iRock School of Music Privacy Policy
Date of last review: 30 April 2026
iRock School of Music is committed to protecting your privacy. This policy explains how we safely and securely process your data in accordance with our legal obligations. We have a legal duty to protect personal information that we collect under the Data Protection Act 2018 and the UK General Data Protection Regulation. This Privacy Policy applies to our use of all data collected by us and describes the way we use any personal information about: ● Customers ● Potential customers ● Visitors to our website ● School contacts ● Suppliers ● Participants of our lessons.
For the purposes of the applicable Data Protection Laws, iRock School of Music is the "data controller". This means that iRock School of Music determines the purposes for which, and the way, your data is processed.
1. What information do we collect? We may collect the following data, which includes personal data, from any persons in the above-named categories: ● Name ● Contact information, such as email addresses, telephone numbers and postal addresses (where needed) ● Payment details and billing information ● Child's name ● Child's school, class, year group or age so we can organise sessions safely and effectively ● Child's medical, allergy, access or support information where this is provided to help us deliver sessions safely ● Preferences, such as instrument choice ● Child's attendance history and session information ● Recordings, images or audio of your child in their band, where this is handled in accordance with the most recent iRock Image Policy and any relevant permissions ● Your account details if you create an online portal account ● Your purchase history ● Records of communication, for example emails, telephone calls, messages, forms or survey responses ● Information about your visit to our website, including cookies or analytics information where applicable ● Marketing preferences and communication preferences ● Any information you have chosen to supply us via our website, email, forms, surveys, competitions, promotions or over the phone. We only collect information that is reasonably necessary for the purposes set out in this policy.
2. Children's personal information As our services are provided to primary-aged children, we take extra care when handling children's personal information. Most information about a child is provided by their parent or carer, by the child's school, or through the child's participation in iRock sessions. We only collect the information we need to provide our band lessons safely and effectively, manage our relationship with parents, carers and schools, and meet our legal, safeguarding and business responsibilities. We do not collect children's date of birth. Where we need age-related information, we normally collect a child's age, year group or school year instead.
3. Data that you provide iRock School of Music will collect your data in several ways, for example: ● When you contact us through the website, by telephone, post, email, form or through any other means; ● When you register with us and set up an account to receive our services; ● When you complete surveys that we use for research purposes. Responses are not obligatory; ● When you enter a competition or promotion; ● When you make payments to us, through this website or otherwise; ● When you elect to receive marketing communications from us; ● When you use our services or the parent portal; ● When we receive information about your child from their school, where this is needed to provide our services safely and effectively.
4. How do we use your personal data? To provide you with the best possible experience when using our services or website. Specifically, personal data may be used by us for the following reasons: ● For internal record-keeping; ● For administrative and business purposes; ● To complete tasks needed to provide our services; ● To communicate with you regarding services, your purchase, your account, your child's sessions or your request; ● To improve our products, services, customer experience and website; ● To inform you about relevant products, services or offers where we are permitted to do so; ● To contact you for optional market research purposes, which may be done using email, telephone or SMS; ● To record sessions involving your child within a secure access platform accessible via our online portal, where relevant permission has been provided, access is limited to the relevant audience such as parents or carers connected to your child's band, and in accordance with the most recent iRock Image Policy; ● To record sessions for training, quality, safeguarding or service improvement purposes where appropriate; ● To monitor the use of our website and keep it secure; ● To ensure personal and financial information you provide is accurate; ● To manage risk for iRock School of Music, our customers, pupils and school partners; ● To fulfil our legal, regulatory, safeguarding, accounting and tax obligations.
Service messages, marketing and research We may send essential service messages about matters such as lessons, payments, the parent portal, timetable changes, concerts, safeguarding, customer support and important account updates. These messages are separate from marketing communications. We will only send pure marketing emails to parents or carers where they have opted in or where we are otherwise permitted to do so under applicable marketing rules. You can unsubscribe or update your marketing preferences at any time, though you will still receive essential service messages, as long as you are using our services.
