GDPR. Three letters that make most small business owners either panic or immediately change the subject. The reality is that for a pottery studio collecting customer names, email addresses, and photos of their work, the rules are straightforward — and the cost of ignoring them is much higher than the effort of getting them right. Here's what you actually need to know.
This isn't legal advice — if you have specific concerns, speak to a solicitor. But for the vast majority of independent pottery studios and craft shops, this guide covers everything you need to do in practice.
Do You Actually Need to Worry About GDPR?
Yes — if you collect, store, or use any personal data about individuals based in the UK or EU, GDPR (or its UK equivalent, UK GDPR) applies to you. For a pottery studio, that includes:
- 📝Customer names, phone numbers, and email addresses collected at drop-off
- 📸Photos of customers' items (particularly if photos show identifying features or faces)
- 📧Any email list you use for marketing — even just a spreadsheet of past customers
- 💳Payment records linking a customer to a transaction
The good news: the rules are designed to be proportionate. A small studio handling a few hundred customer records a year faces very different obligations than a multinational processing millions. The core principles are common sense, and most studios can get compliant with a few simple changes.
The Six Things GDPR Actually Requires
Rather than read through hundreds of pages of regulation, focus on these six principles. If you can honestly say yes to each one, you're in good shape.
- 1️⃣You have a lawful reason to collect data. For a pottery studio, this is usually “legitimate interest” (you need contact details to tell someone their pieces are ready) or “consent” (they agreed to receive your marketing emails). You need to know which applies to each type of data you hold.
- 2️⃣You're transparent about what you collect and why. A brief privacy notice — on your customer form, your website, or both — covers this. It doesn't need to be long; it just needs to exist.
- 3️⃣You only collect what you actually need. You need a name and contact details. You probably don't need a date of birth or a home address for a pottery collection. Only ask for what's genuinely necessary.
- 4️⃣You keep data accurate and up to date. Old records for customers who visited once three years ago and will never return are a liability, not an asset. Have a process for removing or archiving stale data.
- 5️⃣You don't keep data longer than necessary. There's no magic number, but “we keep active customer records for 12 months after last activity” is a reasonable policy for most studios.
- 6️⃣You keep data secure. Passwords on accounts, no sharing login details, no spreadsheets sent over personal WhatsApp. Basic digital hygiene covers most of this.
The Marketing Email Question — This Is Where Most Studios Go Wrong
This is the area where small studios most often find themselves on the wrong side of the rules — usually without realising it. Sending a marketing email to a list of past customers is only lawful under GDPR if those customers have explicitly opted in to receive marketing from you.
Common mistake: a studio collects email addresses from drop-off slips over three years, builds up a spreadsheet, and starts sending a newsletter. The customers gave their email so they could be notified when their pots were ready — not to receive marketing. Sending them a promotional email without their consent is a breach, even if it feels harmless.
The fix is simple: ask at the point of drop-off. A checkbox — “I'd like to hear about upcoming sessions and events” — with an unticked default gives you valid consent. Customers who tick it are genuinely interested; customers who don't get their collection notification and nothing more.
For small studios, the risk of an ICO fine is low. But customer trust is not — and a customer who feels spammed is unlikely to come back or recommend you.
What About Customer Photos?
Photos of pottery items are generally fine — a photo of a mug isn't personal data. Where it gets more sensitive is if photos incidentally capture faces or other identifying information. The safest practice:
- 📷Only store photos that are necessary for identifying or managing the customer's items
- 🗑️Delete or archive photos once a customer has collected and the record is no longer needed
- 🔒Store photos securely — in a proper system, not a shared Google Drive folder with no access controls
The Four Things to Do This Week
If you want to get your studio to a reasonable level of GDPR compliance quickly, focus on these four actions:
- ✅Add a privacy notice to your customer drop-off form. Two sentences is enough: what you collect, why you collect it, and how long you keep it. Link to a fuller privacy policy on your website if you have one.
- ✅Add a clear marketing opt-in checkbox. Unticked by default. Only customers who tick it go on your marketing list. Record the date of consent.
- ✅Audit your existing customer data. If you have a spreadsheet of old customer emails without a record of consent, you can't legally market to them. Archive or delete data older than 12 months of inactivity.
- ✅Make sure you can honour a Subject Access Request. Any customer can ask what data you hold about them. You need to be able to find and share it within 30 days. If your records are in a system rather than a spreadsheet, this is easy.
The Silver Lining: GDPR Done Right Builds Customer Trust
Studios that handle data properly — transparent, consented, secure — tend to have better customer relationships than those who don't. A customer who opted in to your marketing because you asked clearly and honestly is more engaged than one who ended up on a list they don't remember joining.
The customer drop-off moment is genuinely the best time to ask. They're engaged, they're positive, and they're interacting with your brand. A well-designed drop-off form that captures consent properly turns a compliance obligation into a marketing opportunity.
CollectIt handles consent capture automatically.
Every customer drop-off form includes a clear, unticked marketing opt-in. Consent is recorded with a timestamp. Your marketing list only includes customers who genuinely want to hear from you — and you can email them directly from your dashboard.
See How It Works →This post is for general guidance only and does not constitute legal advice. For specific concerns about your studio's data practices, consult a qualified solicitor or the ICO's guidance at ico.org.uk.