Privacy Policy
Privacy Policy 2018 – Participants
The General Data Protection Regulation (GDPR) came into effect on 25th May 2018.
This Notice will provide information on how we, Rhythmix Dance Studio are complying with this Regulation.
Purpose and Statement:
Rhythmix Dance Studio is committed to ensuring the data processed by ourselves remains safe and secure.
We will not sell, rent or trade your personal information to any third party. We will take special care to protect the privacy and security of your information.
This policy has been written in line with legislative change, including both the Data Protection Act (1998) and the EU’s General Data Protection Regulation (GDPR).
Rhythmix Dance Studio has determined the lawful reasons with which it processes personal data:
Legal obligation – GDPR Article 6(1)(c)
Legitimate interest – GDPR Article 6(1)(f)
Contract – GDPR Article 6(1)(b)
There is also some limited data we process with consent from the Data Subject; Consent – GDPR Article 6(1)(a).
While Rhythmix Dance Studio avoids sharing data with third parties at most times, some data is shared in accordance with our business practices. The sharing of data with third parties will always be consensual with the data subject and/or their parent/guardian, and only if Rhythmix Dance Studio is satisfied that their Data Protection policy is GDPR compliant.
Main Aims for the policy:
Specify the data Rhythmix Dance Studio collect, how it is stored/protected and the reason for collecting it
State how Rhythmix Dance Studio use personal data in processing
Disclose who has access to the data and how long we retain information for
Explain Data Subject’s rights with Rhythmix Dance Studio data including access, rectification and erasure
General Principals
The GDPR includes the following rights for individuals:
the right to be informed
the right of access
the right to rectification
the right to erasure
the right to restrict processing
the right to data portability
the right to object
the right not to be subject to automated decision-making including profiling
Rhythmix Dance Studio is committed to providing fair and understandable privacy policies in relation to personal data.
Rhythmix Dance Studio will, at all times, keep data in secure locations (including, but not limited to, encrypted and access restricted files) and not retain data unnecessarily or past the retention length as set out in this policy.
How Rhythmix Dance Studio Collects Personal Data
Rhythmix Dance Studios customers and participants supply their personal data when signing up for classes through our contact us form either via the website, or via our registration paper form.
This is either completed by a parent/guardian.
Personal data may also come to us unsolicited via enquiries through our website, facebook, Instagram, twitter and to our generic email account or mobile phone number.
By using Rhythmix Dance Studios website, mobile applications or otherwise providing your personal information to Rhytmix Dance Studio, you agree to the collection use and sharing of your information in accordance with this statement.
Why Rhythmix Dance Studio Collects Personal Data
To attend any of Rhythmix Dance Studios classes / workshops - participants/parents/guardians must agree to some processing of their personal data. This is due to Legitimate Interests – GDPR Article 6(1)(f), Legal Obligation GDPR Article 6(1)(c), Contract – Article 6(1)(b) and/or Consent – Article 6(1)(a).
Should Rhythmix Dance Studio be unable to process participant’s data, we would be contravening both our Health & Safety and Child Safeguarding policies. We would also be ignoring best practice regarding working with children/vulnerable adults.
Our participants must remain safe at all times, therefore information about participants must be collected in order to create registers and accurate student records. This information is also used to provide students with appropriate classes, including dividing students into appropriate age groups.
Special category data is only collected with the consent of the data subject. Special category data Rhythmix Dance Studio collects includes but is not limited to: Medical/Disability information, date of birth, Gender, address, telephone number, email address.
As physical activity providers it is essential that this consent is given should a participant have any medical/disability needs. This allows us to incorporate participants safely into classes. It is also used in assessing if we can incorporate participants safely into classes.
Rhythmix Dance studio are legally obliged to provide some personal data to the NHS Test and Trace service due to the corona virus pandemic.
What data Rhythmix Dance Studio collects
Personal data and some special category is collected.
It is essential to our primary function (providing classes to participants) that we are provided, and allowed to process and store the following:
Participant Personal Data:
Full Name – GDPR Article 6(1)(f)
Date of Birth – GDPR Article 6(1)(f)
Home Address – GDPR Article 6(1)(f)
Sex – GDPR Article 6(1)(f)
Permission to go home alone – GDPR Article 6(1)(f)
School/Educational Institution – GDPR Article 6(1)(f)
Exam results (vocational exams taken through MTA only) – GDPR Article 6(1)(f)
Classes attended/Price paid – GDPR Article 6(1)(f)
Participant Special Category Data:
Medical Information/History – GDPR Article 9 (a)
Disability Information – GDPR Article 9 (a)
Gender/Sex – GDPR Article 9 (a & j) – further explicate consent sought
Parent/Guardian Personal Data:
Name – GDPR Article 6(1)(f)
Address – GDPR Article 6(1)(f)
Email Address – GDPR Article 6(1)(f)
Mobile Telephone Number – GDPR Article 6(1)(f)
Work/Home Number – GDPR Article 6(1)(f)
Emergency Contact Number – GDPR Article 6(1)(f)
How data is collected and used between principals
Rhythmix Dance Studio transports data with all due diligence.
