GDPR Policy

Date Adopted: 01-09-2019
Date of last review: 01-09-2022
To be reviewed next (before/on): 01-09-2024

Purpose and Statement:

Swindon Academy of Dance is committed to ensuring the data processed by our school remains safe and secure.
This policy has been written in line with legislative change, including both the Data Protection Act (1998) and the EU’s General Data Protection Regulation (GDPR).
Swindon Academy of Dance has determined the lawful reasons with which it processes personal data:

  • Legal obligation – GDPR Article 6(1)(c)
  • Legitimate interest – GDPR Article 6(1)(f)
  • Contract – GDPR Article 6(1)(b)

There is also some limited data it processes with consent from the Data Subject; Consent – GDPR
Article 6(1)(a).

While Swindon Academy of Dance avoids sharing data with third parties at most times, some data is
shared in accordance with our business practices. The sharing of data with third parties will always be
consensual with the data subject and/or their parent/guardian, and only if Swindon Academy of Dance is
satisfied that their Data Protection policy is GDPR compliant.

Main Aims for the policy:

  • Specify the data Swindon Academy of Dance collects, how it is stored/protected and the
    reason for collecting it.
  • State how Swindon Academy of Dance uses personal data in processing.
  • Disclose who has access to the data and how long it retains information for
  • Explain Data Subject’s rights with Swindon Academy of Dance data including access,
    rectification, and erasure.

Distribution:

  • To be distributed to Board at AGM and Induction sessions for Board Members [IF APPROPRIATE]
  • To be sent to all staff, freelance staff, and volunteers as part of induction and training
  • To be displayed on the Swindon Academy of Dance website
  • This policy will be sent directly to members of the public on request.
  • Confirmation of receipt of information – Signed statement from recipient to be held on
    file.

Review and monitoring of policy:

  • Reviewed annually or in instances of legislative change.
  • Monitoring is part of Management and Supervision

The following policy is based on the below principles:

The GDPR includes the following rights for individuals:

  • the right to be informed.
  • the right of access
  • the right to rectification
  • the right to erasure
  • the right to restrict processing.
  • the right to data portability
  • the right to object
  • the right not to be subject to automated decision-making including profiling.

General Principles

Swindon Academy of Dance is committed to providing fair and understandable privacy policies in relation to personal data.

Swindon Academy of Dance will, always, keep data in secure locations (including, but not limited to, encrypted and access restricted files) and not retain data unnecessarily or past the retention length as set out in this policy.

In the rare instance a data processor that is not a Swindon Academy of Dance employee is used, such as a third party, the data subject will either be asked for consent prior to supplying the data or be notified and have the right to object to processing.

Participants and Customers

How Swindon Academy of Dance collect personal data:

Swindon Academy of Dance customers and participants supply their personal data when signing up for classes through our registration form either via the website, or via paper form.
This is either completed by a parent/guardian or the child themselves if they deemed able to do so.
Personal data may also come to us unsolicited via enquiries through our website and to our generic email account.

Why Swindon Academy of Dance collect personal data:

To attend any of Swindon Academy of Dance’s activities participants/parents/guardians must agree to some processing of their personal data. This is due to Legitimate Interests – GDPR Article 6(1)(f), Legal Obligation GDPR Article 6(1)(c), Contract – Article 6(1)(b) and/or Consent – Article 6(1)(a).

Should Swindon Academy of Dance be unable to process participant’s data, it would be contravening both its Health & Safety and Child Safeguarding policies. It would also be ignoring best practice regarding working with children/vulnerable adults.

Our participants must always remain safe, therefore information about participants must be collected to create registers and accurate student records. This information is also used to provide students with appropriate classes, including dividing students into age groups.

Special category data is only collected with the consent of the data subject. Special category data Swindon Academy of Dance collects includes but is not limited to: Medical/Disability information, Income information, Ethnicity, Gender, and Sexuality.

As physical activity providers it is essential that this consent is given should a participant have any medical/disability needs. This allows us to incorporate participants safely into classes. It is also used in assessing if it can incorporate participants safely into classes.

Income information is only collected in instances where a participant applies to attend our classes at a concessionary price, or on a bursary. This financial support is means tested, and therefore is subject to documented proof. Proof of entitlement to concession is shredded after the entitlement has been noted.

