Chiltern Academy School of Performing Arts Commitment to GDPR

On May 25, 2018, the European Union’s General Data Protection Regulation (GDPR) took effect. GDPR regulates the governance of personal data for EU citizens with an emphasis on data security and privacy. The GDPR does not only apply to companies that operate in the EU. This regulation will also impact companies operating outside of the EU if they have any EU customers or personal data of anyone in the EU.

The GDPR imposes additional requirements upon organisations to strengthen the security and enhance the protection of personal data of EU residents.

We recognise the importance of passing regulations to advance information security and data privacy for citizens of the EU, and all citizens, regardless of their location.

We are firmly committed to GDPR compliance.

Definition of Data Controller and Data Processor

A data controller is the person or organisation that decides the purpose for which and the way in which any personal data is processed. A Data processor refers to the person or organisation which processes personal data on behalf of the controller.

The data controller is Chiltern Academy School or Performing Arts

The data protection officer is Lisa Tierney who can be contacted directly at misslisachilternacademy@gmail.com .

General Definitions

Within the Privacy Policy statement ‘we’ and ‘us’, refers to Chiltern Academy School of Performing. Arts. ‘Visitors’ and ‘Clients’ refers to visitors to the website and clients of Chiltern Academy School of Performing Arts.

Services

Services relate to the provision of classes for the performing arts, preparation for examinations and the production of shows.

Information held, which is subject to confidentiality, relates to client details, names and addresses, email addresses, telephone numbers, date of birth, carer details, emergency contact details and details of allergies, medication and additional needs.

This privacy policy pertains to all services we offer whether they’re listed here explicitly in this document or not.

Privacy Notice

This Privacy Notice is meant to help you understand what Personal Data we might collect, why we collect it, and what we do with it. It also describes the choices available to you with regards to the use of your Personal Data and how you can access and update this information.

We am committed to protecting the privacy of our website visitors (“Visitor”), and registered clients (“Client”). We have adopted the following principles to govern the use, collection, and transmittal of Personal Data, except as specifically provided by this Policy or as required by applicable laws:

• Personal data will only be processed fairly and lawfully
• We do not collect any more personal data than is necessary to provide the services
• We only use your personal data for the purposes we specify in this Privacy Notice, unless you agree otherwise
• We do not keep your personal information if it is no longer needed
• We do not sell, distribute or share your personal information with third parties
• You can have your data updated at any time
• You can remove your data at any time
• You can request a copy of the data we store on you at any time
• Personal data is securely stored and managed

What Is Personal Data?

Personal data is any information that relates to an identified or identifiable living individual. Different pieces of information, which collected together can lead to the identification of a particular person, can also constitute personal data.

Personal data is subject to the protection requirements set out in the GDPR.

Examples of data considered as personal data:

• a name and surname
• a home address
• an email address such as YourName@company.com
• telephone numbers
• an identification card number
• location data (for example the location data function on a mobile phone)
• an IP address
• a cookie ID

Examples of data not considered as personal data:

• a company registration number
• an email address such as info@company.com
• anonymised data

What and How We Collect and Maintain Information

We collect and maintain information about our Clients, which may include:

• First and last name
• Postal address
• Phone and fax numbers
• Website URL
• E-mail address
• Date or Birth
• Allergies and Medication
• Parent/ Carer details
• Other billing information

In order to communicate with us or to use our services, you may be prompted to provide certain personal data in the following ways:

• By filling in forms (i.e. a “Contact Us” form or Registration Form) on our website or a paper form downloaded from the website.
• Contact directly (i.e. by phone, SMS, email or post)
• By downloading or accessing our services
• When you register to use our website (http://chilternacademy.co.uk ) this will include your email address and name. This is effectively signing up to a newsletter which you can unsubscribe yourself from at any time.
• When we enter into a relationship for the intended delivery of services. We will require your name, address, email address, contact numbers and other information submitted in application forms. This information is generally exchanged through email and forms part of a business record for maintaining contact and accounts.
• By corresponding with us by phone, e-mail or otherwise using my contact details

Typically, the personal data you give me may include name and email address, and any personal details required to resolve any enquiries or complaints.

