Swindon Music Service – Privacy Notice

prepared 20 October 2026

Part A: About this notice

Version

Swindon Music Service (“we”, “us”) is committed to protecting the privacy and security of your personal information. This notice explains what personal information we collect, why we use it, who we share it with and what your rights are.

Who we are

Swindon Music Service is the data controller for the personal information described in this notice. This means we decide how and why it is used. We are a charitable incorporated organisation (CIO) registered with the Charity Commission for England and Wales, charity number [number].

Contact us about data protection:

• Email: pclark@smscio.co.uk
• Post: CEO, Data Protection Lead, Swindon Music Service, The Platform, Faringdon Road, Swindon SN1 5BJ
• Telephone: 01793 610673
• Data protection lead: Peter Clark

Who this notice covers

• Pupils and students who take lessons, join ensembles or attend our activities
• Parents, carers and guardians of pupils
• Schools and other organisations we work with, and their contact staff
• Staff, music tutors, workers, contractors and volunteers, current and former, and job applicants
• Supporters and people on our mailing lists

Parts A, D, E and F apply to everyone. Part B applies to pupils, parents/carers, schools and other users of our service. Part C applies to staff, tutors, workers, contractors, volunteers and applicants.

The law we follow

We process personal information in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025. We must use your information lawfully, fairly and transparently; only for clear, legitimate purposes; keep it accurate, limited to what we need and no longer than necessary; and keep it secure.

We may give you a separate, shorter notice at the point we collect information for a particular purpose (for example, an event booking). Please read it together with this notice.

Part B: Pupils, parents/carers and schools

What we collect

• Pupil details: name, date of birth, school, year group, instrument, lesson and ensemble details, attendance, progress and exam results, and photographs or recordings (with consent).
• Parent/carer details: names, address, phone numbers, email, relationship to the pupil, and emergency contacts.
• Payment details: billing and payment history, and eligibility for fee remission or subsidised lessons (for example, free school meals or pupil premium status).
• School details: contact names, roles, email and phone numbers for school staff we work with.
• More sensitive information, only where needed: medical conditions, allergies and medication; special educational needs and disabilities (SEND); ethnicity (for equality monitoring, optional); and safeguarding information.

We collect this from parents/carers, from pupils, from schools, and [from the local authority or other music hub partners – delete if not applicable].

Why we use it, and our lawful basis

More sensitive information (special category data). We use health, SEND and ethnicity information only where one of these conditions applies: it is needed to safeguard children and protect their wellbeing; it is needed for reasons of substantial public interest, such as equality of opportunity; or you have given explicit consent. We keep an Appropriate Policy Document explaining how we protect this information.

Children’s information

We write to parents/carers about pupils’ information. As children grow older and understand what is involved, they can exercise their own data protection rights. We will take a child’s wishes into account where they are mature enough to understand them.

Where we rely on consent (for example, for photographs), you can withdraw it at any time by contacting us. This does not affect anything we did before you withdrew it.

If you do not give us information

We need some information, such as emergency contacts and medical needs, to run lessons safely. Without it, we may not be able to offer a place.

Part C: Staff, tutors, workers, contractors, volunteers and applicants

This part does not form part of any contract of employment, tutor contract or other contract for services.

What we collect

• Contact details, date of birth, next of kin and emergency contacts
• National Insurance number, bank details, payroll, tax status, salary, pension and benefits information
• Start and leaving dates, reason for leaving, place of work and teaching timetable
• Recruitment information, including right-to-work documents, references, CVs and application forms
• Work records: job titles, working hours, holidays, training, qualifications and professional memberships
• Performance, disciplinary and grievance information (where relevant)
• Information about your use of our IT and communication systems and CCTV or entry records

More sensitive information: health and sickness records, including parental and sick leave; disability and reasonable adjustments; ethnicity, religion and sexual orientation (for equality monitoring, optional); trade union membership (where relevant); and criminal records information from Disclosure and Barring Service (DBS) checks.

We collect this from you, from recruitment agencies, from referees and former employers, and from the DBS.

Why we use it, and our lawful basis

We use health information to support your wellbeing, manage absence and make adjustments, and criminal records information to decide whether you are suitable to work with children. We keep an Appropriate Policy Document for this information.

If you do not provide information we need, we may not be able to employ or engage you, pay you, or meet our legal duties.