5. Our lawful basis for using personal data Under UK data protection law, we must have a lawful basis for using personal data. The lawful basis we rely on depends on the purpose for which we are using the information.
| Purpose | Examples of data used | Lawful basis we may rely on |
|---|---|---|
| Setting up and managing parent or customer accounts | Parent or carer name, contact details, account details, child name, school, age or year group, preferences | Agreement, or steps before entering into an agreement |
| Delivering iRock band sessions | Child name, school, age or year group, instrument preference, attendance, session information, parent or carer contact details | Agreement and/or legitimate interests |
| Communicating service updates | Parent or carer contact details, child/session information, account information | Agreement and/or legitimate interests |
| Processing payments and managing billing | Payment details, billing records, purchase history, parent or carer contact details | Agreement and legal obligation |
| Keeping attendance, session and customer service records | Child name, attendance history, school, band/session information, records of communication | Agreement and/or legitimate interests |
| Supporting safe participation and managing medical or access needs | Medical, allergy, access or support information provided by parents, carers or schools | Article 6 lawful basis plus an Article 9 special category condition where the information is health-related |
| Using recordings, images or audio in the parent portal | Images, audio or video of children in their band sessions | Consent, where parents/carers have opted in via the parent portal or another permission process |
| Using recordings, images or audio for marketing or promotional purposes | Images, audio or video of children where relevant permissions have been provided | Consent, where parents/carers have opted in via the iRock Image Policy or another permission process |
| Using recordings for training, quality or safeguarding purposes | Images, audio or video from sessions, notes or records connected to the session | Legitimate interests, legal obligation or vital interests where applicable |
| Sending marketing communications | Name, contact details, marketing preferences, service history | Consent for pure marketing emails; legitimate interests only where permitted by marketing rules |
| Running surveys, research, competitions or promotions | Contact details, survey responses, competition entries and preferences | Consent, agreement and/or legitimate interests |
| Monitoring and improving our website | Website usage, device or browser information, cookie and analytics data where applicable | Consent for non-essential cookies; legitimate interests for essential, security or functional processing |
| Handling complaints, disputes, safeguarding matters or legal claims | Contact details, communication records, service records, relevant child/session information | Legal obligation, legitimate interests and/or vital interests where applicable |
Where we rely on legitimate interests, we will always balance these interests with your rights and freedoms. You have the right to object in certain circumstances, as explained in the section headed "Your Rights" below. Where we rely on consent, you may withdraw your consent at any time. Withdrawing consent will not affect any processing that took place before consent was withdrawn.
6. Special category data, including medical information Some information, such as health or medical information, is classed as special category data under UK data protection law. This may include information about a child's medical needs, allergies, access requirements, additional support needs or other information needed to support safe participation. We will only use this information where it is necessary and where we have both a lawful basis under Article 6 UK GDPR and a relevant special category condition under Article 9 UK GDPR. Depending on the circumstances, this may include explicit consent, vital interests, or another condition permitted by data protection law. We use this information only to support safe participation in iRock sessions, manage risk, respond to emergencies, meet safeguarding responsibilities, and provide appropriate support where needed. We apply additional safeguards to this information and limit access to people who need it for their role. If we rely on a special category condition that requires an Appropriate Policy Document or additional documentation under the Data Protection Act 2018, we will ensure that the relevant documentation is in place.
7. Who we share data with There are occasions when it is necessary for iRock School of Music to share data with trusted third-party providers for us to provide services to you. We will never sell your data to a third party. We may share your data with the following groups of people where necessary: ● Schools, for example to provide timetables, attendance information, safeguarding information or information needed to support safe participation; ● Payment providers, banks and finance platforms, to process payments and manage billing; ● Parent portal, customer database, CRM, communication, email, SMS, IT, hosting and security providers, to operate our services and systems; ● Website analytics, cookie and advertising technology providers, where applicable and in line with your cookie choices; ● Professional advisers, auditors, insurers and legal advisers; ● Relevant authorities, regulators, safeguarding bodies, emergency services, police or courts where required by law or where necessary to protect rights, safety or welfare; ● Merchandise fulfilment or support partners where relevant to a merchandise order or enquiry; ● A prospective purchaser, new owner or newly controlling party as set out in the section headed "Changes of business ownership and control". Where third parties process personal data on our behalf, we will put appropriate agreements in place and require them to process it securely, only in accordance with our instructions and applicable data protection law. For further information, access the website of the ICO: https://ico.org.uk/
8. Cookies, website analytics and online advertising When you visit our website, we may collect information about how you use the site, the pages you view, the device or browser you use, and how you interact with our content. Some of this information may be collected through cookies or similar technologies. Essential cookies may be used to make the website work and keep it secure. Non-essential cookies, analytics or advertising technologies will only be used where we have the appropriate consent or lawful basis. You can manage your cookie preferences through the cookie controls on our website, where available.
