Effective: August 2025 / Next Review Due: August 2026
Introduction
Summerscales Performing Arts is committed to protecting your privacy and the personal data we collect. This policy outlines how we collect, use, store, and share personal data in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
We are registered with the Information Commissioner’s Office (ICO) under registration reference: A8305065.
Your Rights Under UK GDPR
You have the following rights:
- The right to be informed – about how your data is collected and used.
- The right of access – to request a copy of the personal data we hold about you.
- The right to rectification – to correct inaccurate or incomplete data.
- The right to erasure – to request deletion where no legal obligation to retain applies.
- The right to restrict processing – to limit how we use your data.
- The right to data portability – to transfer your data to another service.
- The right to object – to processing for direct marketing or certain other purposes.
- Rights relating to automated decision-making and profiling – we do not use automated decision-making.
Lawful Basis for Processing
We process personal data under one or more of the following lawful bases:
- Legal obligation (e.g., safeguarding, licensing)
- Contractual necessity (e.g., staff or teaching contracts)
- Legitimate interests (e.g., enrolling students)
- Consent (e.g., marketing, use of photos/videos)
Consent is obtained through our online portal and may be withdrawn at any time by contacting us.
What Information We Collect
We collect and process data for children, parents/carers, staff, and visitors including:
Children & Parents
- Child’s name, address, date of birth, school, SEN needs
- Parent/carer name, contact details (email, phone, address)
- Attendance and licensing records
- Medical details where necessary for safeguarding
Staff (Including Visiting/Cover Staff)
- Full name, DOB, address, contact details
- ID documents, bank details, employment and DBS information
- Eligibility to work in the UK
How We Use Your Information
- To provide education and support services
- For safeguarding, licensing and compliance with Surrey County Council and other authorities
- For internal administrative purposes
- For examination entries via accredited dance bodies (e.g., ISTD)
- For communication via email/phone
- To comply with health & safety requirements
We may share your data with local authorities, dance associations, and service providers for these purposes, always via secure file transfer systems.
Data Retention
We retain personal data only for as long as legally required:
- Children and parent records: 3 years after leaving
- Accident/injury records: 19–22 years depending on context
- Child protection records: 22 years or until child reaches age 24
- Staff records: 6 years after leaving employment
- Waiting list data: Deleted if not enrolled
All data is securely stored and paper records are shredded or deleted after the retention period.
Data Security
- Paper records stored in locked cabinets securely offsite
- Electronic records stored on password-protected devices
- USB drives used are encrypted/password-protected
- Access to data is limited to authorized staff only
- Passwords are updated when staff leave
Photos, Videos and Website Data
- We may store images/video clips for educational or promotional use
- No names are published with images
- Consent is obtained for use of such media on social media, our website, or displays
Cookies and Website Analytics
Our website uses cookies to support functionality and collect anonymous visitor data via Google Analytics.
We seek explicit consent for non-essential cookies when you visit our site. You may manage your cookie preferences through your browser settings.
Sharing and Transferring Data
We do not transfer personal data outside the UK or EEA.
If this changes, we will implement appropriate safeguards and update this policy.
Accessing or Updating Your Data
You may request access, rectification, or deletion of your data at any time by contacting:
Natalie Wells
📞 0739 5678 000
📧 [email protected]
We will respond within 1 month. If we are legally required to retain the data, we will explain why. You have the right to complain to the ICO if dissatisfied.
Data Protection Lead
While we are not required to appoint a Data Protection Officer, our Data Protection Lead is:
Natalie Wells – responsible for overseeing data compliance and safeguarding your information.
Complaints
If you are concerned about how we use your data, contact us first. You also have the right to complain to the ICO:
📍 www.ico.org.uk
📞 0303 123 1113
Policy Review
This policy was reviewed in August 2025 and is reviewed annually or when changes in law or practices require.