Merton Music foundation (MMF) understands that your privacy is important to you and that you care about how your personal data is used. We respect and value the privacy of all our parents’ information and will only collect and use personal data in ways that are described here, and in a way that is consistent with our obligations and your rights under the law. This policy explains how we use your personal data: how it is collected, how it is held and how it is processed. It also explains your rights under the law relating to your personal data.
What is personal data?
Personal data is defined by the General Data Protection Regulation (EU Regulation 2016/679) (the “GDPR”) as ‘any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier’. Personal data is, in simpler terms, any information about you that enables you to be identified. Personal data covers obvious information such as your name and contact details, but it also covers less obvious information such as identification numbers, electronic location data, and other online identifiers.
What are your rights?
Under the GDPR, you have the following rights, which we will always work to uphold:
- The right to be informed about our collection and use of your personal data. This Policy should tell you everything you need to know, but you can always contact us to find out more.
- The right to access the personal data we hold about you.
- The right to have your personal data rectified if any of your personal data held by us is inaccurate or incomplete.
- The right to be forgotten, i.e. the right to ask us to delete or otherwise dispose of any and all of your personal data that we have.
- The right to restrict (i.e. prevent) the processing of your personal data.
- The right to object to us using your personal data for a particular purpose or purposes.
Further information about your rights can also be obtained from the Information Commissioner’s Office or your local Citizens Advice Bureau. If you have any cause for complaint about our use of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office.
What types of data do we collect?
If you complete a registration form on-line or submit a registration form manually , we will need to know your name, both home and e-mail address and your phone numbers. We will ask for personal information from your child their date of birth, the school your child attends and your child’s ethnic group.
In terms of payments we will only take any credit card or debit card information from you by phone and this information is shredded by us once the payment has been made. Any on-line payment you make is processed through Sagepay who receive transaction details directly over an encrypted secure channel, exchanging digitally signed messages to register the transaction and notify you directly of the authorisation results.
How do we use your data?
Under the GDPR, we must always have a lawful basis for using personal data. This may be because the data is necessary for our performance of a contract with you.
Specifically we may need to pass some of the information to ABRSM for practical examinations. Child level data may be shared with Merton Council as well as Arts Council England and the Department of Education. Data will not be shared with any other third parties without your prior consent.
How long will we keep your personal data?
We won’t keep your personal data for any longer than is necessary in respect of the reason(s) for which it was first collected.
The storage of your personal data
To prevent unauthorised access or disclosure we have put in place suitable physical, electronic and managerial procedures to safeguard and secure any information wereceive from you.
Please note that our website may contain links to enable you to visit other websites of interest easily. However, once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question. If you would like to know more about the specific third-party links which we use on our website, please write to us for details.
How can you access your personal data?
If you want to know what personal data we have about you, you can ask us for details of that personal data and for a copy of it (where any such personal data is held). This is known as a “subject access request”. All subject access requests should be made in writing and addressed to Merton Music Foundation, Lilleshall Road, London SM4 6DU.
How do you contact us?
To contact us about anything to do with your personal data and data protection, including to make a subject access request, please use the following details:
Email address: firstname.lastname@example.org
Telephone number: 020 8640 5446
Postal Address: Merton Music Foundation, c/o Harris Academy Morden, Lilleshall Road, Morden, Surrey SM4 6DU
How do we update this policy?
This policy will be reviewed annually, or as and when legislative and regulatory requirements may warrant a revision and it will always be available on our website. If you would like us to send you a copy of the policy each time it is updated, please contact us to this end.