Data Protection Policy

Purpose and Statement:

Procter Dance Academy is committed to ensuring the data processed by our school remains safe and secure.

This policy has been written in line with legislative change, including both the Data Protection Act (2018) and the UK’s General Data Protection Regulation (UK-GDPR), which is based upon EU-GDPR.

Procter Dance Academy has determined the lawful reasons with which it processes personal data:

Legal obligation – UK-GDPR Article 6(1)(c)
Legitimate interest – UK-GDPR Article 6(1)(f)
Contract – UK-GDPR Article 6(1)(b)

There is also some special category data we process with consent from the Data Subject; Explicit Consent – UK-GDPR Article 9(a).

While Procter Dance Academy avoids sharing data with third parties at most times, some data is shared in accordance with our business practices. The sharing of data with third parties will always be consensual with the data subject and/or their parent/guardian, and only if Procter Dance Academy is satisfied that their Data Protection policy is UK-GDPR compliant.

Main Aims for the Policy:

Specify the data Procter Dance Academy collects, how it is stored/protected, and the reason for collecting it.
State how Procter Dance Academy uses personal data in processing.
Disclose who has access to the data and how long we retain information for.
Explain Data Subject’s rights with Procter Dance Academy data, including access, rectification, and erasure.

Distribution:

To be sent to all staff, freelance staff, and volunteers.
To be displayed on Procter Dance Academy’s website.
This policy will be sent directly to members of the public on request.
Confirmation of receipt of information – Signed statement from the recipient to be held on file.

Review and Monitoring of Policy:

Reviewed annually or in instances of legislative change.
Monitoring is part of Management and Supervision.

The following policy is based on the below principles:

The UK-GDPR includes the following rights for individuals:

The right to be informed.
The right of access.
The right to rectification.
The right to erasure.
The right to restrict processing.
The right to data portability.
The right to object.
The right not to be subject to automated decision-making including profiling.

General Principles

Procter Dance Academy is committed to providing fair and understandable privacy policies in relation to personal data.

Procter Dance Academy will always keep data in secure locations (including, but not limited to, encrypted and access restricted files) and not retain data unnecessarily or past the retention length as set out in this policy.

In the rare instance a data processor is used that is not a staff member of Procter Dance Academy, such as a third party, the data subject will either be asked for consent prior to supplying the data or be notified and have the right to object to processing.

Participants and Customers

How Procter Dance Academy Collects Personal Data:

Procter Dance Academy’s customers supply their personal data when signing up for classes through our registration form via class manager. This is either completed by a parent/guardian or the child themselves if they are deemed able to do so. Personal data may also come to us unsolicited via enquiries through our website and to our generic email account.

Why Procter Dance Academy Collects Personal Data:

To attend any of Procter Dance Academy’s activities, participants/parents/guardians must agree to some processing of their personal data.

Should Procter Dance Academy be unable to process participant’s data, we would be contravening both our Health & Safety and Child Safeguarding policies. We would also be ignoring best practice regarding working with children/vulnerable adults.

Our pupils must always remain safe; therefore, information about pupils must be collected to create registers and accurate student records. This information is also used to provide students with appropriate classes, including dividing students into age groups.

Special category data is only collected with the consent of the data subject. Special category data Procter Dance Academy collects includes but is not limited to: Medical/Disability information, Income information, Ethnicity, Gender.

As physical activity providers, it is essential that this consent is given should a participant have any medical/disability needs. This allows us to incorporate participants safely into classes. It is also used in assessing if we can incorporate participants safely into classes.

What Data We Collect:

Personal data and some special categories are collected. It is essential to our primary function (providing classes to students) that we are provided, and allowed to process and store the following:

Participant Personal Data:
- Full Name.
- Date of Birth.
- Home Address.
- Gender.
- Permission to go home alone.
- School/Educational Institution.
- Exam results.
- Classes attended/Price paid.
Participant Special Category Data:
- Medical Information/History.
- Disability Information.
- Gender.
Parent/Guardian Personal Data:
- Name.
- Address.
- Email Address.
- Mobile Telephone.
- Work/Home Number.
- Emergency Contact Number.
Parent/Guardian Special Category Data:
- Bank Details – further explicit consent sought in the instance of refunds etc.

