Privacy Policy

1. Who we are

The Glasgow School of Music (GSofM) Limited, trading as The Glasgow School of Music, is a private music school providing one-to-one music tuition, online lessons, group learning opportunities, student support and related educational services.

For the purposes of UK data protection law, The Glasgow School of Music (GSofM) Limited is the data controller for the personal information described in this policy.

• Legal organisation: The Glasgow School of Music (GSofM) Limited
• Trading name: The Glasgow School of Music
• Company number: SC627435
• VAT number: 492185959
• ICO registration reference: ZB008963
• School address: 542 Scotland Street West, Kinning Park, Glasgow, G41 1BZ
• Email: info@theglasgowschoolofmusic.co.uk
• Telephone: 07922 546713

If you have any questions about this Privacy Policy or how we handle personal information, please contact us using the details above.

2. Personal information we collect

The information we collect depends on how you interact with us. We may collect and use the following types of personal information.

Enquiries and trial lesson requests

• Parent, guardian, student or adult learner name
• Email address and telephone number
• Student age or age range
• Chosen subject or instrument
• Musical experience, goals and lesson preferences
• Availability and preferred lesson times
• Messages submitted through website forms or by email

Student and parent or guardian records

• Student name, age and lesson details
• Parent or guardian contact details where the student is under 18
• Lesson timetable, attendance, cancellations and planned absences
• Lesson notes, progress information and relevant educational details
• Invoice, payment and account records
• Communication history with administration or tutors where relevant to school management
• Consent, permission and preference records connected to optional photography, recording, testimonials or publicity

Safeguarding, welfare and access information

Where necessary, we may collect limited information about safeguarding, welfare, access needs, medical considerations, disability, additional support needs or other relevant circumstances. We only collect this information where it is needed to support safe and appropriate tuition, student welfare, reasonable adjustments, safeguarding responsibilities or legal obligations.

Tutor, staff and applicant information

• Name, contact details and application information
• CV, qualifications, experience and references
• PVG, safer recruitment and right-to-work information where applicable
• Employment, payroll, attendance and administrative records
• Communication records relating to employment, teaching, safeguarding or school operations

Website and technical information

• Information submitted through contact forms, trial lesson forms or application forms
• Website usage information, where analytics tools are enabled
• Cookie preferences and consent choices
• Technical information such as browser type, device type, approximate location, IP address and pages visited, where collected by website tools or security systems

Optional images, recordings and testimonials

Where separately agreed, we may collect photographs, audio or video recordings, performance material, quotations, testimonials and the permissions or restrictions attached to their use. These are not treated as a routine condition of receiving lessons.

Privacy requests and complaints

Where you exercise a data protection right or make a privacy complaint, we may collect the request, correspondence, relevant account or identity information, investigation notes and outcome records needed to handle the matter lawfully and securely.

3. How we collect personal information

We may collect personal information when you:

• Submit an enquiry through our website
• Request or attend a trial lesson
• Register for lessons or create a student record
• Use our student administration systems
• Communicate with us by email, telephone, text message or in person
• Make payments or receive invoices
• Apply to work with us
• Use our website or accept optional website cookies

We may also receive information from parents, guardians, students, tutors, referees, professional advisers, payment providers, safeguarding bodies or school administration platforms where this is relevant to our services.

Where personal information is obtained from another source rather than directly from the person concerned, we provide the required privacy information within the applicable period, normally within one month, unless a lawful exception applies or the person already has the information.

4. Why we use personal information

We use personal information for the following purposes:

• To respond to enquiries and trial lesson requests
• To match students with suitable tutors and lesson routes
• To provide music lessons and related educational services
• To manage timetables, attendance, absences, cancellations and make-up arrangements
• To issue invoices, process payments and manage student accounts
• To communicate with students, parents, guardians, tutors and staff
• To record student progress and support continuity of tuition
• To manage safeguarding, welfare and student safety responsibilities
• To recruit, employ and manage tutors and staff
• To maintain accurate administrative, financial and business records
• To improve our website, services, communications and user experience
• To manage data protection rights requests, privacy complaints, security incidents and personal-data breaches
• To use optional photographs, recordings, testimonials or publicity material where an appropriate lawful basis and permission framework applies
• To comply with legal, tax, accounting, employment and safeguarding obligations
• To protect the rights, safety and legitimate interests of students, families, staff and the school

Information needed to provide services

Names, contact details, student and lesson information, availability, billing details and relevant account records are normally needed to respond to an enquiry, arrange a trial, enter into or manage a tuition agreement, and administer payment. If this information is not provided, we may be unable to offer or continue the requested service.