How We Use Personal Data

We use personal data provided by you to provide services and for business purposes such as delivering services, marketing, billing and for other general purposes.

We will never share your personal data, or otherwise make your personal data available to any third parties for the purposes of marketing or targeting you. We will not sell, rent, or exchange your personal data with any third-parties.

We use your personal data to:

• Conduct and develop our business with you
• Register on performing arts courses
• Operate, maintain, improve and develop the websites
• Monitor, carry out statistical analysis and benchmarking (i.e. Google Analytics for sites pages tracking), provided that in such circumstances it is on an aggregated basis which will not be linked back to you or anyone else
• Engage and educate you about our services
• Provide you with documentation or communications which you have requested
• Correspond with you to resolve your queries or complaints
• Provide you with any services you request
• Send you marketing communications

Definition Data Processing

The meaning of data processing is defined as any operation performed on personal data whether by automated systems or not and includes collection, use, recording etc.

The extent of “data processing” performed on the personal data we hold is limited to the management and maintenance of existing business relationships and financial accounts. We do not use it for any other purpose.

Change of purpose

We will only use your personal data for the purposes for which we collected it. Where we need to use your personal data for another reason, we will do so only in circumstances where we reasonably consider it is compatible with the original purpose. In the event we use your personal data for a different purpose, we will notify you of the legal basis that allows us to do so before commencement.

How we Protect Your Personal Data

All of your Personal Data remains private and confidential. The security of your Personal Data is extremely important to us. We follow generally accepted standards to protect personal data submitted to us, both during transmission and once it is received. No method of transmission over the Internet, or method of electronic storage is 100% secure.

Our email communications are sent over, and received from, an encrypted connection to the mail systems. Provided you ensure your email communications settings in your email application are also configured to use security you should be assured of the secure communications between us.

We use password controlled accounts on the various computer systems we use on a day to day basis. Systems will also time out requiring password re-entry. The locations where your information is stored are also encrypted. Should we need to carry personal data with us for any purpose, the media that is used is also encrypted.

We ensure that our computer systems are up to date and are using the latest security patches.

Default logins on websites and other devices are never left at their default settings, and passwords to sensitive areas such as websites are extremely cryptic and complex.

Location of Personal Data

Systems we use that contain data may be in one of the following locations:

• On a local encrypted drive attached to a computer system
• On a DropBox Professional Account for website back ups (also encrypted)
• On a portable encrypted device

Use of Third Party Services for Fault Detection, Management and Resolution

We use various 3rd party services when resolving problems on or related to our website. During the process of identifying a problem and investigating it, access may be permitted to the website in order to locate the problem. This is usually the hosting company 20i. On some occasions we may need the help and support of a third party whose plugin or theme is being used on the website. We may grant access to these people as well.

When the work has been completed the login account to the site is deleted

Our commitment to data protection and information privacy demands the use of 3rd party services that are also committed to the same end.

All the 3rd party services will be GDPR compliant and will themselves have their own applicable privacy policies.

Newsletter/Marketing

If you have subscribed to our Newsletter (only you can do this, we will not subscribe anyone without their knowledge, and nobody else can subscribe you without your knowledge) you will receive an email from Chiltern Academy generally once per half term, and on rare occasions when there is something important we need to tell you,  an Alert communication which is sent out on an ad hoc basis. You may unsubscribe to these at any time. You will not receive any further newsletters after you unsubscribe.

Cookies

Cookies are small text files that are placed on your computer by websites that you visit. These text files can be read by these websites and help to identify you when you return to a website. Cookies can be “persistent” or “session ID” cookies. Persistent cookies remain on your computer when you have gone offline, while session ID cookies are deleted as soon as you close your web browser.

The website and the associated plugins and themes use both session and persistent cookies.

In general, cookies are used to retain user preferences, store information, and provide anonymised tracking data to third party applications like Google Analytics. As a rule, cookies will make your browsing experience better. However, you may prefer to disable cookies on this site. The most effective way to do this is to disable cookies in your browser.