When you enter Chesterfield High School, there is CCTV for security monitoring purposes.

How Data Collected is Sent Internally:

Procter Dance Academy transports data with all due diligence.

Enrolment forms are sent to Procter Dance Academy through class manager. See ‘Third Parties/Data Processors’ - class manager.

Storage/Retention of Data:

Data received through enrolment forms is uploaded manually into our database software. Our database is stored both in encrypted files on office-based hardware and backed up regularly in our encrypted cloud-based server. Access to these files is restricted through password protection and only available to authorised staff members.

Registers and emergency contact lists created from student data are stored in encrypted files on office-based hardware and backed up regularly in our encrypted cloud-based server. Access to these files is restricted through password protection and only available to authorised staff members.

Hard copies of registers and emergency contacts may be carried by authorised staff members. They are locked away while not in use. When they are no longer in use or outdated, they are destroyed thoroughly.

Waiting lists are stored on an encrypted cloud-based server.

Our standard retention policy (without the data subject’s right to access, rectification and erasure etc.) is as soon as a student leaves Procter Dance Academy, their details are deleted.

Exceptions to our retention policy:

Financial records are kept for 6 years due to legal obligation.
First Aid records are kept for 7 years due to legal obligation.
Photo consent may be kept indefinitely.
Child Safeguarding records are kept indefinitely on a case-by-case basis, the minimum these will be stored for is 6 years due to legal obligation.
Bank details are deleted after the action concerning them is complete.
Unsolicited enquiries that do not turn into bookings with current classes are deleted after they have been dealt with.

Third Parties/Data Processors:

Procter Dance Academy does not actively share data with third parties, however, there are certain instances where sharing information is crucial to our business processes.

Freelance Teachers:

As many of Procter Dance Academy’s teachers are freelance staff, we have confidentiality and data processor agreements in place. Teachers will never be provided with personal details aside from participant’s first names and any medical information that is pertinent to the running of a class (subject to consent from the data subject).

Class Manager:

As part of our operations, we utilize Class Manager, a leading class management software, and it's crucial for you to understand how your data is handled. Class Manager processes your data solely for the purpose of facilitating an efficient and effective class management system. While your data is collected and processed through Class Manager, the software does not use it for its own purposes, nor does it share your data with any third parties.

As the data controller, we determine the purpose and means of processing your personal data. Class Manager acts strictly as the data processor, adhering to our instructions and always maintaining the confidentiality and security of your data.

We want to assure you that your data remains private and is only used to enhance the services you receive from us. Class Manager has implemented robust technical and organizational measures to ensure the integrity and security of your data.

MailChimp:

Procter Dance Academy may use a USA-based company ‘MailChimp’ to provide newsletters and marketing via email. This is an optional process, which people consent to during enrolment or sign-up directly through our website. Data Subjects can opt-out and erase/rectify their record stored with MailChimp at any time. Procter Dance Academy is satisfied that their UK-GDPR regulations are thorough, and the information stored in MailChimp is secure.

Child Performance Licensing:

To process child performance licences, Procter Dance Academy is legally required to provide some personal data to local councils (including but not limited to full name, date of birth, and school details). This is an optional consent, which will be sought at the time of sending participation consent forms. Procter Dance Academy is satisfied that their UK-GDPR process is thorough, and any data will be stored in a secure environment and not unnecessarily retained.

Child Safeguarding Concerns:

In the unlikely event Procter Dance Academy has a safeguarding concern in relation to one of our participants, Procter Dance Academy is legally required to provide data to the safeguarding board at the local council. Procter Dance Academy is satisfied that their UK-GDPR process is thorough, and any data will be stored in a secure environment and not unnecessarily retained.

Event Programmes:

Procter Dance Academy may occasionally produce programmes for events. These may contain the first name and initial of the last name; a photograph may also be used (unless otherwise consented to). The name of a child’s class may also be included. Participants/their Parent and/or Guardians may choose if they want to be included in the programme when they agree to participate at an event.