Health, disability, access, welfare and safeguarding information is requested only where relevant. Not providing relevant information may limit our ability to assess an adjustment, plan suitable support or manage a safety concern.

5. Our lawful bases for using personal information

Under UK data protection law, we must have a lawful basis for using personal information. Depending on the situation, we may rely on one or more of the following lawful bases.

This table is intended as a practical guide. The lawful basis may vary depending on the specific context, the type of information involved and any legal, safeguarding or operational obligation that applies.

Contract

We use personal information where it is necessary to provide lessons, manage student accounts, process bookings, issue invoices and deliver agreed tuition and school services.

Legitimate interests

We use personal information where it is necessary for the legitimate operation of our school, provided those interests are not overridden by the rights and freedoms of the person concerned. This may include responding to enquiries, managing lesson schedules, communicating with families, improving services, maintaining records and protecting the school from misuse or non-payment.

Legal obligation

We use personal information where required by law, including tax, accounting, employment, safeguarding, health and safety, regulatory or statutory record-keeping obligations.

Consent

We may rely on consent for certain optional uses of personal information, such as non-essential website cookies, optional marketing communications, publication permissions or specific uses of images and recordings. Consent must be freely given, specific and capable of being withdrawn. Where we rely on consent, you can withdraw it at any time, although withdrawal does not affect processing already carried out lawfully.

Vital interests

In rare situations, we may use personal information where necessary to protect someone’s life or immediate safety.

Special category information

Where we need to use information about health, disability, access needs or other special category matters, we identify both an Article 6 lawful basis and a separate Article 9 condition. Depending on the circumstances, the Article 9 condition may include explicit consent, vital interests, employment obligations, legal claims or a specific substantial public interest condition under the Data Protection Act 2018.

Explicit consent is not assumed merely because information has been volunteered. Where it is used, it must be an express, specific statement covering the relevant special-category information and purpose. Where a substantial-public-interest condition is relied on, the particular statutory condition and any requirement for an appropriate policy document must also be satisfied.

Criminal offence information

Where recruitment, PVG, safeguarding or legal processes involve criminal offence information, we use it only where an Article 6 lawful basis and an applicable condition under the Data Protection Act 2018 are available, with access restricted to appropriate personnel.

6. Children and young people

Many of our students are children or young people. We take additional care when handling information relating to students under 18.

Where a student is under 18, we will normally communicate with a parent or guardian about administration, payments, scheduling, safeguarding and lesson arrangements. We may also hold relevant student information needed to provide appropriate tuition and maintain safe school operations.

Where privacy information is provided directly to a child or young person, we aim to explain it in clear, age-appropriate language, including relevant risks, safeguards and choices.

Data protection rights belong to the child. A parent, guardian or authorised representative may exercise a right on the child’s behalf where appropriate, taking account of the child’s age, understanding, wishes and ability to act for themselves.

When sharing or publishing children’s information, we take additional care, consider the child’s best interests and use a high level of privacy by default.

We ask parents and guardians to provide accurate information and to inform us of any relevant changes that may affect a student’s lessons, safety, access needs or welfare.

7. Student administration systems and third-party services

We may use trusted third-party systems to help operate the school. These may include student administration platforms, website hosting, email services, payment providers, analytics tools, security tools, form plugins and cloud-based business systems.

For example, we may use systems such as My Music Staff for student scheduling, invoices, attendance records, lesson notes and parent/student portal access.

Where a provider acts as our processor, we require an appropriate written contract and permit it to use personal information only on our documented instructions, subject to its security, confidentiality, assistance and deletion or return obligations.

