NCD PRIVACY AND GDPR POLICY 

NCD is committed to protecting your personal information. We provide a safe environment for all our customers, employees, casual and freelance workers and everybody who meets us, both physically and virtually (online). This Privacy Statement relates to the use of any personal information provided to us online or via application forms, telephone, email exchange, letters or correspondence.  

Whenever you provide such information, we are legally obliged to use your information in line with current legislation concerning the protection of personal information, including the General Data Protection Regulations (GDPR) and UK Data Protection Act 2018. 

The NCD website contains hyperlinks to websites owned and operated by third parties, such as Classmanager, Stripe, Facebook and Instagram. These third-party websites have their own privacy policies, and are also likely to use cookies, and we therefore urge you to review them. We do not accept any responsibility or liability for the privacy practices of such third-party websites and your use of such websites is at your own risk.  

DATA PROTECTION PRNCIPLES 

The legislation sets out various data protection principles that include personal. That information is: 

·      Used fairly and lawfully 

·      Used for limited, specifically stated purposes 

·      Used in a way that is adequate, relevant and not excessive 

·      Accurate 

·      Kept for no longer than is absolutely necessary 

·      Kept safe and secure 

·      Not transferred outside the European economic area without adequate protection 

YOUR RIGHTS 

The legislation conveys various individual rights. These include the following: 

·      The right to be informed 

·      The right of access 

·      The right to rectification 

·      The right to erase 

·      The right to restrict processing 

·      The right to data portability 

·      The right to object 

·      Rights in relation to automated decision making and profiling 

WHAT INFORMATION DOES NCD HAVE ABOUT ME?  

The legislation requires that there is a clear legal basis for processing personal information. In general, NCD relies on the individual’s consent in order to process their data. 

When you participate in or sign up to any of NCD Youth or Adult classes, activities and workshops we may collect and store personal information about you. Depending on how you are engaging with us this can consist of information such as:  

·      Your name 

·      Email address 

·      Postal address 

·      Telephone or mobile number 

·      Date of birth 

·      Medical conditions (within reason) 

·      Contact preferences 

·      Emergency contact details 

·      Your child’s details if they attend NCD – name, age, D.O.B, address, medical/healthneeds and emergency contact details. 

By submitting your details, you enable us to provide you with the information regarding the services that you have selected and provide a safe teaching environment.  

When taking pictures or filming classes, workshops etc, NCD ask for permission from those present and ask for parental consent for our students. NCD may use the images or footage resulting from the photography/video filming, and any reproductions or adaptions of the images for publicity, marketing, promotion, fundraising or other purposes to help achieve the group’s aims. This might include (but is not limited to) the right to use them in printed and online publicity, social media forums and press releases. 

WHAT ARE COOKIES?  

Cookies are text files that websites store on your computer to hold information tailored to your preferences. Our website utilizes cookies to enhance your browsing experience. You have the option to tailor your cookie preferences but do keep in mind that this may impact your browsing experience. 

HOW WILL WE USE YOUR INFORMATION? 

We will use your information for a number of purposes including:   

·      To provide you with information about our products, services and activities and to deal with your requests and enquiries, including complaints. 

·      For "service administration purposes", which means that we may contact you for reasons related to the service or activity you signed up for (e.g. invoices, or change of details regarding a class you are enrolled in, etc) 

·      To contact you about an application you have made, to process your application for employment and where applicable your employment once appointed. 

·      To complete, send or post any relevant examination documents. 

·      Weekly registers, medication and health forms. 

All documents are shredded after the relevant retention period. 

NCD stores personal data held visually in photographs or video clips or as sound recordings. Parental consent is obtained upon registration via the STUDENT ENROLLMENT/CONTACT INFORMATION FORM and parents are asked to give consent by filling out and submitting that form. No names are stored with images in photo albums, displays, on the website or on NCD social media platforms. A child’s first name will only be mentioned with parental consent and in the instance of exam results and achievements. 

Access to the NCD computer and Class Manager databases are password protected. When a teacher leaves NCD their access to such databases will be removed, in line with our Safeguarding Policy.  

Any portable data storage used to store personal data e.g., a memory stick is password protected and stored in a locked filing cabinet. 

As and when we need to use your personal information for in reasons other than the ones specified above, we would ensure that we notify you first. You will be given the opportunity to withhold or withdraw your consent for the use of your personal information for purposes other than those listed above. NCD does NOT share your personal information with any third parties for marketing purposes. We do NOT sell your data, and neither do we buy data from third parties.  

USE OF DATA PROCESSORS 

Data processors are third parties who provide services for us, and we have contracts in place with ours. This means they cannot do anything with your personal information. They will not share your personal information with any organisation apart from us. They hold it securely and retain it for the period we instruct. All data processors must comply with current GDPR regulations and legislation. We do not transfer any personal data to countries outside of the European Economic Area (EEA).  

