Privacy policy

Freddie Vokes School of Performing Arts ("FVSPA", "we", "us" or "our") is the data controller for this website, our classes and the members area at members.freddievokesperformingarts.co.uk. This notice explains what personal information we use, why we use it, who can see it, how long we keep it and the rights available under UK data protection law.

The privacy notice is information, not a contract. We do not ask you to consent to every use of personal information. Where consent is the appropriate lawful basis, such as for optional marketing, we ask for it separately and you can withdraw it at any time.

Personal Information We Collect or Process

When we use the term "personal information," we are referring to information that identifies or can reasonably be linked to you or another person. Personal information does not include information that is collected anonymously or that has been de-identified, so that it cannot identify or be reasonably linked to you. We may collect or process the following categories of personal information, depending on how you interact with the Services and as permitted or required by applicable law:

• Contact details including your name and email address, and any phone number or other details you choose to include when you contact us.
• Communications with us including the content of any message you send through our contact form or by email, phone or otherwise.
• Device information including information about your device, browser, or network connection, your IP address, and other unique identifiers, which our hosting provider records automatically when you visit.
• Usage information including which pages you request and when, recorded in the technical logs kept by our hosting provider and, in anonymous aggregated form, by our website analytics.
• Members area account information including the adult account holder's email address and authentication details, the name of the child or adult performer attending, choir section, voice part, account status and role.
• Attendance and participation information including event responses, attendance records and the dates on which event, announcement and file updates were viewed.
• Emergency contact information including the contact's name and telephone number. Please tell that person that you have given us their details and point them to this notice.
• Administration and security information including approval and role changes, sign-in dates and counts, audit records and technical records needed to keep the service secure.
• Files and content uploaded by authorised staff. These are intended to be choir materials, but may contain personal information where this is necessary.

Personal Information Sources

We may collect personal information from the following sources:

• Directly from you including when you fill in our contact form, email or phone us, or otherwise provide us with your personal information;
• Automatically through the Services including from your device when you visit our website;
• From our service providers including when they collect or process your personal information on our behalf.

How and Why We Use Personal Information

UK data protection law requires us to identify a lawful basis for each purpose. We use personal information as follows:

• Enquiries, enrolment and class administration — contract. We use contact and performer details to answer pre-enrolment enquiries, provide agreed classes and services, communicate essential information and administer the relationship with you.
• Members area and events — contract. We use account, performer, section, voice-part, event-response and attendance information to provide the members service and organise rehearsals, classes and events.
• Membership decisions, attendance planning and service improvement — legitimate interests. We have a legitimate interest in approving the right people, maintaining accurate registers, planning staffing and facilities, and improving the service. We balance these interests against the rights of account holders and children.
• Account security, administration and audit — legitimate interests. We use authentication, role, sign-in and audit information to restrict access, investigate problems and protect FVSPA, performers and members.
• Emergency contacts — legitimate interests and, in an emergency, vital interests. We keep emergency contact details so authorised staff can respond appropriately. Where necessary to protect someone's life, we may use or share them on the vital-interests basis.
• Legal, safeguarding and regulatory duties — legal obligation or legitimate interests. We may use relevant information to meet duties, respond to valid legal process, establish or defend legal claims, and protect children and other people.
• Optional marketing — consent. Where consent is required, we send optional promotional messages only after a clear opt-in. You can withdraw consent at any time without affecting essential service messages.

If we ever need health, accessibility or other special-category information, we will explain why it is needed, minimise what we collect and identify both an Article 6 lawful basis and an Article 9 condition before using it.

How We Disclose Personal Information

In certain circumstances, we may disclose your personal information to third parties for legitimate purposes subject to this Privacy Policy. Such circumstances may include:

• With the service providers listed below, who perform services on our behalf (such as website hosting, email delivery and forwarding, and members area technology).
• When you direct or request us, or otherwise consent, to our disclosure of certain information to third parties.
• In connection with a business transaction such as a merger or bankruptcy, to comply with any applicable legal obligations (including to respond to subpoenas, search warrants and similar requests), to enforce any applicable terms of service or policies, and to protect or defend the Services, our rights, and the rights of our users or others.

We do not sell your personal information, and we do not use it for advertising.

Who Can See Members Area Information

Access is role-based. The adult account holder can see and update their own performer profile and emergency contact. Authorised staff who take attendance can see a contact-free directory containing the performer's name and relevant choir information. Membership administrators and authorised staff with member-contact access can view account details and emergency contacts when needed for their duties. Administrators may also access the same information through the restricted Firebase administration console for support, security and data-management purposes.

Access is not granted simply because someone helps with FVSPA. It must be necessary for their role, and people with access are expected to keep the information confidential.

Our Service Providers

We use the following providers to run the Services. Each processes personal information on our behalf, or as an independent controller in accordance with its own privacy notice, and may be located in countries other than where you reside:

• Vercel hosts this website, keeps technical server logs such as IP addresses, and provides the cookieless Vercel Web Analytics described above. See the Vercel Privacy Policy.
• Resend delivers the messages you send through our contact form to our inbox. See the Resend Privacy Policy.
• Cloudflare manages our domain's DNS and forwards emails sent to our addresses (such as info@freddievokesperformingarts.co.uk) to our team's email inboxes. See the Cloudflare Privacy Policy.
• Google Fonts supplies the typefaces and icons used on this website, but only if you accept "Fonts and icons" on our cookie banner. Your browser then requests them directly from Google, which receives your IP address when it does so. See the Google Privacy Policy.
• Tailwind CSS supplies the code that styles this website through its content delivery network, which receives your IP address when your browser loads it. This is necessary for the website to display correctly.
• Firebase (Google) provides authentication, database and file-storage services for the members area. See the Google Privacy Policy.
• Vercel also hosts the members area and may process request and security logs needed to deliver it.