Some providers may act as independent controllers for their own legal, fraud-prevention, payment, professional or service obligations. In those cases, their own privacy notice and lawful responsibilities also apply.

Third-party platforms may publish their own privacy notices explaining their role, hosting locations, subprocessors and international-transfer arrangements.

8. Who we share personal information with

We do not sell personal information. We only share personal information where necessary, appropriate and lawful.

We may share information with:

• Students, parents or guardians where relevant to lessons and administration
• Tutors and staff involved in providing lessons or school support
• Student administration, scheduling and invoicing platforms
• Payment providers, accountants, bookkeepers and professional advisers
• Website, email, hosting, security and IT service providers
• PVG, recruitment, payroll or employment service providers where applicable
• Safeguarding, welfare, legal or regulatory bodies where required or appropriate
• Law enforcement, courts, regulators or public authorities where legally required

We share only the information reasonably needed for the relevant purpose and restrict internal access on a proportionate need-to-know basis. Safeguarding, welfare, health, disability and complaint information may require particularly limited access.

Where necessary to protect a child or adult at risk, investigate suspected wrongdoing, establish or defend legal claims, comply with law or respond to a competent authority, information may be disclosed without consent where another lawful basis and any required special-category or criminal-offence condition applies.

9. Marketing communications

We may send service-related communications about lessons, invoices, schedules, policy updates, planned absences, school operations, safety information or student administration. These are not marketing messages and are necessary for the operation of our services.

We may send marketing or promotional communications only where we have a lawful basis to do so and comply with applicable electronic marketing rules. Where consent is required, we will ask for it. You can opt out at any time by using an unsubscribe route where provided or by contacting us. Opting out of marketing does not stop essential service communications about lessons, invoices, safety or school administration.

We will not use children’s personal information for direct marketing without appropriate safeguards and permissions.

Photography, recordings, testimonials and publicity

Student photography, audio, video, lesson recording, testimonials, quotations and reuse of student work are not treated as routine conditions of tuition. Where material is intended for optional publicity, social media, press, awards or promotional use, GSofM will normally seek specific permission and explain the intended purpose and channels.

For a child or young person, the permission process will take account of the child’s age and understanding as well as appropriate parent or guardian permission. Permission may be limited to particular material or uses and can be withdrawn for future use where consent is the lawful basis. Withdrawal may not require recall of material already lawfully printed, published or supplied to third parties before withdrawal.

10. How long we keep personal information

We keep personal information only for as long as necessary for the purposes described in this policy, including legal, accounting, tax, safeguarding, educational, contractual and operational requirements.

Typical retention periods may include:

• General enquiries: normally up to 24 months unless the enquiry becomes an active student, staff or business record
• Student and parent records: for the duration of tuition and normally up to 6 years afterwards where needed for contracts, accounts, complaints or legal claims; routine scheduling information may be deleted earlier
• Invoices and payment records: normally at least 6 years for accounting and tax purposes
• Safeguarding and welfare records: retained according to the nature and seriousness of the matter, the age of the student, applicable safeguarding guidance, legal advice and any continuing need to protect individuals
• Unsuccessful applicant information: normally up to 6 months after the recruitment process unless a longer period is agreed or required for a continuing legal matter
• Employment and tutor records: retained in line with employment, tax, payroll, safeguarding, contractual and legal-claims requirements; different parts of the record may have different retention periods
• Website analytics and cookie data: retained according to the relevant tool settings and consent preferences
• Optional photographs, recordings and testimonials: retained for the approved use period, while the material remains in active use, or until reviewed or withdrawn where consent is the lawful basis; permission and withdrawal records may be retained for longer where needed to demonstrate compliance
• Rights requests and privacy complaints: retained for as long as reasonably necessary to handle the matter, demonstrate the response and meet legal, regulatory, insurance or legal-claims requirements

We may keep limited records for longer where required to establish, exercise or defend legal claims, comply with legal obligations, handle complaints or protect the safety of students, families, staff or the school. When information is no longer required, we delete it securely or anonymise it where appropriate.

11. How we protect personal information

We take reasonable technical and organisational steps to protect personal information from unauthorised access, loss, misuse, alteration or disclosure.

