General Data Protection Regulation (GDPR) 2018
In May 2018, new Europe-wide guidelines come into place regarding how your data is acquired, stored, retrieved and accessed.
If your child is a pupil of Spotlight Academy, these new guidelines give the data owner (you) more control over what information is kept.
This document sets out what and how Spotlight Academy handles the data it collects from participants of our activities and their parents or guardians, and to reassure you of GDPR compliance.
What Data is Acquired and how is it used?
We do not share your data with third parties unless stated below.
We do not sell or share your data, and neither do we buy data from third parties.
All participants are required to complete a registration form giving your address, email, telephone numbers, your child’s name, date of birth and any medical conditions.
Your child’s name and attendance will be noted on class registers.
Your child’s name and age at the time will be given to the International Dance Teachers Association if exams are taken and will appear on relevant lists.
Your child’s name and clothing size may be detailed on show costumes lists.
If your child takes part in a performance, your local council must be informed of your child’s name, date of birth, home address and school.
If you help at a show, we will ask for a copy of your DBS.
Your name and email address is used in the Mailchimp application.
Your name and email address is used by Spotlight Academy.
Your email is forwarded to GoCardless.
Your details will be used in our online accounting software and by our accountants.
How is this Data used?
The data on the registration form is used to contact you, identify which lessons your child attends and to make us aware of any special needs your child may have.
Child attendance registers are used to account for children in class.
Children’s names and age at the time will be used by the International Dance Teachers Association to identify and assess children’s progress in examinations and to complete certificates where appropriate.
Your child’s name and clothing size will be used to order costumes.
The local council requires this information in order to grant a performance licence.
It is retained for possible inspection by the local authority.
Your name and email address is used in the Mailchimp application to send newsletters.
Your name and email address is used by Spotlight Academy to contact you regarding academy business or to send you newsletters, if your email is not compatible with Mailchimp.
Your email is forwarded to GoCardless in order for them to send you a sign up email. All subsequent information is between you and GoCardless.
Your name and payments will be recorded.
How is the data stored?
Registration forms are stored in a locked cabinet and are scanned as a .pdf and stored on secure servers.
Class registers are stored and transported in a locked briefcase.
Forms completed for the International Dance Teachers Association are stored in a locked office.
Costumes lists are stored and transported in a locked briefcase.
It is scanned and held on our secure servers.
Information for Mailchimp is stored on secure GDPR compliant servers.
Information used by Spotlight Academy is stored on secure GDPR compliant servers and devices.
Information used by GoCardless is stored on secure GDPR compliant servers.
Information used by Xero and our accountants is stored on secure GDPR compliant servers.
How long is the data retained?
Registration forms are kept for 7 years to comply with HMRC.
Class registers are kept for 7 years to comply with HMRC.
Forms completed for the International Dance Teachers Association are kept for 12 months.
Costumes lists are kept for 12 months after a show.
It is retained for 3 years.
Information stored with Mailchimp is not automatically removed and you can subscribe at any time. As vital information is sent via Mailchimp, If you choose to unsubscribe, it may be difficult for your child to continue as a pupil at Spotlight Academy Limited.
Information stored by Spotlight Academy is kept for 7 years to comply with HMRC.
Information stored by GoCardless is kept in accordance with the GoCardless GDPR but is inaccessible by Spotlight Academy when you cancel the direct debit agreement.
Information used by Xero and our accountants is kept for 7 years to comply with HMRC.
You can gain access to any of the data held by Spotlight Academy by emailing your request to firstname.lastname@example.org
Please allow 5 working days for a response.