The following is a list of our main data processors. 

WEBSITE HOSTING 

We use a third-party service WordPress to host our website. WordPress are contractually obliged to treat any information on our private website as confidential and only such use of information for the purpose of providing NCD with web hosting. Customers have the option to sign up for our newsletter. For more information, please visit https://automattic.com/privacy/ 

PARENT ENROLMENTS FOR CHILDRENS DANCE CLASSES 

We use a third-party service, Classmanager software to store your and your child’s information and use it for administrative purposes such as timetables, registers, emailing and invoicing customers. For further information please visit https://classmanager.com/privacy/  https://classmanager.com/gdpr/ 

ADULT BOOKINGS 

We use a third-party service, software to store your information and use it for administrative purposes such as class bookings, registers, client contact, deliver a service you have signed up for and payments via Stripe. For further information please visit  

NCD may contact you in relation to any service or activity you have signed up for in order to ensure that we can deliver the services to you, to remind you of important deadlines and/or renewal notifications, in relation to any correspondence we receive from you or any comment or complaint you make about our services and to occasionally market products or services that we think may be of interest to you. We will not hold more information than is required and will ensure all personal data is kept up to date and used only for its specific purpose(s).  

WHAT IF I DO NOT WANT DATA STORED OR CONTACTED REGARDING PRODUCTS, SERVICES OR EVENTS?  

You have the right to ask us not to hold or use personal data however this would mean we may not be able to provide you with the full range of services available. You may opt-out of any personal data being stored and must give consent to any correspondence you wish to receive from NCD. Should you decide to opt-out of any data storage you must:  

·      Stay on the premises during all classes in case of an emergency. Your child will not be able to be entered for any examination or participate in any productions, as we will not be able to process the appropriate candidate information.  

Please note consent is not required for us to email regarding the class you are enrolled in (invoices, updates, cancellations etc) or regarding any enquires you may have contacted the school about as these fall under legitimate interest (please see next point).  

LEGITIMATE INTEREST 

We may hold or use personal data on the grounds of ‘legitimate interest’. In simple terms this means we can process personal information if we have a genuine and legitimate reason and we are not harming any of your rights and interests. This includes information we are legally required to store even after a request to be forgotten. Names and postal address related to invoices (MUST be kept as it is required for HMRC legal tax purposes). Medical information is sensitive data and held on the grounds of legitimate interest. This data will only be processed and stored by NCD when completely relevant to ensure yours or your child’s safety whilst participating in our services or activities. This data will be erased after request to be forgotten, or at any time if it becomes irrelevant. 

YOUNG PEOPLE  

If you are under 18 and you provide us with information on an application form (online or printed), your parent(s)/guardian(s) permission will be required. If taking part in an NCD adult class, the parent must be present (under 16yrs) or complete a parent consent form for the child to join in the class (16yrs+). 

TAKING, STORING AND USING IMAGES OF STUDENTS 

Certain uses of images are necessary for publicising and updating other parents of NCD services and activities. Parental consent is always required when enrolling in NCD before any photograph can be taken, stored or used. Parents will be given the option in the STUDENT ENROLLMENT/CONTACT INFORMATION FORM to give consent for the school to take still or moving images and to use them in terms of marketing the school on: 

·      Our website 

·      Facebook page 

·      Instagram 

·      Flyers and posters 

·      Or internally for progress tracking 

If consent is given for a still or moving image of your child to be used for any of the external marketing purposes, please be informed that these are public domains and can be viewed by anyone. Should an image be used in any marketing publication, website or social media site there will be no use of names alongside images other than in special circumstances (such as further dance studies, or other achievements). In these very special cases parental consent will be asked, and NCD and will only ever use a first name to protect privacy. Any images are only taken on devices belonging to the school and stored by NCD electronically on a secure computer system and phone. Any folder containing stored images has restricted access and held in password protected folders. At any time, consent can be withdrawn to the taking, storing or use of images by contacting [email protected] 

HOW LONG WILL NCD KEEP MY PERSONAL INFORMATION?  

We use secure technologies to help protect your personal information from unauthorised access, use of disclosure. As advised, we store personal information you provide on computer systems, which have carefully controlled access, and which are located in secure facilities. 

We keep the information we hold about our customers and students for as long as is necessary to deliver the services we are providing you with. If your child has completed any National Association of Teachers of Dancing examinations whilst at the school, we will store all exam results. This will include your child’s name, NATD ID number (as appointed by the NATD examinations board), date of any exam(s) and your child's result. This data will also be stored offline in a password protected, and encrypted file.  

The security measures described above ensure that all reasonable steps are taken to protect your personal information. However, the nature of the Internet means that absolute guarantee of security cannot be offered and as with all Internet transactions, you should be aware that there might be a small security risk when disclosing information online. 