These measures may include:

• Limiting access to personal information to staff and tutors who need it
• Using password-protected systems and secure account access where available
• Maintaining appropriate administrative controls
• Using trusted third-party platforms for school administration, hosting and communication
• Keeping safeguarding and welfare information restricted to appropriate personnel
• Reviewing records and deleting or archiving information where it is no longer needed

No system can be guaranteed completely secure, but we aim to handle personal information responsibly and proportionately.

If we become aware of a personal data breach that is likely to result in a risk to individuals’ rights and freedoms, we will assess our reporting obligations and take appropriate action in line with data protection law.

12. International transfers

Some service providers may store, access or process personal information outside the United Kingdom. Where our use of a provider involves a restricted transfer, we take reasonable steps to ensure that it is covered by UK adequacy regulations, appropriate safeguards or an applicable legal exception.

Appropriate safeguards may include the UK International Data Transfer Agreement, the UK Addendum to approved EU standard contractual clauses, and the required data protection test, still commonly described in ICO guidance as a transfer risk assessment, together with any additional protection required in the circumstances.

Where a provider relies on UK adequacy regulations, the UK Extension to the EU–US Data Privacy Framework, an IDTA, the Addendum or another permitted route, the applicable mechanism may change over time. You may contact us for further information about the safeguard relevant to your information.

13. Your data protection rights

Depending on the circumstances, you may have the following rights in relation to your personal information:

• The right to be informed about how your information is used
• The right to access your personal information
• The right to have inaccurate information corrected
• The right to request deletion of your information
• The right to restrict certain processing
• The right to object to certain processing, including an absolute right to object to direct marketing
• The right to data portability in certain circumstances
• The right to withdraw consent where we rely on consent
• Rights relating to solely automated decisions that have legal or similarly significant effects
• The right to complain to the Information Commissioner’s Office

These rights are not absolute and may depend on the lawful basis, the type of information and any legal or safeguarding obligations that apply.

Where we rely on consent, withdrawing it does not affect the lawfulness of processing carried out before withdrawal. We do not currently use personal information to make solely automated decisions that produce legal or similarly significant effects.

To exercise a right, contact us at info@theglasgowschoolofmusic.co.uk. A request can be made verbally or in writing. Where identity is uncertain, we may request only the additional information reasonably necessary to confirm identity or authority to act.

We normally respond without undue delay and within one calendar month after receiving the request or, where necessary, the information required to confirm identity. For a complex request or several requests from the same person, the period may be extended by up to two further months; if so, we will explain the extension and reasons within the first month.

Rights requests are normally handled without charge. Data protection law permits a reasonable fee or refusal only in limited circumstances, including where a request is manifestly unfounded or excessive. For access requests, we carry out a reasonable and proportionate search and provide information securely in a clear and accessible form.

14. Data protection complaints

You can make a data protection complaint if you believe GSofM has not handled personal information or a data protection right correctly. Email info@theglasgowschoolofmusic.co.uk using the subject line Data Protection Complaint – GSofM, or use our Complaints, Concerns & Feedback route.

GSofM will acknowledge receipt within 30 days, take appropriate steps to investigate and respond without undue delay, keep you informed where the investigation remains ongoing, and communicate the outcome without unjustifiable or excessive delay.

Please identify the information, event or right involved, explain what you believe went wrong and state the outcome or clarification sought. We may request relevant information needed to understand the complaint or verify identity.

You can complain to the Information Commissioner’s Office at any point. The ICO will commonly ask whether the matter has first been raised with the organisation so it has an opportunity to investigate and put things right.

15. Cookies and website tracking

Our website may use cookies and similar technologies to make the site work, improve performance, understand website usage and support embedded services.

Strictly necessary cookies may operate without consent where permitted by law. Non-essential analytics, advertising or similar technologies are used only where the required consent has been obtained, and consent preferences can be changed through the available website controls.

For more information, please read our Cookie Policy.

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, website, systems, legal obligations or school operations.

The latest version will be published on this page with the updated date shown above. Where a change materially affects how we use information, we may provide an additional notice through an appropriate school communication route.