Privacy Policy

PRIVACY NOTICE

The General Data Protection Regulation (GDPR) came into effect on 25th May 2018. It has been agreed that Jemma Conner will be appointed as Data Protection Officer (DPO) and is therefore responsible for the safe storage of information relating to our students and customers. This Notice will provide information on how we; SO:Dance are complying with this Regulation.

Purpose and Statement:

SO:Dance is committed to ensuring the data processed by our company remains safe and secure. This policy has been written in line with legislative change, including both the Data Protection Act (1998) and the EU’s General Data Protection Regulation (GDPR). SO:Dance has determined the lawful reasons with which it processes personal data:

Legal obligation

Legitimate interest

Contract

There is also some limited data we process with consent from the Data Subject, Consent. While SO:Dance avoids sharing data with third parties at most times, some data is shared in accordance with our business practices. The sharing of data with third parties will always be consensual with the data subject and/or their parent/guardian, and only if SO:Dance is satisfied that their Data Protection policy is GDPR compliant.

Main Aims for the policy:

• Specify the data SO:Dance collect, how it is stored/protected and the reason for collecting it

• State how SO:Dance use personal data in processing

• Disclose who has access to the data and how long we retain information for

• Explain Data Subject’s rights with SO:Dance’s data including access, rectification and erasure

The GDPR includes the following rights for individuals:

• the right to be informed

• the right of access

• the right to rectification

• the right to erasure

• the right to restrict processing

• the right to data portability

• the right to object

• the right not to be subject to automated decision-making including profiling

General Principles

SO:Dance is committed to providing fair and understandable privacy policies in relation to personal data. SO:Dance will, at all times, keep data in secure locations (including, but not limited to, encrypted and access restricted files) and not retain data unnecessarily or past the retention length as set out in this policy. In the rare instance a data processor that is not a SO:Dance employee is used, such as a third party, the data subject will either be asked for consent pre to supplying the data or be notified and have the right to object to processing. SO:Dance customers and participants supply their personal data when signing up for classes through our registration form. This is either completed by the individual (adult), a parent/guardian or the child themselves if they deemed able to do so. Personal data may also come to us unsolicited via enquiries through our website and to our generic email account. To attend any of SO:Dance’s activities participants/parents/guardians must agree to some processing of their personal data. This is due to ensuring safe practice for all. Should SO:Dance be unable to process participant’s data, we would be contravening both our Health & Safety and Child Safeguarding policies. We would also be ignoring best practice regarding working with children/vulnerable adults. Our participants must remain safe at all times, therefore information about participants must be collected in order to create registers and accurate student records. This information is also used to provide students with appropriate classes, including dividing students into age groups where required. Special category data is only collected with the consent of the data subject. Special category data SO:Dance collects includes but is not limited to Medical/Disability. As physical activity providers, it is essential that this consent is given should a participant have any medical/disability needs. This allows us to incorporate participants safely into classes. It is also used in assessing if we can incorporate participants safely into classes. Personal data and some special category is collected. It is essential to our primary function (providing classes to participants) that we are provided, and allowed to process and store the following:

Participant Personal Data:

Full Name

Date of Birth

Home Address

Classes attended/Price paid

Participant Special Category Data:

Medical Information/History

Disability Information

Parent/Guardian Personal Data:

Name

Address

Email Address

Mobile Telephone Number

Work/Home Number

Emergency Contact Number

Parent/Guardian Special Category Data:

Concession Type – further explicate consent sought

Documented proof of financial need – further explicate consent sought

Bank Details – further explicate consent sought in the instance of refunds etc.

SO:Dance transports data with all due diligence. Received enrolment forms are stored on an encrypted email server for no more than 6 months. Registers and emergency contact lists created from student data securely. Access to these files is restricted through password protection and only available to authorised staff members. Our standard retention policy (without the data subject’s right to access, rectification and erasure etc.) is THREE YEARS post final attendance.