We will not use any hidden marketing or targeted advertising on the Chiltern Academy website. All of the cookies that are used are legitimate for the delivery of the service.

For the detailed information about how cookies are used, please read the cookie policy statement at the bottom of one of the website.

Links

The website, documentation pages or blog might include links to other websites whose privacy practices may differ from those of our own. If you submit information to any of those sites, your information is governed by their respective privacy policies. We encourage you to carefully read the Privacy Policy of any website you visit before engaging with them in any way.

Chiltern Academy School of Performing Arts cannot take responsibility for any interaction you have with 3rd parties or services that are not directly our own.

Your Rights under the Personal Data Protection Laws

As our Customer or User, you have the right to:

• Request access to your personal data (known as a data access request). This enables you to receive details of the personal data we hold about you and to check that we are lawfully processing it.
• Request Correction of the personal data that we hold about you.
• Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us to continue processing it.
• Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this basis. You also have the right to object where we are processing your personal information for direct marketing purposes.
• Request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you, for example if you want to establish its accuracy or the reason for processing it.
• Request the transfer of your personal data to you or another data controller if the processing is based on consent, carried out by automated means and this is technically feasible. We do not believe that any circumstances exist where this right would be exercised due to the very small amount of data held.

Your Responsibilities under the Personal Data Protection Laws

Within your rights under privacy laws you are entitled to ask for a copy of the data (access request)  that we hold in our systems. We will follow a process to make sure that before any personal data is transmitted to the requester, that they are legitimately entitled to receive it.

If you do not co-operate in this process to establish the legitimacy of the request, the information will not be released. Any requests on our part to verify your request will be undertaken solely to protect both you and us against a breach of your personal information.

Should this situation occur and not be resolved to your satisfaction, you should write or contact the ICO office to escalate the matter.

Consent Withdrawal

You may withdraw your consent at any time by contacting us at admin@chilternacademy.co.uk

Automated Decision Making

We do not carry out any ‘Automated Decision Making’ based on the data we hold about you.

Data Retention Period

We will only retain your personal data for as long as is necessary to fulfil the purposes for which it is collected.

• Data retention periods will depend upon a number of factors such as :
• The requirements of our business relationship and services provided;
• Relevant statutory or legal obligations;
• The purposes for which the data was originally collected;
• The lawful grounds upon which we based the processing;
• They types of personal data collected;
• The amount and categories of your personal data;
• Whether the purpose of the processing could be achieved by other means.

Our normal data retention period for data received in connection with our operations and services will be 7 years in line with regulatory requirements unless there is a legitimate interest for retaining that data for a longer period.

Subscribers wishing to unsubscribe themselves from our newsletter will be unsubscribed within seven days of an email request to admin@chilternacademy.co.uk . Or they may choose to unsubscribe themselves online through the link in the bottom of every newsletter. They will not be contacted any further and their details will be removed from the database within six months during our next maintenance cycle.

Example of long-term data retention

We are required by law to be able to record sales and tax information for up to 7 years. In this case we must retain any pertinent information on these transactions.

Changes to this Privacy Notice

We may change this Privacy Notice from time to time by updating this page in order to reflect changes in the law and/or our privacy practices. We encourage you to check this Privacy Notice for changes whenever you visit the website. Each privacy notice will note the date it has been released, We will also inform you of changes through the Chiltern Academy newsletter.

How to Contact Us

If you have any questions about this Privacy Policy or complaints about how we process your Personal Data and you want to contact us, you can do that by going to the Contact Us section of the website or send email to admin@chilternacademy.co.uk . Your issue will be resolved as quickly as possible.

ICO office

You also have the right to make a complaint to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues, at any time. The ICO’s contact details are as follows:

Information Commissioner’s Office

Wycliffe House, Water Lane, Wilmslow, Chesire, SK9 5AF

Telephone 0303 123 1113 (local rate) or 01625 545 745 (national rate).

Website – https://ico.org.uk/concerns

Lisa Tierney

This version 8th August 2021

Next: Accessibility