9. International transfers Some of the trusted service providers we use may process personal data outside the United Kingdom. Where this happens, we will take steps to ensure that appropriate safeguards are in place so that your personal data remains protected in accordance with applicable data protection law.
10. Changes of business ownership and control iRock School of Music may, from time to time, expand or reduce our business and this may involve the sale and/or the transfer of control of all or part of iRock School of Music. Data we hold, where it is relevant to any part of our business so transferred, may be transferred along with that part and the new owner(s) or newly controlling party will, under the terms of this Privacy Policy, be permitted to use the data for the purposes for which it was originally supplied to us. We may also disclose your data to a prospective purchaser of our business or any part of it. In the above instances, we will take steps with the aim of ensuring your privacy is protected.
11. Retention and disposal of information iRock School of Music will retain information about you only for as long as is reasonable and necessary to comply with the law, provide our services, manage our relationship with you, protect our rights and meet legitimate business needs. Retention periods vary according to the type of personal information and the reason we hold it.
| Type of information | How long we keep it |
|---|---|
| Parent, carer or customer account information | While the account is active and for a limited period afterwards to manage queries, administration and legal record-keeping. |
| Payment, billing and purchase records | For the period required for finance, tax, accounting and audit purposes. |
| Child lesson, attendance and session records | While the child receives iRock sessions and for a limited period afterwards to manage queries, safeguarding, service history and reporting. |
| Medical, allergy, access or support information | Only for as long as needed to support safe participation, manage risk or meet safeguarding/legal responsibilities. We will delete or minimise this information when it is no longer needed. |
| Recordings, images or audio | In line with the iRock Image Policy, relevant permissions and the purpose for which the recording was made. |
| Marketing preferences | Until you unsubscribe, update your preferences or we no longer need to keep a suppression record to respect your choice. |
| Website analytics and cookie information | In line with our cookie settings and the retention periods used by the relevant analytics or technology provider. |
| Complaints, safeguarding, disputes or legal records | For as long as needed to investigate, respond, comply with legal obligations or protect rights and safety. |
When information is no longer needed, we will delete it, anonymise it or securely dispose of it.
12. Data Security iRock School of Music takes the risk of security loss seriously and uses appropriate technical and organisational measures to protect personal information. We follow the legal framework set down by the Information Commissioner's Office and relevant industry standards. Access to personal information is limited to people who need it for their role. We also expect trusted providers who process data on our behalf to apply appropriate security measures.
Notification of breaches If appropriate, iRock School of Music will inform affected data subjects about an information security breach. We will also notify the ICO and, where appropriate, consult other regulatory bodies, relevant authorities, the police, banks or other third parties where required or appropriate.
13. Your rights You have the following rights in relation to your data: ● Right to access - the right to request copies of the information we hold about you, unless you have already exercised the Right to Erase, in which case, we will no longer be able to share the information we previously held; ● Right to correct - the right to have your data rectified if it is inaccurate or incomplete; ● Right to erase - the right to request that we delete or remove your data from our systems; ● Right to restrict our use of your data - the right to block us from using your data or limit the way in which we can use it; ● Right to data portability - the right to request that we move, copy, or transfer your data; ● Right to object - the right to object to our use of your data including where we use it for our legitimate interests; ● Right to withdraw consent - where we rely on consent, the right to withdraw that consent at any time. If we provide you with access to the information we hold about you, we will not charge you for this unless your request is manifestly unfounded or excessive. Where we are legally permitted to do so, we may refuse your request. If we refuse your request, we will tell you the reasons why. To make enquiries, exercise any of your rights set out above, or withdraw your consent to the processing of your data where consent is our legal basis for processing your data, please contact us via this email address: [email protected] If you are not satisfied with the way a complaint you make in relation to your data is handled by us, you may be able to refer your complaint to the Information Commissioner's Office (ICO). The ICO's contact details can be found on their website at https://ico.org.uk/ It is important that the data we hold about you is accurate and current. Please keep us informed if your data changes during the period for which we hold it.
14. Automated decision-making and profiling We do not make decisions about you or your child using solely automated processing that would have a legal or similarly significant effect. If this changes, we will update this policy and provide appropriate information about the processing.
15. Changes to this policy iRock School of Music reserves the right to change this Privacy Policy as we may deem necessary from time to time or as may be required by law. Any changes will be immediately posted on our website, or where appropriate, emailed to you.
Policy Owner: Jenny Lynn Taylor, Head of Marketing Approved by: iRock Board of Directors Date of next review: August 2026