is used.
We normally receive this information directly from you. We may also receive it from a parent, guardian, teacher or another person who purchases or submits work on a student’s behalf, from Stripe when a payment is made, or automatically from the device used to visit the website.
3. Why we use personal information
| Purpose | Information used | Lawful basis |
|---|---|---|
| Answering questions and responding to contact forms | Contact details and messages | Legitimate interests in responding to enquiries and running the service; or steps requested before entering a contract |
| Taking, administering and completing an order | Contact, order, billing and transaction information | Performance of a contract |
| Reviewing a portfolio and producing personalised feedback | Portfolio material, course details and messages | Performance of a contract; where a parent or guardian buys on behalf of a student, legitimate interests in delivering the requested service to that student |
| Keeping financial and tax records | Order, invoice and transaction information | Legal obligation |
| Protecting the website, preventing fraud and resolving technical problems | Technical logs, device information, order data and relevant correspondence | Legitimate interests in keeping the website and customers secure and, where applicable, legal obligation |
| Remembering cookie choices and using optional cookies | Cookie preferences and website-use information | Necessary cookies: legitimate interests or legal obligation; non-essential cookies: consent |
We do not use personal information for unrelated advertising, sell it to data brokers or send marketing emails unless you have made a separate, clear choice to receive them. You may withdraw marketing or optional-cookie consent at any time.
4. Portfolio privacy and sensitive information
Portfolio work may occasionally reveal personal information about the student or people shown in the work. Please remove unnecessary names, school details, candidate numbers, addresses and other identifying information before uploading. Do not send medical information, safeguarding information or other highly sensitive material unless it is genuinely necessary for the review and you have contacted us first.
If photographs or artwork identify another person, you are responsible for making sure you have an appropriate reason and any permission needed to share that material for private educational feedback. We use submitted work only to provide the requested service, deal with related questions and meet legal obligations. It is not published or used as exemplar material without separate, explicit permission.
5. Children and young people
This website is likely to be used by GCSE and A Level students, so children’s privacy is especially important. We aim to collect as little personal information as possible, use it only for the stated purpose and explain our practices in clear language.
- If you are under 18, please involve a parent or guardian when purchasing a service or submitting work.
- If you are under 13, do not purchase a service, complete a contact form or upload work yourself. A parent or guardian must do this for you.
- Parents and guardians may contact us about the handling of a child’s information. Data-protection rights belong to the child, although a parent or guardian may exercise them on the child’s behalf where appropriate.
- We do not knowingly profile children for advertising or make solely automated decisions about them.
6. Payments
The website uses WooCommerce to manage orders and Stripe to process card payments. Payment-card information is entered into Stripe’s secure payment system and is handled under Stripe’s Privacy Policy. Portfolio to A Star receives confirmation of payment and transaction details needed to administer the order, but not your full card number or card security code.
7. Who we share information with
We may share only the information necessary with trusted providers that support the service, including:
- website hosting, storage, backup, security and technical-support providers;
- email and website-form service providers;
- Stripe and other providers involved in processing and reconciling payments;
- accountants, professional advisers, insurers, regulators or public authorities where reasonably necessary or required by law; and
- a buyer or successor if the business is sold or reorganised, subject to appropriate confidentiality and data-protection safeguards.
Service providers are permitted to use personal information only as needed to provide their services or meet their own legal obligations. We do not sell personal information. Student portfolio work is not shared with schools, examination boards, other students or the public unless you specifically ask us to do so and there is a lawful basis.
8. International transfers
Some service providers may process information outside the United Kingdom. Where this involves a restricted international transfer, we rely on a lawful transfer mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses or another safeguard permitted by data-protection law. You may contact us for more information about the safeguards relevant to your information.
9. How long we keep information
| Type of information | Usual retention period |
|---|---|
| Uploaded portfolios, artwork files and review working copies | Deleted within 28 days after the completed feedback is sent |
| Final feedback report and correspondence about a completed review | Up to 12 months after completion, so that we can answer reasonable follow-up questions or resolve a complaint |
| General enquiries that do not become an order | Up to 12 months after the last meaningful contact |
| Orders, invoices and essential transaction records | Normally up to six years, where needed for tax, accounting, contractual or legal purposes |
| Cookie-consent records | Normally up to 12 months before consent is requested again, unless a shorter period applies |
| Security logs and backups | For the limited period reasonably required by the hosting, backup or security process, or longer where needed to investigate an incident or establish legal claims |
We may keep information for longer if required by law, if a dispute is ongoing or if it is needed to establish, exercise or defend legal claims. When information is no longer required, it is deleted or irreversibly anonymised.
10. Cookies
Cookies are small files placed on a device. The website uses necessary cookies for functions such as security, order processing and remembering privacy choices. Optional functional or analytical cookies are used only after consent where consent is required. The CookieAdmin panel shows the cookies currently detected, their purposes and available choices.
You can accept, reject or customise non-essential cookies when the cookie banner appears and can change your choices later using the site’s cookie-preference control. Blocking necessary cookies in your browser may prevent parts of the website from working correctly.
11. Security
We use appropriate technical and organisational measures to protect personal information, including access controls, secure connections, restricted access to submitted portfolios and trusted payment processing. No internet service can guarantee absolute security. If a personal-data breach creates a risk to people, we will assess it and notify the Information Commissioner’s Office and affected individuals where the law requires.
12. Your data-protection rights
Depending on the circumstances, you may have the right to:
- ask for a copy of the personal information we hold about you;
- ask us to correct inaccurate or incomplete information;
- ask us to delete information;
- ask us to restrict how information is used;
- object to processing based on legitimate interests and object at any time to direct marketing;
- receive certain information in a portable format;
- withdraw consent at any time, without affecting processing that was lawful before withdrawal; and
- raise a concern about how your information has been handled.
These rights are not absolute and may depend on the lawful basis and circumstances. To make a request, email help@portfoliotoastar.co.uk. We may need to verify your identity. We normally respond within one month and do not charge a fee unless a request is manifestly unfounded or excessive.
13. Complaints
Please contact us first so that we have an opportunity to address your concern. You also have the right to complain to the Information Commissioner’s Office, the UK’s data-protection regulator:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Make a complaint to the ICO
14. External links
The website may link to examination boards, museums, galleries, educational resources and other external websites. Those organisations control their own websites and personal-information practices. Please read their privacy notices before providing information to them.
15. Changes to this policy
We may update this policy when the website, service providers or legal requirements change. The latest version will appear on this page with a revised “Last updated” date. If a change materially affects how existing personal information is used, we will provide an appropriate additional notice.
16. Contact us: Portfolio to A Star privacy policy
For a privacy question, data-rights request or concern about submitted work, email help@portfoliotoastar.co.uk with “Privacy request” in the subject line.