Automated decisions

We do not make decisions about you using only automated means. If this changes, we will tell you first, explain how it works, and you will be able to ask for a person to review any decision.

Part D: Who we share information with

We never sell personal information. We share it only where the law allows, and only what is needed.

Our music service management platform

We use Daia, a platform built and run for us by V88 on its own Daia framework, to manage [enrolments, lessons, timetables, attendance, invoicing, communications and staff records]. We also use SpeedAdmin, provided by SpeedAdmin ApS, which holds [some parent/carer and pupil records, e.g. contact details and lesson information].

V88 and SpeedAdmin act as our data processors. They host and run these systems for us. Their staff may be able to see your information where this is needed to host, maintain or support the system, but they may only use it on our instructions. They cannot use it for their own purposes, must keep it secure and confidential, and must not pass it to anyone else without our approval. This is set out in a written contract with each of them.

V88 does not sell your information, use it for advertising or use it to train any software, and there is no third-party analytics or tracking in the Daia app. To run the service, V88 uses two infrastructure providers, which process the information only for that purpose: Vercel, which serves the application, and Supabase, which hosts the database. Information in Daia is encrypted when stored and when sent, and access controls mean each user can retrieve only the records they are entitled to see.

The Daia platform is also used by other organisations. Our records are kept separate from theirs: they cannot see or use the information we hold.

Our website

Our website is designed and maintained and hosted by Fanatic, a website design agency based in Bristol. Fanatic acts as our data processor. Its staff may see information sent through our website, such as enquiry and contact forms [and website usage data], where this is needed to build, maintain, secure or support the site. Fanatic may only use this information on our instructions, must keep it secure and confidential, and cannot use it for its own purposes. This is set out in a written agreement.

Other organisations we share with

If we ever reorganise, merge or transfer our service to another organisation, we may share information with them. Where possible, we will share anonymised information until the change is complete.

Part E: Transfers, security and how long we keep information

Transfers outside the UK

Information held in Daia is stored on UK-based infrastructure provided by Vercel and Supabase, with backups kept at two separate sites. SpeedAdmin is based in Denmark and stores information within the European Economic Area (EEA). The UK recognises the EEA as giving adequate protection to personal information, so this is permitted.

If any provider stores or accesses information anywhere else, we make sure it is protected to UK standards, for example by using the UK’s approved contract terms (the International Data Transfer Agreement or Addendum). You can ask us for details.

Keeping information secure

We limit access to people who need it, use password-protected and access-controlled systems, and require everyone who handles personal information for us to keep it confidential. We have procedures for dealing with any suspected data breach. Where the law requires, we will tell you and the Information Commissioner’s Office (ICO).

How long we keep information

We keep information only as long as we need it, and for any legal, accounting or safeguarding requirements. Our retention schedule, available on request, gives full details. Typical periods are:

After this, we securely delete or anonymise the information.

Part F: Your rights and how to complain

Your rights

You have the right to:

• Access – ask for a copy of the information we hold about you
• Correction – ask us to correct information that is wrong or incomplete
• Erasure – ask us to delete information in certain circumstances
• Restriction – ask us to limit how we use your information, for example while we check its accuracy
• Objection – object to our use of your information where we rely on legitimate interests, and to direct marketing at any time
• Data portability – ask for information you gave us in a reusable electronic format, in certain circumstances
• Withdraw consent – where we rely on consent, at any time, without affecting what we did before
• Human review – of any decision made about you by automated means

To use any of these rights, contact us using the details in Part A. You do not usually have to pay. We will normally respond within one month. We may need to confirm your identity first, and we may extend the time by up to two further months for complex requests; if so, we will tell you why.

Complaints to us

If you are unhappy with how we have handled your personal information, you have the right to complain to us. You can do this by email, by post, by phone or in person, using the details in Part A. We will acknowledge your complaint within 30 days, look into it without undue delay, and tell you the outcome.

Complaints to the Information Commissioner’s Office

You also have the right to complain to the ICO, the UK’s data protection regulator. The ICO usually expects you to raise your concern with us first.

• Website: org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Your duty to keep us informed

Please tell us if your contact details or other information changes, so our records stay accurate.

Changes to this notice

We review this notice at least once a year and when our arrangements change. We will publish the latest version on our website and send it to staff, tutors and parents/carers when we make significant changes. The version number and date are at the top of Part A.