WHERE IS THE INFORMATION STORED? AND HOW IS IT PROTECTED?  

NCD use a variety of procedures and secure technologies to help protect your personal information from unauthorised access, use or disclosure. We store personal information you provide to us on a secure, password protected, database only accessed on our secure computer system, and by app on secured mobile devices all of which have controlled access. Data is stored on services provided by trusted third party providers, as outlined above, which  

we have entered into data processing agreements with. Your information will not be shared with any other service providers or organisations apart from us. All data will only be used for the agreed purpose relating to the service that they are providing.  

YOUR RIGHTS  

When asked to submit personal data for enrolment purposes there are several details expected for you to register with  Classmanger for the purposes of providing you with services from NCD. You have the right to change your preferences or opt-out of consent at any time by contacting [email protected] The accuracy of your personal data is important to us, and you hold the right to update any information held by us. Please help us keep our data records up to date by notifying us of any changes at [email protected] Under the General Data Protection Regulation you have the right to request full access to any personal information held about you, if you wish to make a Data Access Request or if you would like to request the right for NCD to delete any personal data stored about you, please contact [email protected] You must provide a description of what information you wish to see alongside proof of identity. If you ask for data to be removed, please note we may have a lawful reason to hold or use personal data, which does not require consent, such as on the grounds of legitimate interest. In this case we will keep the minimum amount of information required to ensure we adhere to your request.  

LEGAL OBLIGATION 

We may disclose your personal information to government agencies or entities, regulatory authorities, or other persons in line with any applicable law, regulations, court orders or official request. 

This policy was adapted and updated on October 1st, 2023, on behalf of NCD by: 

Naomi Czuba 

NCD Owner and Director 

Tel: 07773 202164 

Email: [email protected] 

This document’s next review is due October 2024 

GDPR   

GDPR Stands for General Data Protection Regulation and replaces the previous Data Protection Directives that were in place. It was approved by the EU Parliament in 2016 and came into effect on 25th May 2018. 

GDPR states that personal data should be ‘processed fairly and lawfully’ and ‘collected for specific, explicit, and legitimate purposes’ and that individual’s data is not processed without their knowledge and are only processed with their explicit consent. GDRP covers personal data relating to individuals. 

NCD is committed to protecting the rights and freedoms of individuals with respect to the processing of children’s, parents, clients, visitors and staff personal data. 

The Data Protection Act gives individuals the right to know what information is held about them. It provides the framework to ensure that personal information is handled properly. 

NCD is registered with the Information Commissioners Office  

GDPR INCLUDES 7 RIGHTS FOR INDIVIDUALS 

1.The Right to be Informed 

NCD is required to collect and manage certain data. We need to know client’s names, parent’s names, addresses, telephone numbers, email addresses and emergency contact details. We need to know children’s full names, addresses and date of birth along with any SEN or medical requirements. 

We are required to collect certain details of visitors and chaperones to our dance school and adult classes. We need to know visitors names, telephone numbers, and where appropriate company name. This is in respect of our Health and safety and Safeguarding Policies. 

Although our teachers are freelance, NCD is required to hold data on its teachers names, addresses, email addresses, telephone numbers, date of birth, national insurance numbers, bank details and in some cases photographic ID such as passport and drivers licence. Copies of teachers Disclosure and Barring Service (DBS) certificates are stored securely.  

2. The Right of Access 

At any point, an individual can make a request relating to their data and NCD will need to provide a response within 1 month. NCD can refuse a request, or if we have a lawful obligation to retain data, but we will inform the individual of the reasons for the rejection. The individual will have the right to complain to the Information Commissioners Office if they are not happy with the decision. 

3.The Right to Erasure 

You have the right to request deletion of your data where there is no compelling reason for its continued use.  

4. The Right to Restrict Processing 

Parents, visitors, clients and staff can object to NCD processing their data. This means that records can be stored but must not be used in any way, for example reports or for communications. 

5. The Right to Data Portability 

NCD requires data to be transferred from one IT system to another, such as child licence applications to the local authority for performances. These recipients use secure file transfer systems and have their own policies and procedures in place in relation to GDPR. 

6. The Right to Object 

Parents, visitors and clients can object to their data being used for certain activities like marketing or research. 

7. The Right Not to be Subject to Automated Decision-Making Including Profiling 

Automated decisions and profiling are used for marketing-based organisations. NCD does not use personal data for such purposes. 

This policy was adapted and updated on October 1st 2023 on behalf of NCD by: 

Naomi Czuba - Owner & Director 
 

Tel: 07773 202164 

Email: [email protected] 

If any significant changes that impact your rights are made, we will make every effort to communicate them directly to you as promptly as reasonably possible. 
 

Next update due on 1st October 2024