Data Protection Policy

Policy: Data Protection (GDPR)

Date Adopted: 2018 (GDPR)

Date of last review: 25/05/2018

Date of next review: 0n or before 25/05/2019

Purpose and Statement

Danceworks Unlimited (DWU), Edmund Hall (EH) is committed to ensuring the data we process remains safe and secure.

DWU, EH has determined the lawful reasons with which it processes personal data:

  • Consent – from the data subject and/or parent/guardian.

  • Legitimate interest.

Main Aims for the Policy

  • Specify the data DWU, EH collect, how it is stored/protected and the reason for collecting it.

  • State how DWU, EH use personal data.

  • Disclose who has access to the data and how long it is retained.

  • Explain data subject’s rights including access, rectification and erasure.

Distribution

  • To be displayed on the DWU website.

  • This policy will be sent directly to members of the public on request.

  • Conformation of receipt of information – signed statement from recipient to be held on file.

Review and Monitoring of Policy

  • Reviewed annually or in instances of legislative change.

The policy is based on the following principals:

The GDPR includes the following rights for individuals

  • The right to be informed

  • The right to access

  • The right to rectification

  • The right to erasure

  • The right to restrict processing

  • The right to data portability

  • The right to object

  • The right not to be subject to automated decision-making including profiling.

General Principals

DWU, EH is committed to providing fair and understandable privacy policies in relation to personal data.

DWU, EH will keep data secure and will not retain data unnecessarily or past the retention length set out in the policy.

How DWU EH collect personal data

DWU, EH customers and participants supply their personal data when signing up for classes through the registration or screening forms and via hall hire booking forms.

Personal data may also come to us via enquiries through our website, email address and/or Facebook page.

Why DWU, EH collect personal data.

To attend DWU lessons and/or use EH facilities participants/parents/guardians/hirers must agree to some processing of personal data. This is due to Consent and/or Legitimate Interest.

All DWU participants must remain safe at all times, therefore information about participants must be collected in order to create registers and accurate pupil records. The information is also used to provide pupils with appropriate classes, including splitting into age groups, Entering pupils for International Dance Teacher Association (IDTA) examinations and Informing pupils/parents/guardians of any relevant practice/timetable amendments.

Data from hirers of EH is used to create invoices, maintain professional, safe practice within our facility and Inform hirers of availability updates.

As our service involves the provision of physical activity it is essential that data processing consent be given should a participant have any medical/disability needs. This allows for participants to be safely incorporated into class and for us to assess if we can incorporate participants safely.

What Data is collected

Danceworks Unlimited – Children.

  • Childs full name.

  • Childs date of birth.

  • Childs home address.

  • Parent’s/guardians mobile number and email address.

  • Alternative emergency contact name, relationship to pupil and telephone number.

  • Details of any relevant medical conditions and/or medication.

  • International Dance Teachers Association PIN and exam results where applicable.

  • Attendance register.

  • Accident/Incident forms.

  • Permission forms (i.e. performance consent, exam consent)

  • Photos/Video.

Danceworks Unlimited – Adults.

  • Name.

  • Address.

  • Telephone and Mobile number.

  • Email address.

  • Age range.

  • Current exercise details.

  • I.C.E. (In case of an emergency) name and number.

  • Details of any relevant medical conditions and/or medication.

  • Females only – If you have had a recent pregnancy, are you pregnant at time of registration.

  • International Dance Teachers Association PIN and exam results where applicable.

  • Attendance register.

  • Accident/Incident forms.

  • Performance consent forms.

  • Photos/Video

Edmund Hall - Hirers

  • Hirer’s name.

  • Name of Organisation.

  • Hirer’s home address.

  • Hirer’s Telephone number/Mobile number

  • Hirer’s email address.

  • Copy of Public liability and Indemnity insurance.

  • Copy of any other relevant licences. (PPL/Electrical PAT)

CCTV Data.

There are a total of six AHD Night vision dome CCTV cameras, which cover both Edmund Hall entrance, car park, and the private residential dwelling of 6 Edmund Road, Spondon, Derby.

Data from the cameras is recorded 24/7 and stored on the systems internal hard drive for two weeks.

Data recorded includes:

  • Images of people entering/leaving Edmund Hall.

  • Images of people and vehicles using the car park.

  • Images of anyone in the external private areas of the residential dwelling.

Viewing the data can only be made via gaining access to the hard drive, which is stored securely within the building.

The lawful basis on which I gather and store this information is Legitimate Interest.

Paper data storage

Paper documents are stored in a secure filing system. Attendance registers are kept in a folder behind reception during lessons and transferred to the secure filing system upon completion.

Paper data includes:

  • Registration/Screening forms.

