GDPR Compliance
Last updated: January 2024
This page outlines how Confr Branc Music Education Ltd complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We take your data protection rights seriously and are committed to transparent, lawful processing of personal information.
Our Commitment
As a data controller, we ensure that personal data is:
- Processed lawfully, fairly, and transparently
- Collected for specified, explicit, and legitimate purposes
- Adequate, relevant, and limited to what is necessary
- Accurate and kept up to date
- Retained only for as long as needed
- Processed securely with appropriate safeguards
Lawful Bases for Processing
We process personal data under one or more of the following legal bases:
Contractual Necessity
When you enrol for lessons, we process your data to deliver the services you have requested. This includes scheduling lessons, tracking progress, processing payments, and entering you for examinations.
Legitimate Interests
We may process data where we have a legitimate business interest, provided this does not override your rights. Examples include improving our services, maintaining security, and sending administrative communications about your lessons.
Legal Obligation
Certain processing is required by law. This includes maintaining financial records for tax purposes and keeping safeguarding records for the protection of minors.
Consent
Where we rely on consent—such as for marketing emails or non-essential cookies—you may withdraw that consent at any time without affecting the lawfulness of prior processing.
Your Rights Under UK GDPR
You have the following rights regarding your personal data:
Right to Access
You may request a copy of the personal data we hold about you. We will provide this within one month, free of charge in most circumstances.
Right to Rectification
If any information we hold is inaccurate or incomplete, you have the right to have it corrected. Simply contact us with the updated details.
Right to Erasure
In certain circumstances, you may request deletion of your personal data. This right does not apply where we have a legal obligation to retain information or a legitimate reason to continue processing.
Right to Restrict Processing
You may ask us to limit how we use your data while we address a concern you have raised about accuracy or our grounds for processing.
Right to Data Portability
Where processing is based on consent or contract and carried out by automated means, you may request your data in a structured, commonly used format.
Right to Object
You may object to processing based on legitimate interests. We will stop unless we can demonstrate compelling grounds that override your interests.
Rights Related to Automated Decision-Making
We do not make decisions based solely on automated processing that significantly affect you. If this changes, we will inform you and ensure appropriate safeguards.
Exercising Your Rights
To make a request regarding your personal data, contact us at:
- Email: [email protected]
- Post: Data Protection, Confr Branc Music Education Ltd, 47 Harmony Lane, Westbrook, Manchester M15 4QR
Please provide enough information for us to verify your identity and locate your records. We will respond within one calendar month.
Data Protection Officer
As a small organisation, we are not legally required to appoint a Data Protection Officer. However, data protection queries are handled by our administrative team, who can be reached at the contact details above.
International Transfers
We primarily store and process data within the United Kingdom. If any data is transferred outside the UK, we ensure appropriate safeguards are in place, such as standard contractual clauses approved by the Information Commissioner's Office.
Data Breach Procedures
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours and inform affected individuals without undue delay where required.
Children's Data
Given the nature of our services, we process data relating to children. For students under 13, we require parental consent before collecting any personal information. For students aged 13-17, parents or guardians are involved in the enrolment process and receive communications about lessons.
Data Retention
We retain personal data only as long as necessary for the purposes it was collected:
- Active student records: Duration of enrolment plus 6 years (or until age 25 for minors)
- Financial records: 7 years as required by HMRC
- Enquiries that do not lead to enrolment: 2 years
- CCTV footage (if applicable): 30 days unless needed for an investigation
Complaints
If you believe we have not handled your data appropriately, please contact us first so we can address your concerns. You also have the right to lodge a complaint with the supervisory authority:
Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Website: ico.org.uk
Updates to This Information
We review our data protection practices regularly and may update this page accordingly. Material changes will be communicated to enrolled students via email.