GENERAL DATA PROTECTION REGULATION
GDPR stands for General Data Protection Regulation and replaces the previous Data Protection Act 1998
Directives that were in place. It was approved by the EU Parliament in 2016 and comes into effect on 25th May 2018.
GDPR states that personal data should be ‘processed fairly & lawfully’ and ‘collected for specified, explicit and legitimate purposes’ and that individuals data is not processed without their knowledge and are only processed with their ‘explicit’ consent. GDPR covers personal data relating to individuals. Knight School of Dance Ltd. is committed to protecting the rights and freedoms of individuals with respect to the processing of pupil’s (adult and child), parents, and volunteers, visitors and staff personal data.
The Data Protection Act gives individuals the right to know what information is held about them. It provides a framework to ensure that personal information is handled properly.
For the purposes of the data protection laws (including the Data Protection Act 1998, the EU General Data Protection Regulation (EU Regulation 2016/679) coming into effect on 25 May 2018 and the Data Protection Bill 2017) Knight School of Dance Ltd are the ‘data controller’. The controller holds and uses your data (referred to as ‘processing’ under the data protection laws).
This policy covers any personal data that is collected and describes how this data is collected, handled and stored.
GDPR includes 7 rights for individuals:
1) The right to be informed
Knight School of Dance Ltd (KSD) is a registered dance and acrobatics provider with Royal Academy of Dance (RAD), Imperial Society of Teachers of Dancing and Acrobatic Arts and as so, is required to collect and manage certain data.
Personal information or data is information which relates to an individual who can be identified from that data. Personal data includes (but is not limited to) an individual’s name, address, date of birth, telephone numbers, email addresses and other information that identifies them.
The type of information collected and stored by Knight School of Dance Ltd. for staff, pupils (adult and child), parents and volunteers and the purposes it will be used for includes:
- Date of birth
- Telephone numbers
- Email addresses
- Emergency contacts
- Medical and SEN information
- Ethnic group (for exam entry)
- We need to know parent’s names, addresses, telephone numbers, email addresses to keep pupils and parents informed to subjects relating to KSD activities and procedures. We are requested to provide a selection of data to Local Authorities when parents and adults perform chaperone duties.
- We need to know a child’s full name, addresses, date of birth and any SEN requirements, medical or disability information to ensure needs are met. We are requested to provide a selection of data to Local Authorities for performance BOPA licences, and Dance Associations for examinations when a pupil’s ethnic group is requested. Passport or driving license numbers are required for Vocational Examination entry and will be collected at the time of entry. Iinformation is sent via a secure electronic file transfer system.
- We are required to collect certain details of visitors to KSD. We need to know visitors names, telephone numbers, and where appropriate company name. This is in respect of our Health and Safety and Safeguarding Policies.
- Photographs and video footage of participants taken by Knight School of Dance Ltd. may be used for teaching aids, publicity and marketing purposes and used in flyers, posters and social media. Images posted by Knight School of Dance Ltd. on the website, Facebook and Instagram will not identify anyone.
- Relatives will be permitted to film and take photographs at classes. Verbal permission will be sought at the beginning of a class and requested that images MUST be purely for personal use.
- DISCLOSING DATA FOR OTHER REASONS. In certain circumstances, the Data Protection Act allows personal data to be disclosed to law enforcement and other agencies without the consent of the data subject. Under these circumstances Knight School of Dance Ltd. will disclose requested data. However, the data controller will ensure the request is legitimate.
A cookie stores small amounts of information on your computer or device to allow certain information from your web browser to be collected.
Overall cookies help to make it easier for you to log on and use the site. A cookie will not give us access to your computer or device or any information about you, other than data you choose to share with us.
- Bank details - Information of bank transfer transactions are kept in paper form on bank statements and viewed electronically through online banking services with are GDPR compliant. Data may also be shared with our UK based Accountant - for instance, payment information - to meet legal obligations
2) The right of access
At any point an individual can make a request relating to their data and KSD will need to provide a response (within 1 month). KSD can refuse a request, if we have a lawful obligation to retain data but we will inform the individual of the reasons for the rejection. The individual will have the right to complain to the ICO if they are not happy with the decision.
3) The right to erasure
You have the right to request the deletion of your data where there is no compelling reason for its continued use. However KSD has a legal duty to keep an individual’s details for a reasonable time and so will retain these records for 3 years after leaving.
In respect of child pupils, accident and injury records can be kept for 19 years or until a child reaches 21 years) and 22 years (or until a child reaches 24 years) for Child Protection records.
In respect of adult pupils, accident and injury records can be kept for 19 years.
Staff records must be kept for 6 years after the member of leaves employment, before they can be erased. This data is archived securely and shredded or deleted after the legal retention period.
4) The right to restrict processing
Parents, visitors and staff can object to KSD processing their data. This means that records can be stored but must not be used in any way, for example reports or for communications.
5) The right to data portability
KSD requires data to be transferred to certain third parties, from one IT system to another; such as from KSD to the Local Authorities, for performance BOPA licences, chaperone duties, and Dance Associations for examinations. These recipients use secure file transfer systems and have their own policies and procedures in place in relation to GDPR.
Those third parties may also disclose your personal data to any sub-processors that they engage in order to provide services to the KSD.
6) The right to object
Parents, visitors and staff can object to their data being used for certain activities like marketing or research.
7) The right not to be subject to automated decision-making including profiling.
Automated decisions and profiling are used for marketing based organisations. KSD does not use personal data for such purposes.
Storage and use of personal information
All paper copies of pupils, parents and staff records are kept in a locked filing cabinet at the Principal’s address. Members of staff can only have access to these files when necessary (e.g. for shows and special events) but information taken from the files about individual children is confidential and records remain on site at all times. These records are shredded after the retention period.
Information about an individual pupil is used in certain documents, such as, a weekly register, medication forms, referrals to external agencies and disclosure forms. These documents include data such as pupil name, date of birth and sometimes address. These records are shredded after the relevant retention period.
Paper registers taken to the studio will include a pupil’s name and emergency contact telephone number. These will be kept in a locked case at the studio and in a locked room at the Principal’s address.
KSD collects an amount of personal data every year including; names and addresses of those on the waiting list. These records are shredded if the pupil does not attend or added to the pupil’s file and stored appropriately.
Access to the office computer, school mobile phone and iPad is password protected. Any portable data storage used to store personal data, e.g. USB memory stick, are password protected and/or stored in a locked filing cabinet. All servers and computers containing data, e.g. email addresses will be protected by approved security software and firewall.
GDPR means that Knight School of Dance Ltd must;
* Manage and process personal data properly
* Protect the individual’s rights to privacy
* Provide an individual with access to all personal information held on them
How to contact KSD
By email to: firstname.lastname@example.org
In writing to: 11 Kingfisher Drive, Yateley, Hampshire, GU46 6NP
Where you are dissatisfied with any aspect of our handling of your personal data you have a right to lodge a complaint with the Information Commissioner's Office. Their contact telephone number is 0303 123 1113.