Ethnicity and other sensitive data are to provide information to funding bodies for statistical purposes. This data is always provided to third parties as quantified data (i.e., cumulative numerical data only with no identifying information relating to any data subject).

What data we collect:

Personal data and some special categories are collected.
It is essential to our primary function (providing classes to participants) that we are provided, and allowed to process and store the following:

Participant Personal Data:
  • Full Name – GDPR Article 6(1)(f)
  • Date of Birth – GDPR Article 6(1)(f)
  • Home Address – GDPR Article 6(1)(f)
  • Sex – GDPR Article 6(1)(f)
  • Permission to go home alone – GDPR Article 6(1)(f)
  • School/Educational Institution – GDPR Article 6(1)(f)
  • Exam results (vocational exams taken through Swindon Academy of Dance only) – GDPR Article 6(1)(f)
  • Classes attended/Price paid – GDPR Article 6(1)(f)
Participant Special Category Data:
  • Medical Information/History – GDPR Article 9 (a)
  • Disability Information – GDPR Article 9 (a)
  • Ethnicity – GDPR Article 9 (a & j) – further explicate consent sought.
  • Gender/Sex – GDPR Article 9 (a & j) – further explicate consent sought.
  • Sexuality – GDPR Article 9 (a & j) – further explicate consent sought.
Parent/Guardian Personal Data:
  • Name – GDPR Article 6(1)(f)
  • Address – GDPR Article 6(1)(f)
  • Email Address – GDPR Article 6(1)(f)
  • Mobile Telephone Number – GDPR Article 6(1)(f)
  • Work/Home Number – GDPR Article 6(1)(f)
  • Emergency Contact Number – GDPR Article 6(1)(f)
Parent/Guardian Special Category Data:
  • Concession Type – further explicate consent sought.
  • Documented proof of financial need – further explicate consent sought.
  • Bank Details – further explicate consent sought in the instance of refunds etc.
How data collected is sent internally:

Swindon Academy of Dance transports data with all due diligence.
Enrolment forms are sent to Swindon Academy of Dance through an encrypted email server directly from our website which has controlled access. Received enrolment forms are stored on an encrypted email server for no more than 6 months. Paper enrolment received are destroyed after no more than 4 weeks.

Storage/Retention of data:

Data received through enrolment forms is uploaded manually into our database software. Our database is stored both in encrypted files on office-based hardware and backed up regularly in our encrypted cloudbased server. Access to these files is restricted through password protection and only available to
authorised staff members.

Registers and emergency contact lists created from student data are stored in encrypted files on officebased hardware and backed up regularly in our encrypted cloud-based server. Access to these files is restricted through password protection and only available to authorised staff members.
Hard copies of registers and emergency contacts are carried by authorised staff members. They are locked away while not in use. When they are no longer in use or out-dated, they are destroyed thoroughly.

Waiting lists are stored on an encrypted cloud-based server.

Our standard retention policy (without the data subject’s right to access, rectification and erasure etc.) is THREE YEARS post final attendance.

Exceptions to our retention policy:

  • Financial records are kept for 6 years due to legal obligation.
  • First Aid records are kept for 21 years due to legal obligation.
  • Photo consent may be kept indefinitely.
  • Child Safeguarding records are kept indefinitely on a case-by-case basis, the minimum these will stored for is 6 years due to legal obligation.
  • Bank details are deleted after the action concerning them is complete.
  • Unsolicited enquiries that do not turn into bookings with current classes are deleted after they have been dealt with
Third Parties/Data Processors:

Swindon Academy of Dance does not actively share data with third parties, however there are certain
instances where sharing information is crucial to our business processes.

Freelance Teachers:

As many of Swindon Academy of Dance teachers are freelance staff, we have confidentiality and data
processor agreements in place. Teachers will never be provided with personal details aside from
participant’s first names and any medical information that is pertinent to the running of a class (subject to
consent from the data subject)

Go Contactless:

Swindon Academy of Dance uses Go Contactless to process orders through our website.
By purchasing through Go Contactless you must agree to their own (GDPR Compliant) policies.
Swindon Academy of Dance is satisfied that their GDPR regulations are thorough, and the information stored in Go Contactless is secure. It has a processor agreement in place, and copies are available upon request.

