1. Introduction
Green Room Place, Ltd. is dedicated to protecting and respecting the privacy of all individuals whose personal data we process. This Privacy Policy explains how we collect, use, store, and safeguard personal data in compliance with the Data Protection Act 2018 and the General Data Protection Regulation (GDPR).
This policy applies to all staff, students, contractors, volunteers, and stakeholders interacting with Green Room Place, Ltd. Personal data is processed lawfully, fairly, and transparently, and only for the purposes for which it is collected.
2. Purpose of Data Collection
We collect personal data to provide the following services:
- Educational Services: Managing music courses, workshops, and festivals, including registration and communication.
- Safeguarding and Welfare: Ensuring the safety, health, and well-being of students.
- Marketing and Communications: Sending updates, promotional materials, and newsletters (with consent).
- Legal and Financial Requirements: Fulfilling contractual obligations, processing payments, and maintaining financial records.
We only collect data necessary for these purposes and will not use it for unrelated activities without prior consent.
3. Types of Personal Data We Collect
The types of personal data we may collect include:
- Personal Information: Name, address, phone number, email, date of birth.
- Health and Emergency Details: Medical information, emergency contacts, and specific health needs.
- Educational Records: Academic performance, musical experience, and participation history.
- Photographs and Video: Images/videos during events (with consent).
- Payment Information: Bank details for fees and services.
- Communication Data: Emails, feedback, and social media interactions.
- Identity Verification: Copies of passports or government-issued IDs for registration or visa purposes.
We process personal data based on the following lawful bases:
- Consent: For marketing or using photographs.
- Contractual Necessity: To fulfill agreements with students, staff, or contractors.
- Legal Obligation: Compliance with legal and regulatory requirements.
- Legitimate Interests: Improving services, communications, and operations, provided these do not override individual rights.
5. Data Retention
We retain personal data only as long as necessary. Guidelines include:
- Student Data: Kept for 6 years after course completion for legal purposes.
- Marketing Data: Retained while consent is active.
- Staff and Contractor Data: Retained for 7 years post-employment or contract.
- Health Data: Retained for 3 years post-event for safety purposes.
After the retention period, data is securely deleted or anonymized.
6. Data Security
We implement strict measures to protect personal data, including:
- Encryption: Safeguarding data during storage and transmission.
- Access Controls: Restricting access to authorized personnel only.
- Regular Audits: Assessing and improving security practices.
- Training: Educating staff on GDPR compliance and best practices.
In case of a data breach, we will notify the ICO within 72 hours and inform affected individuals as necessary.
7. Sharing Personal Data
We do not share personal data except:
- With Service Providers: Trusted third parties aiding operations (e.g., payment processors).
- For Legal Obligations: Compliance with laws or court orders.
- In Emergencies: Sharing relevant data with contacts or medical providers.
We never sell or rent personal data to third parties.
8. Cookies and Tracking
What Are Cookies?
Cookies are small text files placed on your device by websites to enhance your experience.
How We Use Cookies
- Essential Cookies: For website functionality and preferences.
- Analytical Cookies: To analyze website usage and improve services.
- Marketing Cookies: To display relevant ads and communications.
You can manage cookies through browser settings. Blocking cookies may limit website functionality.
Tracking and Analytics
We use Google Analytics to analyze website traffic and improve content. You can opt out using the Google Analytics Opt-Out Browser Add-On.
9. Your Data Protection Rights
You have the right to:
- Access: Request a copy of your personal data.
- Rectification: Correct inaccurate or incomplete data.
- Erasure: Request data deletion under certain conditions.
- Restrict Processing: Limit how your data is processed.
- Data Portability: Transfer your data to another organization.
- Object: Oppose data processing for specific purposes.
- Withdraw Consent: Revoke consent for data use at any time.
10. Complaints
If you believe your data has been processed improperly, you can lodge a complaint with the Information Commissioner’s Office (ICO):
- Website: ico.org.uk
- Phone: 0303 123 1113
If unsatisfied with our response, contact the ICO for further assistance.