Enquiries are sent to Rhythmix Dance Studio through an encrypted email server directly from our website which has controlled access. Received enquiries are stored on an encrypted email server for no more than 6 months. Received paper enrolment forms are stored until a student leaves.
Storage and Retention of Data
Data received through enrolment forms is uploaded manually into our database software. Our database is stored both in encrypted files on office-based hardware and backed up regularly in our encrypted cloud-based server. Access to these files is restricted through password protection and only available to the principals.
Registers and emergency contact lists created from student data are stored in encrypted files on office-based hardware and backed up regularly in our encrypted cloud-based server. Access to these files is restricted through password protection and only available to the principals.
Hard copies of registers and emergency contacts are carried by authorised staff members. They are locked away while not in use. When they are no longer in use or out-dated, they are destroyed thoroughly.
Waiting lists are stored on an encrypted cloud-based server.
Our standard retention policy (without the data subject’s right to access, rectification and erasure etc.) is THREE YEARS post final attendance.
Exceptions to our retention policy:
First Aid records are kept for 21 years due to legal obligation
Child Safeguarding records are kept indefinitely on a case-by-case basis, the minimum these will stored for is 6 years due to legal obligation
Enquiries that do not turn into bookings with current classes are deleted after they have been dealt with.
Links to other websites
Our website will link to other websites and services from time to time. Rhythmix Dance Studio will always attempt to associate with only the most trustworthy partners who share our high standards regarding privacy. However we are not responsible for the content of and privacy practices of any other companies or websites.
Cookies & Tracking Technologies
Cookies are text only pieces of data that a website transfers an individuals hard drive or other website browsing equipment for recording purposes. Cookies allow the site to remember important information that will make your use of the site more convenient. This site uses cookies.
Third Party Data Processors
Rhythmix Dance Studio does not actively share data with third parties, however there are certain instances where sharing information is crucial to our business processes.
Freelance Teachers / Teachers for Workshops:
We have confidentiality and data processor agreements in place that we provide to our Freelance teachers / teachers attending our workshops. Teachers will never be provided with personal details aside from participant’s first names and any medical information that is pertinent to the running of a class / workshop (subject to consent from the data subject)
Child Performance Licensing:
In order to process child performance licences, Rhythmix Dance Studio are legally required to provide some personal data to local councils (including but not limited to: full name, date of birth and school details). This is an optional consent, which will be sought at the time of sending participation consent forms.
Rhythmix Dance Studio is satisfied that their GDPR process is thorough and any data will be stored in a secure environment, and not unnecessarily retained.
Child Safeguarding Concerns:
In the unlikely event Rhythmix Dance Studio has a safeguarding concern in relation to one of our participants, Rhythmix Dance Studio are legally required to provide data to the safeguarding board at the local council.
Rhythmix Dance Studio is satisfied that their GDPR process is thorough and any data will be stored in a secure environment, and not unnecessarily retained.
Event Programmes:
Rhythmix Dance Studio may occasionally produce programmes for events. These will only ever contain the first name and first initial of a child’s last name (unless otherwise consented to). The name of a child’s class may also be included. Participants/their Parent and/or Guardians may choose if they want to be included in the programme when they agree to participate at an event.
Examination Entry:
In order to enter examinations, Rhythmix Dance Studio must provide some personal data to our examination board (currently Rhythmix Dance Studio work with: IDTA – International Dance Teachers Association). This sharing of data is to be consented to by the data subject and/or parent/guardian upon being entered for the exam.
NHs Test and Trace service:
Due to the current Corona Virus outbreak, Rhythmix Dance Studio is legally obliged to provide the NHS Test and Trace service with some personal data in the event of an identified poisitive corona virus case. The NHS Test and Trace Service helps trace close recent contacts of anyone who tests positive for corona virus and, if necessary, notifies them that they must self -isolate at home.
Rights of the data subject and Rhythmix Dance Studio compliance with responces
Any data subject with personal data stored within Rhythmix Dance Studio is entitled to the rights of:
Access
You may contact Rhythmix Dance Studio at any time to access all data held relating to you and/or your child(ren). Rhythmix Dance Studio will ensure that we respond to a subject access request without undue delay and within one month of receipt. If the information request will also include data regarding others, Rhythmix Dance Studio has the right to refuse the request or take steps in order to obtain consent from other involved parties.