Child Performance Licensing:

To process child performance licences, Swindon Academy of Dance is legally required to provide some personal data to local councils (including but not limited to full name, date of birth and school details).
This is an optional consent, which will be sought at the time of sending participation consent forms.
Swindon Academy of Dance is satisfied that their GDPR process are thorough, and any data will be stored in a secure environment, and not unnecessarily retained.

Child Safeguarding Concerns:

In the unlikely event Swindon Academy of Dance has a safeguarding concern in relation to one of our participants, Swindon Academy of Dance is legally required to provide data to the safeguarding board at the local council.
Swindon Academy of Dance is satisfied that their GDPR process are thorough, and any data will be stored in a secure environment, and not unnecessarily retained.

Event Programmes:

Swindon Academy of Dance may occasionally produce programmes for events. These will only ever contain the first name and first initial of a child’s last name (unless otherwise consented to). The name of a child’s class may also be included. Participants/their Parent and/or Guardians may choose if they want to be included in the programme when they agree to participate at an event.

Examination Entry:

To enter examinations, Swindon Academy of Dance must provide some personal data to examination boards (currently Swindon Academy of Dance works with: ISTD and RAD). This sharing of data is to be consented to by the data subject and/or parent/guardian upon being entered for the exam.

Schools:

Swindon Academy of Dance must sometimes share personal data with schools (names, DOB, and payment information) when taking part in an internal class for them to check persons attending. This also helps the identify Swindon Academy of Dance’s payment in terms of renting space.
Swindon Academy of Dance is satisfied that their GDPR process are thorough, and any data will be stored in a secure environment, and not unnecessarily retained.

Independent Examiner:

It is Swindon Academy of Dance’s legal obligation to have an independent examination with regards to its financial processes at the end of every financial year. This includes access to our income relating to classes and services. Any data shared will be purged of as much identifying data as possible.
Swindon Academy of Dance is satisfied that their GDPR processes are thorough and any data will be stored in a secure environment, and not unnecessarily retained. Swindon Academy of Dance has a copy of the privacy agreement on file.

Rights of the data subject and Swindon Academy of Dance compliance with responses:

Any data subject with personal data stored within Swindon Academy of Dance is entitled to the rights of:

  • Access
    You may contact Swindon Academy of Dance at any time to access all data held relating to you and/or your child(ren). Swindon Academy of Dance will ensure that it responds to a subject access request without undue delay and within one month of receipt. If the information request will also include data regarding others, Swindon Academy of Dance has the right to refuse the request or take steps to obtain consent from other involved parties.
    The right of access does not apply to Swindon Academy of Dance’s legal obligations such as Child Safeguarding records.
  • Rectification
    You may contact Swindon Academy of Dance at any time to rectify data held relating to you and/or your child(ren). Swindon Academy of Dance will ensure that it responds to a rectification request without undue delay and within one month of receipt.
    The right to rectification does not apply to Swindon Academy of Dance’s legal obligations such as payment record information.
  • Erasure
    You may contact Swindon Academy of Dance at any time to erase data held relating to you and/or your child(ren). Swindon Academy of Dance will ensure that it responds to an erasure request without undue delay and within one month of receipt.
    The right to erasure does not apply to Swindon Academy of Dance’s legal obligations such as First Aid records.
  • Restrict Processing
    You may contact Swindon Academy of Dance at any time to restrict the data it processes relating to you and/or your child(ren). Swindon Academy of Dance will ensure that it responds to a request to restrict processing without undue delay and within one month of receipt.
    However, due to our legitimate interest in most of the data collected- it may have to revoke your membership with Swindon Academy of Dance until the restriction is lifted. This is due to Health and Safety and Child Safeguarding.
  • Data Portability
    You may contact Swindon Academy of Dance at any time to obtain the data it processes relating to you and/or your child(ren) and reuse it across different services. Swindon Academy of Dance will ensure that it responds to a request to restrict processing without undue delay and within one month of receipt.
    Please note, this does not apply to Swindon Academy of Dance’s legal obligations.
  • Objection
    You may contact Swindon Academy of Dance at any time to object to the processing of data relating to you and/or your child(ren). Swindon Academy of Dance will ensure that it responds to a request to restrict processing without undue delay and within one month of receipt.
    However, due to our legitimate interest in most of the data collected- it may have to revoke your membership with Swindon Academy of Dance until the restriction is lifted. This is due to Health and Safety and Child Safeguarding.
Rights related to automated decision-making including profiling.

