General Data Protection Regulation Policy (GDPR)
GDPR stands for General Data Protection Regulation which came into effect 25th May 2018. It is an EU law that sets out guidelines for the collection and processing of personal information and aims to give individuals more rights over how their data is used. GDPR is incorporated into the UK’s Data Protection Act 2018.
GDPR includes 7 rights for individuals:
1. The Right To Be Informed:
SJ Performing Arts Plymouth collects and uses certain personal information to enable us to conduct our business and operate as a dance and performing arts school.
This information includes:
- Personal details: name of parents/guardians and students, students date of birth, family addresses, parents/guardians telephone, family email addresses and emergency contact details. We may ask for information about students educational school.
- Medical information: any physical or mental condition, allergies, past and/or present injuries.
- Financial Information: Invoice details including bank details.
The above information we hold and is used for the day-to-day administration including registers, invoicing for fees, uniform and/or costumes orders, and activities such as dance or musical theatre event or experience.
As a performing arts provider, we have to collect, manage and disclose certain data with the following exam boards:
- Imperial Society of Teachers of Dance.
- Royal Academy of Dance.
- London College of Music
- London Academy of Music and Dramatic Art
- Acrobatic Arts.
This will include a child’s full name, date of birth, address, photographic identification, membership, PIN numbers, along with any SEN requirements. Parents name, address, telephone numbers, and email addresses.
When necessary we may need to share your personal information with other providers and following the Data Protection Act, we may need to share:
- When the law requires.
- Following information on from a child protection incident including the police, courts, and social services.
- Educational providers.
- The media.
- Financial services or charitable organisations.
- Postal companies when sending post directly to you.
- Website designers and hosts.
- Registration and Invoicing databases.
We will never share any information with third parties unless they are providing a service to help us run our business efficiently. Data processors are third parties who provide services for us all have their own GDPR in place.
We are required to know visitors’ full names, addresses, emails, telephone numbers, and where appropriate a company name. This is in respect to our Health and Safety and Safeguarding Policies.
We are required to hold data on our employees; full names, addresses, email addresses, telephone numbers, date of birth, National Insurance numbers, photographic ID such as passport and driver’s license, DBS, teaching qualifications, and financial details. We also need this information to confirm Disclosure and Barring Service (DBS) checks and the proof of eligibility to work in the UK.
2. The Right Of Access
At any point, an individual has the right to ask to view their data. Any requests relating to a person’s data will be provided with a response no late than one month. SJ Performing Arts Plymouth can refuse a request if we have a lawful obligation to retain data, we will inform the individual of the reasons for the rejection.
3. The Right To Erasure
You have the right to request the deletion of your data where there is no compelling reason for its continued use. However, SJ Performing Arts Plymouth has a legal duty to keep children and parents’ details for a reasonable time. SJ Performing Arts Plymouth will archive these records for 2 years after leaving the school. We will retain all children’s accident and injury records for 19 years (or until the child reaches 21 years) for child protection records. Staff records must be kept for 6 years after the member leaves employment before they can be erased. You have the right to request to change information about your data.
4. The Right To Restrict Processing
Parents/guardians, visitors, and staff can object to SJ Performing Arts Plymouth processing data. This means that records can be stored but must not be used in any way.
5. The Right To Data Portability
SJ Performing Arts Plymouth requires data to be transferred from one IT or technology system to another. Data can be transferred to systems such as to local authorities, to exam boards, and for performing licences. The recipients have their own GDPR in place.
6. The Right To Object
Parents, visitors, and staff can object to their data being used for certain activities like marketing or research.
7. The Right Not To Be Subject: To automated decision – making including profiling.
Automated decisions and profiling are used for marketing-based organisations. SJ Performing Arts Plymouth does not use personal data for such purposes.
Storage And Use Of Personal Information
All paper copies of children and staff records are kept in secured boxed files in principals’ home addresses. Members of staff can have access to these files when needed but information taken about individual children is strictly confidential and apart from archiving, these records will remain on-site at all times. After the retention period, all information will be shredded. Examination results will be stored securely and achieved indefinitely.
Copies of emergency contact details will be available to teachers at all times. All information will be stored on password protected devices.
SJ Performing Arts Plymouth will not disclose your information to third parties outside the school except where the law requires, or where you have given your permission to do so. We will use personal information only were stated in appendix 1.
SJ Performing Arts Plymouth collects a large amount of personal data every year including; names and addresses of those on the waiting list. These records will be added to the child’s file and stored appropriately or shredded if the child does not attend.
Every new student will complete a registration form and all data on this form be stored securely in boxed files, locked cabinets or on a password protected computer.
SJ Performing Arts Plymouth stores personal data held visually in photographs, video clips, or as sound recording. We will have received consent via our Photo, Video & Social Media Policy Consent Form. All photos, video, and sound recordings are stored on password protected devices.
Access to all office computers are password protected. Any portable technology device is password protected. Any portable data storage used to store personal data, e.g. a USB memory stick, are password protected and/or stored securely. When a member of staff leaves any password, they acquired will be changed immediately.
GDPR means that SJ Performing Arts Plymouth must:
- Manage and process personal data properly.
- Protect the individual’s rights to privacy.
- Provide an individual with access to all personal information held on them.
This policy was adopted at a meeting at SJ Performing Arts Plymouth by Principals Jodie Nicholls and Sarah Bayliss in July 2020 signed on behalf of SJ Performing Arts Plymouth.
19 Herbert Place, Plymouth, PL2 1RU.