DATA PROTECTION POLICY

1. This document describes the means by which Dance Junction will comply with new EU regulations known as the General Data Protection Regulation (GPDR), which came into force on 25 May 2018 and updated the UK Data Protection Act 1998.

2. The lawful basis for the collection and storing of data is that Dance Junction needs to know, for each student, their name, age and contact details of parents/guardians. Without this information, the school cannot run its weekly classes.

3. To comply with the GPDR Dance Junction will:

a. Appoint a Data Controller responsible to the school for the implementation of this Policy.

b. Provide all students and parents/guardians with a GPDR Privacy Notice explaining why data is being collected and what will be done with it.

c. Ensure that all students’ parents/guardians positively ‘opt-in’ to their data being collected.

d. Ensure that electronically-held personal data is password-protected.

e. Ensure that reasonable and proportionate measures are taken to prevent unauthorised viewing or theft of hard-copy personal data.

f. Respond to any subject access request within the statutory 30 days. The Data Controller is responsible for responding to subject access requests.

g. Normally retain data indefinitely for the purpose of maintaining a historical record but remove an individual’s data if asked to do so via a subject access request.

h. Only collect personal data that is necessary for the running of Dance Junction, as follows:

contact details of students (name, date of birth, address, telephone and email address);
medical conditions (which may affect the students learning of dance and wellbeing during lessons)
contact details of emergency contact (name and telephone number);
basic contact details (name, address and phone number) of teachers and volunteers.

i. From time to time, process post hoc aggregated data for the purpose of managing the school (for example, estimating how much time must be allocated for classes and performances).

j. Place this policy and the GPDR on the school website.

4. Dance Junction will not:

a. Place any personal data online or on the school website, other than posting the forenames of students involved in newsworthy events.

b. Share personal data with any other organisation.

c. Be responsible for data relating to the school which has been collected by other persons or agencies.

5. This policy has been approved by the school principal. All questions regarding this policy should be addressed to the Data Controller.