You may contact Swindon Academy of Dance at any time to object to profiling relating to you and/or your child(ren). Swindon Academy of Dance will ensure that it responds to a request to restrict processing without undue delay and within one month of receipt.
However, due to our legitimate interest in most of the data collected- it may have to revoke your membership with Swindon Academy of Dance until the profiling restriction is lifted. This is due to Health and Safety and Child Safeguarding.
Swindon Academy of Dance has a lawful reason for profiling; Legitimate Interests and consent.
None of Swindon Academy of Dance’s decision making is automated. Profiling is only used in circumstances where a participant may have certain health/disability needs which may prevent them from taking part in classes (as it would be unsafe to do so).
Any written and all verbal requests are noted, and then contacted again either via phone or email to verify the request. Verbal requests will be responded to in the time frames mentioned above.

Photos/Videos of Participants

Swindon Academy of Dance often uses footage/photos used from shows, performances, and classes for marketing purposes both in print media and the website. Participants/their Parent and/or Guardians may choose if they do not wish themselves/their child to be depicted.
Some attendees at events may film/take photos for their own personal use (e.g., parents of other participants). Participants/their Parent and/or Guardians may choose if they do not wish themselves/their child to be depicted.

Social Media:

Swindon Academy of Dance regularly share photos/videos of students in workshops, events and performances through social media platforms including Instagram, Facebook, Twitter, Email. These will never be shared with any identifying information (age, location etc.). There may be times where it will share first names, but only with the explicit consent of the parents.

Staff (Employees/Freelance), Trustees, Volunteers and Potential Staff/Trustees and/or Volunteers

For the purposes of this policy, the persons above will be referred to as ‘staff’.

How Swindon Academy of Dance collect personal data:

Swindon Academy of Dance staff supply their personal data when applying for roles within the company.
This is either completed through an application form or submission of a CV.
Further information is collected when applicants are considered successful. Unsolicited data may come to Swindon Academy of Dance in the form of applicants emailing regarding work/volunteer opportunities.

Why Swindon Academy of Dance collect personal data:

It is Swindon Academy of Dance’s legal obligation to collect staff’s personal data in relation to their employment. This is due to Legal Obligation GDPR Article 6(1)(c) and/or Contract – Article 6(1)(b)
Should Swindon Academy of Dance be unable to process staff’s data, it would be contravening UK Employment law, our own employment contracts (both PAYE and Freelance) and our own Health & Safety and Child Safeguarding policies.
Special category data is only collected with the consent of the data subject. Special category data Swindon Academy of Dance collects includes but is not limited to: Medical/Disability information, Ethnicity, Gender, and Sexuality. Swindon Academy of Dance’s lawful purpose for collecting this data is both Article 6(1)(b) – contract and Article 9(2)(b) – employment. This also ensures it is confirming to our Equal Opportunities policy. Any data is always recorded as quantified data (i.e., cumulative numerical data only with no identifying information relating to any data subject).
Swindon Academy of Dance is also entitled to obtain and process data in relation to criminal convictions and DBS checks. Most posts within Swindon Academy of Dance are exempt from the Rehabilitation of Offenders Act (1974) by the 1975 and 2001 Exceptions Amendment, as they involve working with vulnerable and/or young people. This is further supported by article 10 of GDPR.

What data is collected:

Personal data and some special category is collected.
It is essential to the business that it is provided, and allowed to process and store the following:

