iRock School of Music Privacy Policy

Last review: 23rd November 2022 iRock School of Music (“We”, “Us”, “Our”) is committed to protecting your privacy. This policy explains how we safely and securely processing their data in accordance with all our legal obligations. We have a legal duty to protect personal information that we collect under the data protection act 2018 and the UK General Data Protection Regulation.

This privacy policy applies to our use of all Data collected by us and describes the way we use any personal information about: • Customers • Potential Customers • Visitors to our website • Job applicants • School contacts • Suppliers • Participants of our classes • Professional contacts

We have a legal duty to protect personal information that we collect under the data protection act 2018 and the UK General Data Protection Regulation. For purposes of the applicable Data Protection Laws, iRock School of Music is the "data controller". This means that iRock School of Music determines the purposes for which, and the manner in which, your Data is processed.

1. What information do we collect? We may collect the following Data, which includes personal Data, from you: • Your name; • Date of birth; • Job title; • profession; • Contact Information such as email addresses and telephone numbers; • Your payment details; • Your child's name; • Your child's school; • Your child's age; • Your child's medical information; • You preferences (Such as instrument choice); • Your child's attendance history; • Recordings of your child participating in our services (Only when we a permitted to do so); • Your account details (If you create a parent account); • Your purchase history; • Records of communication (For example, emails, telephone calls); • Information about your visit to our website; • Your CV and/or application form (If you apply for a job); • Your address; • References ; • DBS check results; • Your right to work; • The organisation you work for; • Any information you have chosen to supply us via our website, email or over the phone;

Recordings When your child attends our sessions, with your consent we may film, photograph, or record your child’s performance as a part of their educational experience. With your permission we will share a pre-recorded video or photo with the school or other parents in your child’s band through our online portal. You can withdraw your consent for recording at any time by contacting us using the contact details set out in section10.

We must obtain separate consent to use any recording as part of our marketing purposes. Recordings of an iRock lesson for safeguarding or training purposes will only be retained for 28 days unless we identify an issue or training opportunity in which case recordings will be kept for a longer period depending on how long we need to retain them.

2. Data that is given to us by you iRock School of Music will collect your Data in a number of ways, for example: • When you contact us through the Website, by telephone, post, e-mail or through any other means; • When you register with us and set up an account to receive our products/services; • When you complete surveys that we use for research purposes (although you are not obliged to respond to them); • When you enter a competition or promotion through a social media channel; • When you make payments to us, through this Website or otherwise; • When you elect to receive marketing communications from us; • When you use our services; • When we receive information about your child for their school

3. How do we use your personal data? To provide you with the best possible service and experience when using our services or website. Specifically, personal data may be used by us for the following reasons: • Internal record keeping • For administrative and business purposes • To complete certain tasks • Communicate with your regarding services your purchase or request • improvement of our products / services • Tell you about relevant products, services or offers.

• Contact for market research purposes which may be done using email, telephone, or mail. Such information may be used to customise or update the Website. • To record sessions involving your child for consumption within a secure access platform accessible via our online portal which is made available to other customers in your child’s band. • To record sessions for training or safeguarding purposes. • Monitor the use of our website • To ensure personal and financial information you provide is accurate. • To manage risk for the company and our customers • To fulfil our legal obligations

Legitimate Interest We may use your Data for the above purposes if we deem it necessary to do so for our legitimate interests. Where we rely on legitimate interest, we will always balance these interests with your rights. you have the right to object in certain circumstances (see the section headed "Your rights" below).

4. Who we share data with There are occasions when it is necessary for iRock to share data with trusted third-party providers in order for us to provide services to you. We will never sell your personal data to a third part. We may share you data to the following groups of people for the following reasons: • Schools to provide them with your child’s timetable • Trusted providers who carry out services on our behalf such as payment providers and hosting providers for our database • Relevant authorities to facilitate the detection of crime or other illegal activity • Insurance providers For further information, access the website of the ico: https://ico.org.uk/

5. Changes of business ownership and control iRock School of Music may, from time to time, expand or reduce our business and this may involve the sale and/or the transfer of control of all or part of iRock School of Music. Data provided by Users will, where it is relevant to any part of our business so transferred, be transferred along with that part and the new owner or newly controlling party will, under the terms of this privacy policy, be permitted to use the Data for the purposes for which it was originally supplied to us. • We may also disclose Data to a prospective purchaser of our business or any part of it. • In the above instances, we will take steps with the aim of ensuring your privacy is protected.

6. Retention and disposal of information iRock will retain information about you for as long as is reasonable and necessary to comply with the law and for legitimate business needs. This means retention periods will vary according to the type of personal information.

7. Data Security iRock takes the risk to security loss very seriously and adheres to the legal framework set down by the Information Commissioner’s Office and industry standards. Notification of breaches – if appropriate iRock will inform a Data Subject about an information security breach, the ICO; (and if in doubt will consult) other regulatory bodies; other third parties such as the police and the banks; or the media.

8. Your rights You have the following rights in relation to your Data • Right to access - the right to request (i) copies of the information we hold about you at any time, or (ii) that we modify, update or delete such information. If we provide you with access to the information we hold about you, we will not charge you for this, unless your request is "manifestly unfounded or excessive." Where we are legally permitted to do so, we may refuse your request. If we refuse your request, we will tell you the reasons why. • Right to correct - the right to have your Data rectified if it is inaccurate or incomplete. • Right to erase - the right to request that we delete or remove your Data from our systems. • Right to restrict our use of your Data - the right to "block" us from using your Data or limit the way in which we can use it. • Right to data portability - the right to request that we move, copy or transfer your Data. • Right to object - the right to object to our use of your Data including where we use it for our legitimate interests.

To make enquiries, exercise any of your rights set out above, or withdraw your consent to the processing of your Data (where consent is our legal basis for processing your Data), please contact us via this e-mail address: [email protected]. If you are not satisfied with the way a complaint you make in relation to your Data is handled by us, you may be able to refer your complaint to the Information Commissioner's Office (ICO). The ICO's contact details can be found on their website at https://ico.org.uk/. It is important that the Data we hold about you is accurate and current. Please keep us informed if your Data changes during the period for which we hold it.

9. Changes to this policy iRock School of Music reserves the right to change this privacy policy as we may deem necessary from time to time or as may be required by law. Any changes will be immediately posted on our website or where appropriate emailed to you. 10. Contacting Us If you have any questions, comments, or concerns please contact us on the following details: Address: Wellesley House, 10 Eelmoor Road, Farnborough, GU14 7QN, United Kingdom Email: [email protected] Telephone: 0330 174 2655