Exceptions to our retention policy:

• Financial records are kept for 6 years due to legal obligation

• First Aid records are kept for 21 years due to legal obligation

• Photo consent may be kept indefinitely

• Child Safeguarding records are kept indefinitely on a case-by-case basis, the minimum these will stored for is 6 years due to legal obligation

• Bank details are deleted after the action concerning them is complete

• Enquiries that do not turn into bookings with current classes are deleted after they have been dealt with

• SO:Dance does not actively share data with third parties, however there are certain instances where sharing information is crucial to our business processes.

Child Performance Licensing:

In order to process child performance licences, SO:Dance are legally required to provide some personal data to local councils (including but not limited to: full name, date of birth and school details). This is an optional consent, which will be sought at the time of sending participation consent forms if required for the performance. SO:Dance is satisfied that their GDPR process are thorough and any data will be stored in a secure environment, and not unnecessarily retained.

Child Safeguarding Concerns:

In the unlikely event SO:Dance has a safeguarding concern in relation to one of our participants, SO:Dance are legally required to provide data to the safeguarding board at the local council. SO:Dance is satisfied that their GDPR process are thorough and any data will be stored in a secure environment, and not unnecessarily retained.

Event Programmes:

SO:Dance may occasionally produce programmes for events. These will only ever contain the first name and surname (unless otherwise consented to). The name of a child’s class may also be included. Participants/their Parent and/or Guardians may choose if they want to be included in the programme when they agree to participate at an event.

Examination Entry:

In order to enter examinations, SO:Dance must provide some personal data to examination boards (currently SO:Dance work with: ISTD). This sharing of data is to be consented to by the data subject and/or parent/guardian upon being entered for the exam.

Any data subject with personal data stored within SO:Dance is entitled to the rights of:

Access

You may contact SO:Dance at any time to access all data held relating to you and/or your child(ren). SO:Dance will ensure that we respond to a subject access request without undue delay and within one month of receipt. If the information request will also include data regarding others, SO:Dance has the right to refuse the request or take steps in order to obtain consent from other involved parties. The right of access does not apply to SO:Dance’s legal obligations such as Child Safeguarding records.

Rectification

You may contact SO:Dance at any time in order to rectify data held relating to you and/or your child(ren). SO:Dance will ensure that we respond to a rectification request without undue delay and within one month of receipt. The right to rectification does not apply to SO:Dance’s legal obligations such as payment record information.

Erasure

You may contact SO:Dance at any time in order to erase data held relating to you and/or your child(ren). SO:Dance will ensure that we respond to an erasure request without undue delay and within one month of receipt. The right to erasure does not apply to SO:Dance’s legal obligations such as First Aid records.

Restrict Processing

You may contact SO:Dance at any time in order to restrict the data we process relating to you and/or your child(ren). SO:Dance will ensure that we respond to a request to restrict processing without undue delay and within one month of receipt. However, due to our legitimate interest in most of the data collected- we may have to revoke your membership with SO:Dance until the restriction is lifted. This is due to Health and Safety and Child Safeguarding.

Data Portability

You may contact SO:Dance at any time in order to obtain the data we process relating to you and/or your child(ren) and reuse it across different services. SO:Dance will ensure that we respond to a request to restrict processing without undue delay and within one month of receipt. Please note, this does not apply to SO:Dance’s legal obligations.

Objection

You may contact SO:Dance at any time in order to object to the processing of data relating to you and/or your child(ren). SO:Dance will ensure that we respond to a request to restrict processing without undue delay and within one month of receipt. However, due to our legitimate interest in most of the data collected- we may have to revoke your membership with SO:Dance until the restriction is lifted.

Photographs/Filming

SO:Dance often use footage/photos used from shows, performances, and classes for marketing purposes both in print media and the website. Participants/their Parent and/or Guardians may choose if they do not wish themselves/their child to be depicted. Some attendees at events may film/take photos for their own personal use (e.g. parents of other participants). Participants/their Parent and/or Guardians may choose if they do not wish themselves/their child to be depicted.