The right of access does not apply to Rhythmix Dance Studios legal obligations such as Child Safeguarding records.
Rectification
You may contact Rhythmix Dance Studio at any time in order to rectify data held relating to you and/or your child(ren). Rhythmix Dance Studio will ensure that we respond to a rectification request without undue delay and within one month of receipt.
The right to rectification does not apply to Rhythmix Dance Studios legal obligations such as payment record information.
Erasure
You may contact Rhythmix Dance Studio at any time in order to erase data held relating to you and/or your child(ren). Rhythmix Dance Studio will ensure that we respond to an erasure request without undue delay and within one month of receipt.
The right to erasure does not apply to Rhythmix Dance Studios legal obligations such as First Aid records & photo consent used in advertising leaflets and or social media.
Restrict Processing
You may contact Rhythmix Dance Studio at any time in order to restrict the data we process relating to you and/or your child(ren). Rhythmix Dance Studio will ensure that we respond to a request to restrict processing without undue delay and within one month of receipt.
However, due to our legitimate interest in most of the data collected- we may have to revoke your membership with Rhythmix Dance Studio until the restriction is lifted. This is due to Health and Safety and Child Safeguarding.
Data Portability
You may contact Rhythmix Dance Studio at any time in order to obtain the data we process relating to you and/or your child(ren) and reuse it across different services. Rhythmix Dance Studio will ensure that we respond to a request to restrict processing without undue delay and within one month of receipt.
Please note, this does not apply to Rhythmix Dance Studios legal obligations.
Objection
You may contact Rhythmix Dance Studio at any time in order to object to the processing of data relating to you and/or your child(ren). Rhythmix Dance Studio will ensure that we respond to a request to restrict processing without undue delay and within one month of receipt.
However, due to our legitimate interest in most of the data collected- we may have to revoke your membership with Rhythmix Dance Studio until the restriction is lifted. This is due to Health and Safety and Child Safeguarding.
Any and all verbal requests are noted, and then contacted again either via phone or email to verify the request. Verbal requests will be responded to in the time frames mentioned above.
Photos / Videos of participants
Rhythmix Dance Studio often use footage/photos used from shows, performances and classes for marketing purposes both in print media, social media and the website. Participants/their Parent and/or Guardians may choose if they do not wish themselves/their child to be depicted.
Some attendees at events may film/take photos for their own personal use (e.g. parents of other participants). Participants/their Parent and/or Guardians may choose if they do not wish themselves/their child to be depicted.
Social Media:
Rhythmix Dance Studio regularly share photos/videos of students in workshops, events and performances through social media platforms including; Instagram, Facebook, Twitter, Email. These will never be shared with any identifying information (age, location etc.). There may be times where we will share first names, but only with the explicit consent of the parents.
Training and Data Protection in practice
All members of staff (Freelance and Voluntary) must agree to this Data Protection policy prior to accepting a contract of employment.
Training is supplied as part of management and supervision. It is also included in all induction and training periods.
Rhythmix Dance Studio is registered as a Data Controller with the Independent Commissioners Office (ICO). The registered Data Protection Officers (DPO) are The Principals of the school - Jessica Charity & Hayley Stanley
Who can be contacted via the following email address – Rhythmixdancestudio@outlook.com
There is no guarantee that any email you send will be received by us or that the confidentiality or that email will be maintained during internet transmission.
Complaints & Data Breeches:
Complaints in regard to the handling of any personal data can be made directly to Rhythmix Dance Studio principals – Jessica Charity & Hayley Stanley
Email: Rhythmixdancestudio@outlook.com
Telephone: 07725908390
If you feel that your complaint was not handled in the correct manner, or still have concerns, you may escalate the complaint by contacting the Independent Commissioner’s Office (ICO).
ICO Telephone Number: 0303 123 1113
Data Breeches:
If Rhythmix Dance Studio experiences a data breech of any kind, we have a legal obligation to report this to ICO within 72 hours. The data breech will be reported by the DPO. In the instance they are unavailable to report the breech, the next most senior staff member shall do so.
Rhythmix Dance Studio will also inform all the victims of the data breech as soon as possible if there is a high risk of adversely affecting individuals’ rights and freedoms.
Rhythmix Dance Studio will store and record all data breeches.ts & Data Breeches
This Privacy Policy was updated August 2020
Copyright – Rhythmix Dance Studio May 2018