Oct 16, 2019 03:34 AM
Privacy at Edinburgh Dance School
You are able to access and control all the information we hold for you by signing into your 'parent portal' at https://dancestudio-pro.com/online/edinburghdanceschool. There you can access your account and view / amend this data, including the new 'Right To Be Forgotten' setting.
Who We Are
The Edinburgh Dance School & Learn 2 Wedding Dance[ hereafter collectively known as "EDS"] is a Dance school in Edinburgh providing tuition in Dance, Drama and Music for children from 2½ to 16 years old and adults.
EDS opened in 2003 and is managed by the school Principal, Mrs Felicity Drever-Mclean.
EDS main office is located at EDStudio, 132 Captains Road, edinburgh, EH17 8DU and it is at this address that you can contact our Data Controller should you have any queries about how we use the data we gather.
About this Privacy Notice
At EDS your privacy is important and we will treat any personal information you provide in accordance with the General Data Protection Regulation (EU 2016/679) and the UK Data Protection Act 2018.
This policy is intended to provide information about how Edinburgh Dance School will use (or "process") personal data about individuals including: their staff; their current, past and prospective pupils; and their pupils’ parents, carers or guardians (referred to in this policy as "parents").
This information is provided, in accordance with the rights of individuals under Data Protection Law, to help you understand how your data is used. Staff, parents and pupils are encouraged to read this Privacy Notice and understand EDS obligations, as a "data controller", to their entire community.
This Privacy Notice applies alongside any other information EDS may provide about the use of personal data, for example when collecting data via an online or paper form.
This Privacy Notice also applies in addition to EDS's relevant terms and conditions and policies, including:
the Data Protection policy for staff;
the Health and Safety policy;
the Security policy;
ICT policies, including the Acceptable Use (Computers) policies
any contract between EDS and staff or the parents of pupils, including the Enrolment Document;
the policy on Taking, Storing and Using Images of Children;
the CCTV policy;
the Retention of Records policy;
the Child Protection policy;
Anyone who works for or acts on behalf of EDS (including staff, volunteers and service providers) should also be aware of, and comply with, this Privacy Notice and EDS Data Protection Policy for staff, which also provides further information about how personal data is used.
Responsibility for Data Protection
Edinburgh Dance School has appointed a Data Controller ("DC") who will fulfil his/her role as required by Data Protection Law.
The DC can be contacted by emailing email@example.com or by writing to Edinburgh Dance School, 132 Captains Road, Edinburgh, EH17 8DU.
Why Edinburgh Dance School Needs to Process Personal Data
As part of their daily operations, and in order to carry out their ordinary duties to pupils, parents and staff, EDS may process a wide range of personal data about individuals (including current and prospective staff, pupils or parents).
Some of this activity is carried out so that the EDS can fulfil their legal rights, duties or obligations – including those under a contract with staff, or parents of their pupils.
Other uses of personal data will be made in accordance with EDS legitimate interests, or the legitimate interests of another, provided that these are not outweighed by the impact on individuals, and provided it does not involve special or sensitive types of data.
EDS expect that the following uses may fall within the category of their or their community’s ‘legitimate interests’:
For the purposes of pupil enrollment(and to confirm the identity of prospective pupils and their parents);
To provide education services, including dance training, music and drama education and extra-curricular activities to pupils, and monitoring pupils' progress;
Maintaining relationships with the school community, including direct marketing or fundraising activity;
For the purposes of management planning and forecasting, research and statistical analysis, including that imposed or provided for by law (such as diversity or gender pay gap analysis and taxation records);
To enable relevant authorities to monitor the performance of EDS and to intervene or assist with incidents as appropriate;
To safeguard pupils' welfare and provide appropriate pastoral care;
To monitor (as appropriate) use of EDS IT and communications systems in accordance with the Acceptable Use (Computers) Policy;
To make use of photographic and video recorded images of pupils internally in school publications, and on the Schools intranets in accordance with the policies on taking, storing and using images of children.
To make use of photographic and video recorded images of pupils externally, online and in print, for example in newspapers or magazines, on the EDS website and official social media channels for marketing purposes or to celebrate the achievements of pupils and in accordance with EDS policies on taking, storing and using images of children and use of social media;
For security purposes, including CCTV in accordance with EDS’ CCTV policy; and
Where otherwise reasonably necessary for EDS purposes, including to obtain appropriate professional advice and insurance for the School.
