Data Protection GDPR

Sarah Jane Dance Academy Ormskirk is committed to keeping all the information from our participants and their child(ren) safe.

We are creating a safe environment for all our customers and free-lance teachers.

 

This policy relates to the use of any personal data provided to us by yourselves, either online, in person or by registration forms, emails, phone calls or letters.

We will always use this information in line with current legislation.

 

Data Protection Principles (How this data is used)

 

·         Used fairly and lawfully

·         Used for limited, specifically stated purposes

·         Used in a way that is adequate, relevant and not excessive

·         Accurate

·         Kept for no longer than necessary

·         Kept safe and secure

·         Not transferred outside the European economic area without adequate protection.

 

 

The GDPR includes the following rights for individuals (your rights as a customer/participant in class)

·         The right to be informed

·         The right of access

·         The right of rectification

·         The right to erasure

·         The right to restrict processing

·         The right to data portability

·         The right to object

·         The right not to be subject to automated decision-making including profiling

 

Purpose and statement

Sarah Jane Dance academy Ormskirk (SJDA) is committed to ensuring the data processed remains safe and secure.

This policy has been written in line with legislative change, including both the Data Protection Act (1998) and the EU’s General data protection Regulation (GDPR) 2018.

 

 

SJDA has determined the lawful reasons with which it processes personal data:

·         Legal obligation – GDPR Article 6(1)(C)

·         Legitimate interest-GDPR Article6(1)(F)

·         Contract – GDPR Article 6(1)(b)

There is also some limited data we process with consent from the Data subject; Consent-GDPR Article6(1)(a).

While SJDA avoids sharing data with third parties at most times, some data is shared in accordance with our business practices. The sharing of data with third parties will also be consensual with the data subject and/or their parent/guardian, and only when SJDA is satisfied that their Data Protection Policy is GDPR compliant.

 

From time to time we have to share your information with third parties such as the IDTA for exam sessions or the local council for child performance licences for shows, but we will always ask your consent before doing so either verbally or by you filling in a form.

 

Main Aims for the policy

-Specify the data SJDA collect, how it is stored/protected and the reason for collecting it

-State how SJDA use personal data in processing

-Disclose who has access to the data and how long we retain information for

-Explain data subject’s rights with SJDA data including access, rectification and erasure.

 

Distribution:

To be displayed on SJDA website

This policy will be sent directly to members of the public on request

 

 

Review and monitoring of policy

·         Reviewed annually or in instances of legislative change

·         Monitoring is part of management and supervision

 

The GDPR includes the following rights for individuals:

·         The right to be informed

·         The right of access

·         The right of rectification

·         The right to erasure

·         The right to restrict processing

·         The right to data portability

·         The right to object

·         The right not to be subject to automated decision-making including profiling

 

General Principles

 

SJDA is committed to providing fair and understandable privacy policies in relation to personal data.

SJDA will, at all times, keep data in secure locations (including Dance Biz which is a compliant platform) and not retain data unnecessarily or past the retention length as set out in this policy.

 

 

Participants and Customers  

How SJDA collect personal Data

SJDA customers and participants supply their personal data when signing up for classes through our registration forms either via the website, e-mail or via paper form.

This is either completed by a parent/guardian or the child themselves if they are deemed able to do so.

 

Why SJDA collect personal Data

To attend any of SJDA dance classes participants/parents/guardians must agree to some processing of their personal data. This is due to legitimate interest.

 

Should SJDA be unable to process participants data, we would be contravening both our Health & Safety and Child Safeguarding Policies. We would also be ignoring best practice regarding working with children/vulnerable adults.

Our participants must remain safe at all times, therefore information about participants must be collected in order to create registers and accurate student records. This information is also used to provide students with appropriate classes, including dividing students into age groups.

Special category data is only collected with the consent of the data subject, special category data SJDA collects includes but is not limited to Medical/Disability information.

As physical activity providers it is essential that this consent is given should a participant have any medical/disability needs. This allows us to incorporate participants safely into classes.

 

 

What Data we collect

 

Personal Data and Medical info is collected, it is essential to our primary function (providing classes to participants) that we are provided and allowed to process and store the following participant personal data;

 

·         Full Name

·         Date of Birth

·         Home Address

·         Sex

·         permission to go home alone

·         School/Education institution

·         Exam results (IDTA exams taken through SJDA only)

·         Classes attended/price paid

Participants special category Data :

·         Medical information/history

·         Disability information

 

Parent/Guardian personal data:

·         Name

·         Address

·         email address

·         Mobile telephone number

·         Work/home number

·         Emergency contact number

 

Parent/Guardian special category data:

·         bank details – further consent sought in the instance of refunds etc.

 

How Data collected is sent internally

SJDA transports data with all due diligence. Received enrolment forms are stored on dance biz, Received paper enrolment forms are destroyed after no more than 4 weeks and the data transferred to Dance Biz.

 

Storage/retention of data

Data received through email or enrolment forms is uploaded manually into our database software (dance Biz)

Access to Dance Biz is restricted through password protection and only available to authorised staff members.

Registers and emergency contact lists created from student data are also stored on dance biz.

Our standard retention policy (without the data subject’s right to access, rectification and erasure is the term after the participant is no longer active in class.)

Exceptions to our retention policy;

-Financial records are kept for 6 years due to legal obligation

-First Aid Records are kept for 21 years due to legal obligation

-Child safeguarding records are kept indefinitely on a case by case basis, the minimum this will stored for is 6 years due to legal obligation.

