Privacy Policy

This privacy policy explains how Planet drum collects, uses, and protects your personal data when you visit our website (www.theplanetdrum.co.uk), book a taster, enrol for lessons, or otherwise contact the school.

We take your privacy seriously. We only collect the information we need to run your lessons and keep the school working well, and we do not sell your data to anyone. This policy sets out what we hold, why we hold it, who we share it with, and the rights you have over it.

If you have any questions about anything below, please get in touch using the details in section 2.

Planet drum is the data controller responsible for your personal data. Our details are:

• Postal address: Planet drum, The Crypt, St Mary Magdalene Church, Holloway Road, Islington, London, N7 8LT
• Phone: 020 3417 5793
• Email: info@theplanetdrum.co.uk

Under UK data protection law we must have a lawful basis for using your data. The bases we rely on are set out below.

• To provide lessons, tasters, vouchers, and practice rooms you have booked. Lawful basis: performance of a contract with you.
• To send service messages such as booking confirmations, directions, lesson and rescheduling information. These are necessary to deliver what you have booked. Lawful basis: contract and our legitimate interests in running the school.
• To send our weekly newsletter to currently enrolled students (rehearsal announcements, tips, and school news). This comes as part of membership and stops when a student leaves. Lawful basis: our legitimate interests.
• To send occasional marketing emails (special offers, gift voucher promotions) to past and current students about services similar to those you have used. Every marketing email includes a clear unsubscribe link. Lawful basis: our legitimate interests under the "soft opt-in" rule in the Privacy and Electronic Communications Regulations. See section 7 to opt out.
• To keep students safe and respond to emergencies, using the medical and emergency-contact information you provide. Lawful basis: your explicit consent, given when you enrol, and, in a genuine emergency, the protection of vital interests.
• To keep proper financial and tax records. Lawful basis: compliance with a legal obligation.
• To use photos and videos of students for marketing, where you have agreed. Lawful basis: consent (see section 6).
• To establish, exercise, or defend legal claims where necessary. Lawful basis: our legitimate interests.

We teach children as well as adults, and we treat children's data with particular care.

Where a student is under 18, the enrolment form is completed and signed by a parent or guardian, who provides the child's details, the emergency contact, and any relevant medical information. We use this data only to deliver lessons safely and to communicate with the parent or guardian. We do not send marketing to children. A parent or guardian can exercise all of the rights in section 12 on the child's behalf.

From time to time we may use photos and videos taken at the school to show what we do, including on our social media pages, to help prospective students and families get a feel for Planet drum.

If you would prefer that photos or videos of you or your child are not used in this way, you can opt out in writing at any time, and we will respect that. We will always ask for permission before posting on our YouTube channel.

To opt out, or to ask us to remove an image, email news@drumad.com.

If you have booked with us in the past, we may occasionally email you about similar services such as offers and gift vouchers. You can stop these at any time by clicking the unsubscribe link in any marketing email, or by emailing news@drumad.com with "unsubscribe" in the subject line. Opting out of marketing will not affect the service messages we need to send to run your lessons.

We do not sell your data. We share it only with the people and trusted service providers who help us run the school, and only as far as they need it. These include:

• Our office team and your teacher, so your lessons can be delivered and any relevant safety information acted on.
• GoCardless, which processes Direct Debit payments for weekly and children's memberships.
• Xero, which we use for invoicing and our financial records.
• PayPal, which processes taster lesson payments. You do not need a PayPal account to pay.
• systeme.io, which we use to send newsletters and marketing emails.
• Google Workspace, which we use for contacts, calendars, and email.
• Elfsight, which provides the events calendar embedded on our website.

We require everyone who processes data on our behalf to keep it secure, to use it only for the purposes we have set, and to comply with the law.

Some of the service providers in section 8 may store or process data outside the UK. Where that happens, we make sure an appropriate safeguard is in place so that your data receives the protection required by UK data protection law. This means the transfer is either to a country the UK government has decided offers an adequate level of protection, or it is covered by the UK's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.

We keep your personal data only for as long as we need it, and then delete it securely.

• Financial records are kept for six years, the minimum period required by HMRC and the period during which a contract claim can be brought.
• Medical and emergency-contact information is held only while a student is enrolled, and is securely deleted within twelve months of them leaving. We do not need it once lessons end.
• Other enrolment and lesson records are kept for up to six years after a student leaves, and are then securely deleted.
• Contact details we use to stay in touch, such as your name and email, are kept for as long as you are happy to hear from us. Every email includes a one-click unsubscribe, you can ask to be removed at any time, and we regularly clear addresses that are no longer in use or that have not engaged with us for a long time.
• Taster and enquiry records are kept for twelve months if you do not go on to enrol, and are then deleted.

We use appropriate technical and organisational measures to keep your data secure, and we limit access to it to the people who need it to do their job. Medical and emergency-contact information is treated as confidential and shared only with those responsible for student safety.

Under UK data protection law you have the right to:

• Access the personal data we hold about you
• Correct data that is inaccurate or incomplete
• Erase your data in certain circumstances
• Restrict how we use your data
• Object to processing based on our legitimate interests, including marketing
• Data portability, where applicable
• Withdraw consent at any time, where we rely on consent (for example, photo and video use or marketing)

To exercise any of these rights, email us at info@theplanetdrum.co.uk. You can read more about your rights on the Information Commissioner's Office website at ico.org.uk.

If you have a concern about how we handle your data, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator for data protection, at ico.org.uk or by calling their helpline.

We may update this policy from time to time. When we do, we will change the "last updated" date at the top of the page, and where the changes are significant we will make that clear.

For anything to do with your data or this policy, contact us at:

Planet drumThe Crypt, St Mary Magdalene Church, Holloway Road, Islington, London, N7 8LT
Phone: 020 3417 5793
Email: info@theplanetdrum.co.uk