How Long We Keep Personal Data
The Schools will retain personal data securely and only in line with how long it is necessary to keep for a legitimate and lawful reason. Typically, the legal recommendation for how long to keep ordinary staff and pupil personnel files is up to 7 years following departure from the Schools.
If you have any specific queries about how this policy is applied, or wish to request that personal data which you no longer believe to be relevant is considered for erasure, please contact the DC at firstname.lastname@example.org.However, please bear in mind that EDS may have lawful and necessary reasons to hold on to some personal data even following such a request.
A limited and reasonable amount of information will be kept for archiving purposes, for example; even where you have requested we no longer keep in touch with you, we will need to keep a record of the fact in order to fulfil your wishes (called a "suppression record").
Special Category Personal Data
In addition, EDS may need to process special category personal data (concerning health, ethnicity, religion, or sexual life) or criminal records information (such as when carrying out Disclosure Scotland checks) in accordance with rights or duties imposed on it by law, including as regards safeguarding and employment, or from time to time by explicit consent where required. These reasons will include:
To safeguard pupils' welfare and provide appropriate pastoral (and where necessary, medical) care, and to take appropriate action in the event of an emergency, incident or accident, including by disclosing details of an individual's medical condition or other relevant information where it is in the individual's interests to do so: for example, for medical advice, for social protection, safeguarding and cooperation with police or social services, for insurance purposes or to caterers or organisers of EDS trips who need to be made aware of dietary or medical needs;
To provide educational services in the context of any special educational needs of a pupil;
In connection with employment of their staff, for example Disclosure Scotland checks;
As part of any school or external complaints, disciplinary or investigation process that involves such data, for example if there are SEN, health or safeguarding elements; or
For legal and regulatory purposes (for example child protection, diversity monitoring and health and safety) and to comply with their legal obligations and duties of care.
Types of Personal Data - This will include by way of example:
names, addresses, telephone numbers, email addresses and other contact details;
where appropriate, information about individuals’ health, and contact details for their next of kin;
images of pupils (and occasionally other individuals including staff and parents) engaging in school activities, and images captured by the EDS CCTV system (in accordance with EDS policies on the use of CCTV, taking, storing and using images of children and social media);
How EDS Collect Data
Generally, EDS receive personal data from the individual directly (including, in the case of pupils, from their parents). This may be via a form, online submission through the EDS websites, or simply in the ordinary course of interaction or communication (such as email).
Who Has Access to Personal Data and Who EDS Share It With
For the most ersonal data collected by EDS will remain within EDS and will be processed by appropriate individuals in accordance with access protocols (i.e. on a ‘need-to-know’ basis). Particularly strict rules of access apply in the context of:
medical records held and accessed only by appropriate staff or those under their supervision, or otherwise in accordance with express consent; and
pastoral or safeguarding files.
Keeping in Touch and Supporting EDS
EDS will use the contact details of parents and other members of the school community to keep them updated about the activities of EDS and parent events of interest, including by sending updates and newsletters, by email and on ocassion text.
Should you wish to limit or object to any such use, or would like further information about it, please contact the DC at email@example.com. You always have the right to withdraw consent, where given, or otherwise object to direct marketing. However, EDS are nonetheless likely to retain some of your details (not least to ensure that no more communications are sent to that particular address, email or telephone number).
Data Accuracy and Security
EDS will endeavour to ensure that all personal data held in relation to an individual is as up- to-date and accurate as possible. Individuals must notify EDS of any significant changes to important information, such as contact details, held about them.
An individual has the right to request that any out-of-date, irrelevant or inaccurate information about them is erased or corrected (subject to certain exemptions and limitations under Data Protection Law): please see above for details of why EDS may need to process your data, and whom you may contact if you disagree.
EDS will take appropriate technical and organisational steps to ensure the security of personal data about individuals, including policies around the use of technology and devices, and access to EDS systems. All staff will be made aware of these policies and their duties under Data Protection Law and will receive relevant training.
Rights of Access
Individuals have various rights under Data Protection Law to access and understand personal data about them held by EDS, and in some cases, ask for it to be erased or amended or have it transferred to others, or for EDS to stop processing it - but subject to certain exemptions and limitations.
Any individual wishing to access or amend their personal data, or wishing it to be transferred to another person or organisation, or who has some other objection to how their personal data is used, should contact the DC at firstname.lastname@example.org.