Staff Personal Data:
  • Full Name Legal obligation – GDPR Article 6(1)(c) Legal Obligation
  • Date of Birth – GDPR Article 6(1)(c) Legal Obligation
  • Contact Details – GDPR Article 6(1)(c) Legal Obligation
  • Pension Information – GDPR Article 6(1)(c) Legal Obligation
  • NI number – GDPR Article 6(1)(c) Legal Obligation
  • UTR number – GDPR Article 6(1)(c) Legal Obligation
  • Right to work in the UK – GDPR Article 6(1)(c) Legal Obligation
  • References – GDPR Article 6(1)(c) Legal Obligation
  • Bank Details – Article 6(1)(b) Contract
  • Tax details – GDPR Article 6(1)(c) Legal Obligation
  • Qualifications – Article 6(1)(b) Contract
  • Pay Details – GDPR Article 6(1)(c) Legal Obligation
  • Performance Details – Article 6(1)(b) Contract
  • Annual Leave Details – Article 6(1)(b) Contract
  • Sick/Compassionate/Maternity/Paternity Leave Details – Article 6(1)(b) Contract
  • Safeguarding Concerns – GDPR Article 6(1)(c) Legal Obligation
  • Emergency Contact – GDPR Article 6(1)(b) Contract
Staff Special Category Data:
  • Criminal Record/DBS Checks – GDPR Article 6(1)(c) Legal Obligation & GDPR Article 10
  • Medical/Disability – Article 6(2)(b) Contract & Article 9(2)(b)
  • Ethnicity – Further explicit consent sought- Article 9(2) (a & b)
  • Sexuality – Further explicit consent sought – Article 9(2) (a & b)
How data is sent internally:

Any transfer of data regarding staff is conducted through encrypted emails and/or stored in our encrypted cloud-based server.
Any unsolicited information is received to an encrypted email server.

Storage/Retention of data:

All Staff personal data is stored on encrypted files in our cloud-based server. It is also stored on encrypted hardware within the office. Any hard copies are stored in a locked cabinet. All these files have restricted access to authorised staff only.
Most staff data is retained for 6 YEARS (post-employment).
Exceptions to our retention policy:

  • Pension details are stored for 75 years (post-employment) due to legal obligation.
  • Child Safeguarding records are kept indefinitely on a case-by-case basis, the minimum these will stored for is 6 years due to legal obligation.
  • First Aid records are kept for a minimum of 21 years due to legal obligation.

Unsuccessful applicant data is stored 6-months post campaign, this includes unsolicited data from potential applicants.

Third Parties/Data Processors:

Swindon Academy of Dance does not actively share data with third parties, however there are certain instances where sharing information is crucial to our business processes.
National Westminster Bank:
To process payments by BACs, staff’s bank details and names must be added to our online banking system. Swindon Academy of Dance is satisfied that their GDPR process are thorough, and any data will be stored in a secure environment, and not unnecessarily retained.
HMRC:
In order to fulfil our legal obligations to HMRC, Swindon Academy of Dance must supply PAYE staff’s personal data each month and at the end of every financial year. Swindon Academy of Dance is satisfied that their GDPR processes are thorough, and any data will be stored in a secure environment, and not unnecessarily retained.
People’s Pension:
To fulfil our legal obligation with the Pensions Regulator, Swindon Academy of Dance chose the Nest Pension as our pension provider. Swindon Academy of Dance must supply PAYE staff’s personal data each month and at the end of every financial year. Swindon Academy of Dance is satisfied that their GDPR processes are thorough, and any data will be stored in a secure environment, and not unnecessarily retained.
References:
To supply references for staff members, some personal data must be divulged. This will only be done with the data subject’s consent, as Swindon Academy of Dance may not be fully aware of the recipients GDPR policies.
Child Performance Licensing:
In order to process child performance licences, Swindon Academy of Dance is legally required to provide some staff’s personal data to local councils (including but not limited to: full name and DBS details).
Swindon Academy of Dance is satisfied that their GDPR process are thorough and any data will be stored in a secure environment, and not unnecessarily retained.
Child Safeguarding Concerns:
In the unlikely event Swindon Academy of Dance has a safeguarding concern in relation to one of participants and/or staff members, Swindon Academy of Dance is legally required to provide data to the safeguarding board at the local council and the Disclosure and Barring service.
Swindon Academy of Dance is satisfied that their GDPR process are thorough and any data will be stored in a secure environment, and not unnecessarily retained.
Website Biography:
Swindon Academy of Dance’s website includes staff biographies, these are available for public viewing.
Consent it sought before any/all staff profiles are added to the website.
Independent Examiner:
It is Swindon Academy of Dance’s Legal Obligation to have an independent examination with regards to its financial processes at the end of every financial year. This includes access to our payroll records.
Swindon Academy of Dance is satisfied that their GDPR process are thorough, and any data will be stored in a secure environment, and not unnecessarily retained. Swindon Academy of Dance has a copy of the privacy agreement on file.