  • Attendance registers.

  • Permission forms.

  • Booking forms.

  • Accident report forms.

Online data storage

  • I have a computer and laptop that are used for business purposes, both of which are password protected. Information is stored on the desktop in encrypted files and backed up on a memory stick that is stored in a secure filing system.

  • Email – I keep a copy of your email address in my contacts to allow me to process emails quickly. I do not gather statistics or monitor any information.

  • Mobile phone – I use Vodafone as my mobile phone provider to send and receive calls and text messages. I keep a copy your mobile phone number and emergency contact numbers in my contacts. My mobile is password protected.

Retention of paper and online data

Data

Period of Retention

Details

Registration form

1 year post attendance

After this period they will be shredded.

Booking forms/Copies of licences and Insurance.

1 year post hire.

After this period they will be shredded.

Permission/Consent forms

1 year post attendance

After this period they will be shredded.

Accident/Incident forms

3 years post attendance

After this period they will be shredded.

Attendance Register

1 year post attendance

After this period they will be shredded.

IDTA PIN / Exam Results

Indefinitely

As pupil pin numbers are all together on the same notification from the IDTA I cannot destroy these or share them with others. They will remain in a secure filing system till such time as I cease trading. They will then be shredded.

Email address

1 term post attendance

After this period they will be deleted.

Contact numbers in mobile

1 term post attendance

After this period they will be deleted.

Photos/Videos

Indefinitely

No last names or further identifying data.

Third Parties/Data Processors

DWU, EH does not actively share data with third parties, however there are certain instances where sharing information is crucial to our business processes.

Examination Entry:

In order to enter examinations DWU must provide some personal data to the examination body, IDTA. This data sharing is to be consented to by the data subject and/or parent/guardian upon being entered for the exam.

Performance and Examination Participation.

DWU will occasionally produce and display examination and performance participation notices. These will contain the first name and initial of participants last name.

Your rights

Access. 
You may contact DWU, EH at any time to access all data held relating to you and/or your child(ren). DWU, EH will ensure that we respond to a subject access request without undue delay and within one month of receipt. If the information request will also include data regarding others, DWU, EH has the right to refuse the request or take steps in order to obtain consent from other involved parties.

Rectification You may contact DWU, EH at any time in order to rectify data held relating to you and/or your child(ren). DWU, EH will ensure that we respond to a rectification request without undue delay and within one month of receipt.

Erasure. You may contact DWU, EH at any time in order to erase data held relating to you and/or your child(ren). DWU, EH will ensure that we respond to an erasure request without undue delay and withinone month of receipt.

Restrict Processing. You may contact DWU, EH at any time in order to restrict the data we process relating to you and/or your child(ren). DWU, EH will ensure that we respond to a request to restrict processing without undue delay and within one month of receipt.

Data Portability. You may contact DWU, EH at any time in order to obtain the data we process relating to you and/or your child(ren) and reuse it across different services. DWU, EH will ensure that we respond to a request to data portability without undue delay and within one month of receipt.

Objection. You may contact DWU, EH at any time in order to object to the processing of data relating to you and/or your child(ren). DWU, EH will ensure that we respond to an objection request without undue delay and within one month of receipt.

An extended compliance period of a further two months may be needed for complex or numerous requests.

Verbal requests will be noted and acted upon in the time frame noted above. People making requests will then be contacted via email or phone to confirm request.

Photos/Videos of Participants

DWU, EH often use footage/photos used from shows, performances and classes for marketing purposes both in print media and the website. Participants/their Parent and/or Guardians may choose if they do not wish themselves/their child to be depicted. Permission is sought for the use of any footage/photos in print media and the website.

Social Media: DUU, EH regularly share photos/videos of students in workshops, events and performances through social media platforms including Facebook and Email. These will never be shared with any identifying information (age, full name etc.). There may be times where we will share first names, but only with the explicit consent of the parents. Permission is sought for the use of any footage/photos on social media.

Complaints and Data Breeches

If you think that your data has been misused or that it hasn’t been kept secure in the first instance you should contact:

Mrs C Beheshti

Danceworks Unlimited, Edmund Hall, 6A Edmund Road, Spondon, Derby. DE21 7HH.

01332 670196

clare@danceworksunlimited.co.uk

If you need any advise you can contact the Information Commissioner’s Office (ICO)

Helpline – 03031231113

Online – http://www.ico.org.uk/complaints

If DWU, EH experiences a data breech of any kind, we have a legal obligation to report this to ICO within 72hours.

DWU, EH will also inform all the victims of the data breech as soon as possible if there is a high risk of adversely affecting individuals’ rights and freedoms.

DWU, EH will store and record all data breeches.