Cookies and Similar Technologies

This website does not set cookies and does not use advertising technologies. We use Vercel Web Analytics to count visits and see which pages are viewed. It is cookieless: it does not store anything on your device or track you across websites, and it records only anonymous, aggregated information such as pages viewed, referring website, country, browser and device type. When you make a choice on our cookie banner, we save that choice in your browser's local storage on your own device, so that we do not ask you again. This is strictly necessary for the banner to work and is not sent to us. You can change or withdraw your choice at any time using the "Cookie settings" link in the footer of every page.

If you accept "Fonts and icons", your browser loads our typefaces and icons from Google Fonts, which receives your IP address (see below). If you reject, nothing is requested from Google Fonts and the site uses your device's standard fonts. Our members area may use cookies or similar technologies that are strictly necessary to keep you signed in.

Third Party Websites and Links

The Services may provide links to websites or other online platforms operated by third parties. If you follow links to sites not affiliated or controlled by us, you should review their privacy and security policies and other terms and conditions. We do not guarantee and are not responsible for the privacy or security of such sites, including the accuracy, completeness, or reliability of information found on these sites. Information you provide on public or semi-public venues, including information you share on third-party social networking platforms may also be viewable by other users of the Services and/or users of those third-party platforms without limitation as to its use by us or by a third party. Our inclusion of such links does not, by itself, imply any endorsement of the content on such platforms or of their owners or operators, except as disclosed on the Services.

Children and Guardian Accounts

The public website and members account are intended to be used by parents, carers and other adults. An adult manages a members account on behalf of a child performer. We process the child's name, choir information and attendance because they are the person receiving the service. Children have data-protection rights in their own information, and we take their age and interests into account when deciding whether and how to use it.

The adult creating or managing the account must have authority to provide the child's information and should explain this notice to the child in an age-appropriate way. Please contact us if a child's information is inaccurate, no longer needed or has been provided without appropriate authority.

Security and Retention of Your Information

Please be aware that no security measures are perfect or impenetrable, and we cannot guarantee "perfect security." In addition, any information you send to us may not be secure while in transit. We recommend that you do not use unsecure channels to communicate sensitive or confidential information to us.

We keep enquiry correspondence only for as long as needed to answer and follow up the enquiry. Members-area profiles, attendance records, emergency contacts and routine audit information are kept while the membership is active and normally for no more than 12 months after the account is deactivated or the membership ends, after which they are deleted or anonymised unless a longer period is needed for a legal claim, safeguarding matter or legal obligation. Financial and transaction records may be kept for up to six years where required for tax, accounting or legal purposes. Backups and provider logs may persist for a short additional period under controlled deletion cycles.

We review inactive accounts and do not keep information merely because it might be useful one day.

Your Rights and Choices

Under UK data protection law, you may have the following rights. These rights are not absolute and the right that applies can depend on our lawful basis.

• Right to Access / Know. You may have a right to request access to personal information that we hold about you.
• Right to Delete. You may have a right to request that we delete personal information we maintain about you.
• Right to Correct. You may have a right to request that we correct inaccurate personal information we maintain about you.
• Right of Portability. You may have a right to receive a copy of the personal information we hold about you and to request that we transfer it to a third party, in certain circumstances and with certain exceptions.
• Managing Communication Preferences. You may ask us at any time to stop contacting you, using the contact details below. We may still contact you where necessary about an enquiry or booking you have made.

You may also have the following rights:

• Objection to Processing and Restriction of Processing: You may have the right to ask us to stop or restrict our processing of personal information for certain purposes.
• Withdrawal of Consent: Where we rely on consent to process your personal information, you have the right to withdraw this consent. If you withdraw your consent, this will not affect the lawfulness of any processing based on your consent before its withdrawal.

You may exercise these rights using the contact details below. We may need to verify identity and, for a request about a child, the authority to act for that child. We normally respond within one month as required by law.

Required and Optional Information

Information marked as required is needed to create and approve an account or provide the requested class or service. If it is not provided, we may be unable to provide that service. Optional fields can be left blank. We do not use solely automated decision-making or profiling that produces legal or similarly significant effects.

Complaints

If you have complaints about how we process your personal information, please contact us using the contact details provided below. Depending on where you live, you may have the right to appeal our decision by contacting us using the contact details set out below, or lodge your complaint with your local data protection authority. In the UK, this is the Information Commissioner's Office. For the EEA, you can find a list of the responsible data protection supervisory authorities here.

International Transfers

Please note that we may transfer, store and process your personal information outside the country you live in, because some of our service providers are located or operate outside the UK.

If we transfer your personal information out of the European Economic Area or the United Kingdom, we will rely on recognized transfer mechanisms like the European Commission's Standard Contractual Clauses, or any equivalent contracts issued by the relevant competent authority of the UK, as relevant, unless the data transfer is to a country that has been determined to provide an adequate level of protection.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time, including to reflect changes to our practices or for other operational, legal, or regulatory reasons. We will post the revised Privacy Policy on this website, update the "Last updated" date and provide notice as required by applicable law.

Contact

Should you have any questions about our privacy practices or this Privacy Policy, or if you would like to exercise any of the rights available to you, please call 07964 824752 or email us at info@freddievokesperformingarts.co.uk or contact us at Freddie Vokes School of Performing Arts, 3 Robinson Rd, Mapperley, Nottingham NG3 6BA, United Kingdom. For the purpose of applicable data protection laws, we are the data controller of your personal information.