EDS will endeavour to respond to any such written requests as soon as is reasonably practicable and in any event within the statutory timelimits (14 days in the case of requests for access to information).
Requests that cannot be fulfilled
You should be aware that the right of access is limited to your own personal data, and certain data is exempt from the right of access. This will include information which identifies other individuals (and parents need to be aware this may include their own children, in certain limited situations – please see further details below), or information which is subject to legal privilege (for example legal advice given to or sought by the school, or documents prepared in connection with a legal action).
EDS are also not required to disclose any pupil examination, medal test or grading information, nor share any confidential reference given by EDS themselves for the purposes of training or employment of any individual.
However, we will sometimes have compelling reasons to refuse specific requests to amend, delete or stop processing your (or your child's) personal data: for example, a legal requirement, or where it falls within a legitimate interest identified in this Privacy Notice. All such requests will be considered on their own merits.
Pupils can make subject access requests for their own personal data, provided that, in the reasonable opinion of EDS, they have sufficient maturity to understand the request they are making (see section ‘Whose Rights?’ below). A pupil of any age may ask a parent or other representative to make a subject access request on his/her behalf.
Indeed, while a person with parental responsibility will generally be entitled to make a subject access request on behalf of younger pupils, the law still considers the information in question to be the child's: for older pupils, the parent making the request may need to evidence their child's authority for the specific request.
It should be clearly understood that the rules on subject access are not the sole basis on which information requests are handled. Parents may not have a statutory right to information, but they and others will often have a legitimate interest or expectation in receiving certain information about pupils without their consent. EDS may consider there are lawful grounds for sharing with or without reference to that pupil.
Parents will in general receive progress updates about their children, in accordance with the parent contract. Where parents are separated, the school will aim to provide information to each parent or legal guardian with parental responsibility, in accordance with choices indicated in the parent contract, but may need to factor in all the circumstances, including the express wishes of the child.
Where the Schools are relying on consent as a means to process personal data, any person may withdraw this consent at any time (subject to similar age considerations as above). Examples of when we do rely on consent are: certain uses of images, certain types of fundraising activity. Please be aware however that EDS may not be relying on consent but have another lawful reason to process the personal data in question even without your consent.
That reason will usually have been asserted under this Privacy Notice, or may otherwise exist under some form of contract or agreement with the individual).
Rights under Data Protection Law belong to the individual to whom the data relates. However, EDS will often rely on parental authority or notice for the necessary ways they process personal data relating to pupils – for example, under the parent contract, or via a form. Parents and pupils should be aware that this is not necessarily the same as EDS relying on strict consent (see section on Consent above).
Where consent is required, it may in some cases be necessary or appropriate – given the nature of the processing in question, and the pupil's age and understanding – to seek the pupil's consent. Parents should be aware that in such situations they may not be consulted, depending on the interests of the child, the parents' rights at law or under their contract, and all the circumstances.
In general, EDS will assume that pupils’ consent is not required for ordinary disclosure of their personal data to their parents, e.g. for the purposes of keeping parents informed about the pupil's activities, progress and behaviour, and in the interests of the pupil's welfare. That is unless, in the opinion of EDS, there is a good reason to do otherwise.
However, where a pupil seeks to raise concerns confidentially with a member of staff and expressly withholds their agreement to their personal data being disclosed to their parents, EDS may be under an obligation to maintain confidentiality unless, in EDS opinion, there is a good reason to do otherwise; for example, where EDS believe disclosure will be in the best interests of the pupil or other pupils, or if required by law.
Pupils are required to respect the personal data and privacy of others. Staff are under professional duties to do the same, covered under the Acceptable Use (Computers) Staff policy, Data Protection Policy, policy on taking, storing and using images of children and Social Media Policy.
The Schools will update this Privacy Notice from time to time. Any substantial changes that affect your rights will be provided to you directly as far as is reasonably practicable.
Queries and Complaints
Any comments or queries on this policy should be directed to the Data Controller by writing to him/her at EDStudio, 132 Captains Road, Edinburgh, EH17 8DU.
If an individual believes that EDS have not complied with this policy or acted otherwise than in accordance with Data Protection Law, they should utilise EDS complaints procedure and should also notify the DC.
Name of company
Edinburgh Dance School
132 Captains Road
Edinburgh EH17 8DU