Effective Date: 03/06/2025

Bromsgrove School of Music ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website (the "Site"). Please read this policy carefully. If you do not agree with the terms of this Privacy Policy, please do not access the site.

We are a data controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Personal data, or personal information, means any information about an individual from which that person can be identified.
We may collect, use, store and transfer different kinds of personal data about you as required such as:
From adult learners, parents/guardians, and visitors:

• Name
• Email address
• Phone number
• Postal address
• Payment details (processed via third-party providers)
• Communication preferences
• IP address, browser type, and usage data (via cookies)

From a parent/guardian we may collect the following information about students under the age of 18:

• Name
• Date of birth or age
• Parent or guardian contact details
• Lesson attendance and progress notes
• Media (photos/videos) if consent has been given

We collect this information directly from you when you:

• Fill out forms on our website
• Register for music lessons
• Contact us via phone, email, or web forms
• Sign up for newsletters or updates
• Use our services

We will only use your personal data when the law allows us to. The legal bases include:

• Consent: Where you have explicitly agreed to us processing your data (e.g., signing up to marketing emails or allowing use of media of your child).
• Contract: Where processing is necessary for the performance of a contract (e.g. booking a lesson).
• Legal Obligation: Where we must comply with legal or regulatory requirements.
• Legitimate Interests: For our legitimate business purposes, unless overridden by your rights.

We may use your information to:

• Provide and manage music lessons
• Communicate about bookings, schedules, payments, and lesson updates
• Respond to inquiries and provide support
• Maintain safeguarding and attendance records
• Promote the school (if you have given media consent)
• Improve our services and website
• Comply with legal and safeguarding obligations

We take child data protection seriously. If we collect personal data from a child under 18, we will obtain verifiable parental or guardian consent. Parents and guardians have the right to:

• Access their child’s data
• Request correction or deletion
• Withdraw consent at any time (where processing is based on consent)
• We do not knowingly market to children directly.

We will never sell your data. We may share it with:

• Music tutors and administrative staff (only what’s necessary)
• Payment processors (e.g. Stripe)
• Website hosting and email service providers
• Legal or regulatory authorities if required

All third-party providers are required to respect the security of your personal data and to treat it in accordance with the law.

Some of our third-party service providers may process your data outside the UK (e.g., cloud service providers). Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or UK adequacy decisions.

We take appropriate technical and organisational measures to safeguard personal data. This includes secure servers, encryption, access controls, and regular monitoring. Despite our best efforts, no system can be guaranteed 100% secure. We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

We will only retain your data for as long as necessary to fulfil the purposes we collected it for, including for legal, accounting, or safeguarding requirements. Retention periods:

• Contact information: up to 6 years after last contact
• Student records (minors): up to 6 years after the child turns 18
• Financial records: 6 years (for HMRC compliance)

You have the right to:

• Access your personal data
• Request correction of your data
• Request erasure (in some cases)
• Object to processing or restrict it
• Withdraw consent at any time
• Lodge a complaint with the Information Commissioner’s Office (ICO), (www.ico.org.uk), however, we would appreciate the opportunity to address any issues before you approach the ICO.

To exercise any of these rights, please contact us at info@bromsgroveschoolofmusic.co.uk.

We may update this policy from time to time. When we do, we will revise the "Effective Date" at the top. Please review it regularly.

We may update this policy from time to time. When we do, we will revise the "Effective Date" at the top. Please review it regularly. If you have any questions or concerns about this privacy policy or your personal data, please contact:
Bromsgrove School of Music
Email: info@bromsgroveschoolofmusic.co.uk.
Phone: 01527 570339
Address: 13-15 Worcester Road, Bromsgrove, B61 7AE