Privacy Notice for Schools

WHAT IS PERSONAL DATA?

i) ‘Personal data’ means information which relates to a living person who can be identified from that data (a ‘data subject’) on its own, or when taken together with other information which is likely to come into our possession. It includes any expression of opinion about the person and an indication of the intentions of us or others, in respect of that person. It does not include anonymised data.

ii) This policy applies to all personal data whether it is stored electronically, on paper or on other materials.

WHO WE ARE

i) Edubox (the trading name for Learn Create Play Ltd) is committed to protecting and respecting your privacy. This policy, together with any other documents referred to within, sets out the basis on which we will process any personal data that we collect from you, or that you provide to us. Please read the following carefully to understand our views and practices regarding your personal data and how we treat it.

ii) For the purpose of the Data Protection Act 1998 (Act)/EU General Data Protection Regulation (GDPR) effective from 25th May 2018, the data controller is Learn Create Play trading as Edubox, Flat 7, Chine View Mansions, 2 Mckinley Road, Bournemouth, Dorset, BH4 8AQ, UK.

WHAT IS THE LEGAL BASIS FOR PROCESSING YOUR PERSONAL DATA?

i) The basis for processing any personal data relating to your school is that Edubox has a legitimate interest as the Lead Organisation for the Kirklees Music Education Hub and also because the personal data that you supply us with is necessary for the purposes of the performance of a contract (eg our agreement to provide musical instrument tuition services).

ii) Edubox is an educational provider and we are committed to working with schools and partners to provide musical opportunities for children between 5 to 18.

WHAT WE USE YOUR PERSONAL DATA FOR?

Edubox aims to liaise with schools regarding the school's needs and requirements in relation to extra curricular activities. Edubox undertakes a programme of school visits to meet with the relevant person in that school responsible for music. This may be the Headteacher/Head of Music/Music Co-ordinator.

WHAT KIND OF INFORMATION DO WE HOLD ABOUT YOU?

i) We may retain the name and email address of the following individuals in school:-

 The Headteacher

 The Head of Music/Music Co-ordinator/person responsible for music

 The Administrator in school

ii) We may collect information in the following ways:-

 Face to face

 Telephone

 In writing

 Email

 Electronically (ie via the school’s website)

WHO DO WE SHARE INFORMATION WITH?

i) The information that we hold is not shared with any third parties

ii) We will contact you in order to engage in an Information Sharing Agreement (ISA) between Edubox and the school. Upon the receipt of a signed ISA we will supply the following information to the school that each student attends. Individuals have been made aware of this information via our ‘Privacy Notice for Parents’ available to view on Edubox’ website (www.educationbox.co).

 Forename and surname of pupil

 The duration of the lesson

 The instrument the pupil studies

 The year group the student is in

 The day and time that lessons will take place in school. This will be communicated in writing in September and amendments during the rest of the academic year may be communicated verbally by the teacher concerned.

iii) In the instances when schools purchase tuition from Edubox, it is expected that a Service Level Agreement will be signed by the school. In order to assist with Edubox teaching, it would be beneficial for schools to provide a list of forenames to the member of teaching staff however this would be at the schools’ discretion and in accordance with your own Privacy Notice.

HOW WE DEFINE PROCESSING

‘Processing’ means any operation which is performed on personal data such as:

i) collection, recording, organisation, structuring or storage

ii) adaption or alteration

iii) retrieval, consultation or use

iv) disclosure by transmission, dissemination or otherwise making available

v) alignment or combination vi) restriction, destruction or erasure.

vii) this includes processing personal data which forms part of a filing system and any automated processing.

EXAMPLES OF WHEN WE MIGHT PROCESS YOUR PERSONAL DATA

i) Edubox may contact the Headteacher to inform them of relevant Enhanced DBS checks relating to Edubox staff visiting your school.

ii) Edubox may contact the Headteacher/Head of Music/Music Coordinator/Administrator when sending the following out:-

 An Information Sharing Agreement out

 Information regarding the purchase of Activities from Edubox (ie a Service Advice/Service Level Agreement etc)

 Accommodation Forms relating to the following academic year

 Instrument Loan Agreement (if applicable)

HOW LONG DO WE RETAIN YOUR DATA?

We will only use and store the personal data for as long as it is required for the purposes it was collected for. How long it will be stored for depends on the information in question, what it is being used for and, sometimes, statutory legal requirements.

FURTHER PROCESSING

If we wish to use your personal data for a new purpose which is not covered by this Privacy Notice then we will provide you with a new notice explaining this new use prior to commencement of the new purpose.

MARKETING

Occasionally Edubox would like to contact you with information regarding products and services that we provide. You have the right to modify or withdraw your consent at any time by contacting hello@educationbox.co

SECURITY

i) Edubox is committed to ensuring your information is secure in order to prevent unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures to safeguard the information we collect.

YOUR DATA SUBJECTS RIGHTS

i) You have the right to information about what personal data we process, how and on what basis as set out in this policy (see section 15 Appendix A – Subject Access Request Form).

ii) You have the right to access your own personal data by way of a Subject Access Request.

iiI) You can correct any inaccuracies in your personal data. To do so, you should contact the Data Protection Manager. Document 12 – Privacy Notice for Schools 9

iv) You have the right to request that we erase your personal data where we were not entitled under the law to process it or it is no longer necessary to process it for the purpose it was collected. To do so you should contact the Data Protection Manager.

v) While you are requesting that your personal data is corrected or erased or are contesting the lawfulness of our processing, you can apply for its use to be restricted while the application is made. To do so you should contact the Data Protection Manager.

vi) You have the right to object to data processing where we are relying on a legitimate interest to do so and you think that your rights and interests outweigh our own and you wish us to stop.

vii) You have the right to object if we process your personal data for the purposes of direct marketing.

viii) You have the right to receive a copy of your personal data and to transfer your personal data to another data controller. We will not charge for this and will in most cases aim to do this within one month. iv) If we receive a request from you to exercise any of the above rights, we will ask you to verify your identity before acting on the request. This is to ensure that your data is protected and secure.

x) You have the right to be notified of a data security breach concerning your personal data.

xi) In most situations we will not rely on your consent as a lawful ground to process your data. If we do however request your consent to the processing of your personal data for a specific purpose, you have the right not to consent or to withdraw your consent later. To withdraw your consent, you should contact the Data Protection Manager.