-Bank details are deleted after the action concerning them is complete

 

Third Parties/Data Processors

SJDA does not actively share data with third parties that are not involved in the core operation of this dance business. The third parties we share information with are detailed below:

 

Freelance Teachers

As many SJDA dance teachers are Freelance staff, we have confidentiality and data processor agreements in place. Teachers will be provided with personal details which include participants names, D.O.B, email address, telephone number and any medical information that is pertinent to the running of a class.

 

Child Performance Licencing

In order to process child performance licences, SJDA are legally required to provide some personal data to local councils (including but not limited to: Full Name, DOB and school details). This is an optional consent which will be sought at the time of sending participation consent forms.

SJDA is satisfied that their GDPR processes are thorough and any data will be stored in a secure environment, and not unnecessarily retained. For more information see your local council website.

 

Child Safeguarding Concerns

In the unlikely event SJDA has a Safeguarding concern in relation to one of our participants SJDA are legally required to provide data to the safeguarding board at the local council.

SJDA is satisfied that their GDPR processes are thorough and any data will be stored in a secure environment, and not unnecessarily retained.

 

Event Programmes

SJDA may occasionally produce programmes for events. These will only ever contain the first name and first initial of a child’s last name (unless otherwise consented to) the name of a child’s class may also be included. Participants/their parent/or guardian may choose if they would like to be included in the programme when they agree to participate at an event.

 

Examination Entry

In order to enter examinations, SJDA must provide some personal data to examination boards (currently SJDA work with the IDTA International Dance Teachers Association). This sharing of data is to be consented to by the data subject and/or parent/guardian upon being entered into the exam.

 

Rights of the data subject and SJDA compliance with responses

Any data subject with personal data stored within SJDA is entitled to the rights of:

 

-Access – You may contact SJDA at any time to access all data held relating to you and/or your child(ren). SJDA will ensure that we respond to a subject access request with out undue delay and within one month of receipt. If the information request will also include data regarding others, SJDA has the right to refuse the request or take steps in order to obtain consent from other involved parties.

The right of access does not apply to SJDA legal obligations such as child safeguarding records.

-Rectification – you may contact SJDA at any time in order to rectify data held relating to you and/ or your child(ren). SJDA will ensure that we respond to a rectification request without undue delay and within one month of receipt. The right to rectification does not apply to SJDA legal obligations such as payment record information.

 

-Erasure- you may contact SJDA at any time in order to erase data held relating to you and/or your child(ren). SJDA will ensure that we respond to an erasure  request without undue delay and within one month of receipt.

The right to erasure does not apply to SJDA legal obligations such as First Aid Records.

 

-Restrict Processing- you may contact SJDA at any time in order to restrict the data we process relating to you and/ Your child(ren ). SJDA will ensure that we respond to a request to restrict processing without undue delay and within one month of receipt.

However due to our legitimate interest in most of the data collected – we may have to revoke your membership with SJDA until the restriction is lifted. This is due to health and safety and child safeguarding.

 

-Data Portability- you may contact SJDA at any time in order to obtain the data we process relating to you and/or your child(ren)  and re use it across different services. SJDA will ensure that we respond to a request of data portability without undue delay and within one month of receipt.

Please note this does not apply to SJDA legal obligations.

 

-Objection- you may contact SJDA at any time in order to object to the processing of data relating to you and / or your children. SJDA will ensure that we respond to a request to object to processing without undue delay and within one month of receipt.

However due to our legitimate interest in most of the data collected – we may have to revoke your membership with SJDA until the restriction is lifted. This is due to health and safety and child safeguarding.

 

-Rights related to automated decision making including profiling- you may contact SJDA at any time in order to object to profiling relating to you and or your children. SJDA will ensure that we respond to a request to restrict processing without undue delay and within one month of receipt.

However, due to our legitimate interest in most of the data collected- we may have to revoke your membership with SJDA until the profiling restriction is lifted. This is due to health and safety and child safeguarding.

SJDA has a lawful reason to profiling; Legitimate interest and consent.

None of SJDA decision making is automated. Profiling is only used in circumstances where a participant may have certain Health/Disability needs which may prevent them from taking part in classes as it would be unsafe to do so.

Any and all verbal requests are noted, and contacted again either by phone or email to verify the request. Verbal requests will be responded to in the timeframes mentioned above.

 

Photos/Videos of participants

SJDA often use footage/photos used from shows, performances and classes for marketing purposes both in print media and the website. Participants/ their parents and /or guardians may choose if they do not wish themselves or their children to be depicted. Some attendees at events may film/take photos for their own personal use (e.g. parents of other participants). Participants /parents/guardians may choose if they do not wish themselves/children to be depicted.

 

Social Media

SJDA regularly share photos/videos of students in workshops, events and performances through social media platforms including; Instagram, Facebook, twitter & email. These will never be shared with any identifying information (age, location etc). there may be times where we will share first names, but only with the explicit consent of the parents.

 

 

 

 

 

Sarah McCabe is registered as a Data Controller with the Independent Commissioners Office (ICO).

 

The registered Data Protection Officer (DPO) is Sarah McCabe

 

Complaints and Data Breeches

 

Complaints:

Complaints in regard to the handling of any personal data can be made directly to:

Sarah McCabe (owner/DPO)

Email: ormskirk@babyballet.co.uk

Telephone: 07921256166

Address: 46 Motherwell crescent, Southport PR8 5LU

If you feel that your complaint was not handled in the correct manner, or still have concerns, you may escalate the complaint by contacting the Independent Commissioner’s Office (ICO). ICO Telephone Number: 0303 123 1113

Data Breeches:

If SJDA experiences a data breech of any kind, we have a legal obligation to report this to ICO within 72 hours. The data breech will be reported by the DPO.

 

SJDA will also inform all the victims of the data breech as soon as possible if there is a high risk of adversely affecting individuals’ rights and freedoms.

SJDA will store and record all data breeches.