Examination Entry:

To enter for examinations, Procter Dance Academy must provide some personal data to examination boards (currently Procter Dance Academy works with RAD and ISTD). This sharing of data is to be consented to by the data subject and/or parent/guardian upon being entered for the exam.

Rights of the Data Subject and Procter Dance Academy’s Compliance with Responses:

Any data subject with personal data stored within Procter Dance Academy is entitled to the rights of:

Access:

You may contact Procter Dance Academy at any time to access all data held relating to you and/or your child(ren). Procter Dance Academy will ensure that we respond to a subject access request without undue delay and within one month of receipt. If the information request will also include data regarding others, Procter Dance Academy has the right to refuse the request or take steps to obtain consent from other involved parties. The right of access does not apply to Procter Dance Academy’s legal obligations such as Child Safeguarding records.

Rectification:

You may contact Procter Dance Academy at any time to rectify data held relating to you and/or your child(ren). Procter Dance Academy will ensure that we respond to a rectification request without undue delay and within one month of receipt. The right to rectification does not apply to Procter Dance Academy’s legal obligations such as payment record information.

Erasure:

You may contact Procter Dance Academy at any time to erase data held relating to you and/or your child(ren). Procter Dance Academy will ensure that we respond to an erasure request without undue delay and within one month of receipt. The right to erasure does not apply to Procter Dance Academy’s legal obligations such as First Aid records.

Restrict Processing:

You may contact Procter Dance Academy at any time to restrict the data we process relating to you and/or your child(ren). Procter Dance Academy will ensure that we respond to a request to restrict processing without undue delay and within one month of receipt. However, due to our legitimate interest in most of the data collected, we may have to revoke your membership with Procter Dance Academy until the restriction is lifted. This is due to Health and Safety and Child Safeguarding.

Data Portability:

You may contact Procter Dance Academy at any time to obtain the data we process relating to you and/or your child(ren) and reuse it across different services. Procter Dance Academy will ensure that we respond to a request to restrict processing without undue delay and within one month of receipt. Please note, this does not apply to Procter Dance Academy’s legal obligations.

Objection:

You may contact Procter Dance Academy at any time to object to the processing of data relating to you and/or your child(ren). Procter Dance Academy will ensure that we respond to a request to restrict processing without undue delay and within one month of receipt. However, due to our legitimate interest in most of the data collected, we may have to revoke your membership with Procter Dance Academy until the restriction is lifted. This is due to Health and Safety and Child Safeguarding.

Rights Related to Automated Decision-Making Including Profiling:

You may contact Procter Dance Academy at any time to object to profiling relating to you and/or your child(ren). Procter Dance Academy will ensure that we respond to a request to restrict processing without undue delay and within one month of receipt. However, due to our legitimate interest in most of the data collected, we may have to revoke your membership with Procter Dance Academy until the profiling restriction is lifted. This is due to Health and Safety and Child Safeguarding. Procter Dance Academy has a lawful reason for profiling; Legitimate Interests and consent. None of Procter Dance Academy’s decision-making is automated. Profiling is only used in circumstances where a participant may have certain health/disability needs which may prevent them from taking part in classes (as it would be unsafe to do so).

All verbal requests are noted, and then contacted again either via phone or email to verify the request. Verbal requests will be responded to in the time frames mentioned above.

Photos/Videos of Participants

Procter Dance Academy often use footage/photos from shows, performances, and classes for marketing purposes both in print media and on the website. Participants/their Parent and/or Guardians may choose if they do not wish themselves/their child to be depicted.

Some attendees at events may film/take photos for their own personal use (e.g., parents of other participants). Participants/their Parent and/or Guardians may choose if they do not wish themselves/their child to be depicted.

Social Media:

Procter Dance Academy regularly shares photos/videos of students in workshops, events, and performances through social media platforms including Instagram, Facebook, Twitter, and Email. These will never be shared with any identifying information. There may be times where we will share first names, but only with the explicit consent of the parents. Participants/their Parent and/or Guardians may choose if they do not wish themselves/their child to be depicted.