Rights of the data subject and Swindon Academy of Dance compliance with responses:

Any data subject with personal data stored within Swindon Academy of Dance is entitled to the rights of:

  • Access
    You may contact Swindon Academy of Dance at any time to access all data held relating to you.
    Swindon Academy of Dance will ensure that it responds to a subject access request without undue delay and within one month of receipt. If the information request will also include data regarding others, Swindon Academy of Dance has the right to refuse the request or take steps to obtain consent from other involved parties.
    The right of access does not apply to Swindon Academy of Dance’s legal obligations such as confidential Child Safeguarding records.
  • Rectification
    You may contact Swindon Academy of Dance at any time to rectify data held relating to you.
    Swindon Academy of Dance will ensure that it responds to a rectification request without undue delay and within one month of receipt.
    The right to rectification does not apply to Swindon Academy of Dance’s legal obligations such as payment record information.
  • Erasure
    You may contact Swindon Academy of Dance at any time to erase data held relating to you.
    Swindon Academy of Dance will ensure that it responds to an erasure request without undue delay and within one month of receipt.
    The right to erasure does not apply to Swindon Academy of Dance legal obligations such as First Aid records.
  • Restrict Processing
    You may contact Swindon Academy of Dance at any time to restrict the data it processes relating to you. Swindon Academy of Dance will ensure that it responds to a request to restrict processing without undue delay and within one month of receipt.
    However, due to our legitimate interest and legal obligations in most of the data collected- it may not be able to restrict processing.
  • Data Portability
    You may contact Swindon Academy of Dance at any time to obtain the data it processes relating to you and reuse it across different services. Swindon Academy of Dance will ensure that it responds to a request to restrict processing without undue delay and within one month of receipt.
    Please note, this does not apply to Swindon Academy of Dance’s legal obligations.
  • Objection
    You may contact Swindon Academy of Dance at any time to object to the processing of data relating to you. Swindon Academy of Dance will ensure that it responds to a request to restrict processing without undue delay and within one month of receipt.However, due to our legitimate interest and legal obligations in most of the data collected- it may not be able to accept your objection.
  • Rights related to automated decision-making including profiling
    You may contact Swindon Academy of Dance at any time in order to object to profiling relating to you. Swindon Academy of Dance will ensure that it responds to a request to restrict processing without undue delay and within one month of receipt.
    Please note, this does not apply to Swindon Academy of Dance’s legal obligations.
    Swindon Academy of Dance has a lawful reason for profiling; Legitimate Interests and consent.
    None of Swindon Academy of Dance’s decision making is automated.

Any written and all verbal requests are noted, and then contacted again either via phone or email to verify the request. Verbal requests will be responded to in the time frames mentioned above.

Third Parties/Data Processors:

Swindon Academy of Dance does not actively share data with third parties, however there are certain instances where sharing information is crucial to business processes.

HMRC/Police:

In the instance it is believed a donation to be part of a money laundering operation, Swindon Academy of Dance has a legal obligation to provide data to the parties.

Training and Data Protection in Practise

All members of staff (PAYE, Freelance and Voluntary) must agree to this Data Protection policy prior to accepting a contract of employment.

Training is supplied as part of management and supervision. It is also included in all induction and training periods.

Swindon Academy of Dance is registered as a Data Controller with the Independent Commissioners Office (ICO). The registered Data Protection Officer Sarah Hamilton-Gill is Principal of Swindon Academy of Dance, swaofdance@gmail.com

Complaints and Data Breeches
Complaints:

Complaints regarding the handling of any personal data can be made directly to Swindon Academy of Dance’s DPO: Safeguarding Officer, Yasmin Kardasz.
Email: swaofdance@gmail.com

If you feel that your complaint was not handled in the correct manner, or still have concerns, you may escalate the complaint by contacting the Independent Commissioner’s Office (ICO). ICO Telephone Number: 0303 123 1113

Data Breeches:

If Swindon Academy of Dance experiences a data breech of any kind, it has a legal obligation to report this to ICO within 72 hours. The data breech will be reported by the DPO. In the instance they are unavailable to report the breech, the next most senior staff member shall do so.

Swindon Academy of Dance will also inform all the victims of the data breach as soon as possible if there is a high risk of adversely affecting individuals’ rights and freedoms.
Swindon Academy of Dance will store and record all data breaches.