Section 1 Consent for Images

 

Section 2 GDPR

 

 

Section 1 Client/Parental Consent for Images

 

By ticking “Yes” in our registration form to the statement “I give consent to the Impresario Theatre School Image Policy which can be found in the Privacy Policy and have read and understood the conditions of use and are fully aware of the following”:

 

• Permission is valid from the date that you register for Impresario Theatre School.
• Media will remain on all Impresario Theatre School sites for as long as the data is needed and has purpose in accordance with our Privacy Policy and Image Use policy.
• We will not use the personal information or full names (which means first name and surname) of any child or adult in a photographic image or video on our website, online, in our prospectus or in any of our other printed publications.
• If we use photographs of individual clients/children, then we will not use the full name of that client/child in the accompanying text or photo caption.
• In exceptional circumstances, where articles are written based on client’s/children’s achievements (for example if they have successfully auditioned for a show or won a talent competition) we will seek explicit consent from the parent/guardian to use their name and picture together via another form for that purpose only!
• We may use group photographs or footage with general labels. We will only use images of children who are suitably dressed.
• We will discuss the use of images with children in an age appropriate way and to role model positive behaviour.
• This consent can be withdrawn by client/parent/carer at any time by informing Impresario Theatre School in writing or emailing impresariotheatreschool@gmail.com

 

Websites can be viewed worldwide and not just in the United Kingdom where UK law applies.

 

The press are exempt from the GDPR and may want to include the names and personal details of children and adults in the media.

 

Parent/guardian will discuss the use of images with your child/ren to obtain their views, if appropriate.

 

As the child’s parents/guardians, you agree that if we/I take photographs or video recordings of our child/ren which include other children, then we will only use these for our personal use.

 

You agree that if your child uses social media platforms to upload photos/videos taken at Impresario Theatre School they will seek consent from the parents of the people who appear in the photograph/video prior to uploading online. Impresario Theatre School will accept no responsibility for private images/videos posted to social media.

 

You agree Impresario Theatre School may use you or your child’s photograph/image in displays around the school/setting and offsite.

 

Impresario Theatre School may use you or your child’s photograph/image in our prospectus and other printed publications that we produce for publicity and promotional purposes (Leaflets, newspapers, magazines, Show programmes,)

 

Impresario Theatre School may use videos and images of you or your child on our website, social media platforms and other electronic communications (Impresario Theatre School Facebook pages, Instagram, YouTube channel, online features, articles and write ups about Impresario Theatre School).

 

You are happy for you or your child to appear in the media e.g. if a newspaper photographer or television film crew attend an event organised by the setting.

 

Image Use Policy

 

Impresario Theatre School Data Controller: Amy Rackliff (Principal)

 

Impresario Theatre School Designated Safeguarding Officer: Amy Rackliff (Principal)

 

Administrator with lead responsibility: Amy Rackliff

 

Official use of Images/Videos of Children and clients by the School/Setting

 

Scope and aims of the policy

 

• This policy seeks to ensure that images and videos taken within and by Impresario Theatre School are taken and held legally and the required thought is given to safeguarding all members of the community.
• This policy applies to all staff including, teachers, assistants, external contractors, visitors, volunteers and other individuals who work for or provide services on behalf of Impresario Theatre School (collectively referred to as ‘staff‘ in this policy) as well as clients, children and parents/carers.
• This policy must be read in conjunction with other relevant Impresario Theatre School policies including (but not limited to) safeguarding and child protection, code of conduct, behaviour, health and safety, mobile phone policy, privacy policy found in our terms and conditions.
• This policy applies to all images (including still and video content) taken by the school/setting.
• All images taken by the school/setting will be used in a manner respectful of the new GDPR legislations. This means that images will be:
• fairly and lawfully processed
• processed for specifically stated purposes only
• used in a way that is adequate, relevant and not excessive
• kept on file for no longer than is necessary
• processed in line with an individual’s legal rights
• kept securely
• adequately protected if transferred to other countries
• The Data Controller/DSL and Management team are responsible for ensuring the acceptable, safe use and storage of all camera technology and images within the setting/school. This includes the management, implementation, monitoring and review of the School/Settings Image Use Policy.

 

Parental/Client Consent

 

• Permission from parents/carers or clients (via our registration form) will always be obtained before images/videos of clients/children are taken, used or published by the school/setting.
• Client/parental consent will always be sought to take and use photographs offsite for professional, marketing and training purposes. This may be in addition to parental permission sought for onsite images.
• Consent from clients/parents will be kept by the setting where client/children’s images are used for publicity purposes (such as brochures or publications, social media sites), until the image is no longer in use.
• Client/Parental permission will be sought on an agreed basis from the day they register to attend services provided by Impresario Theatre School.
• A record of all consent details will be kept securely on file. Should permission be withdrawn by parents/carers/clients at any time, then all relevant images will be removed and disposed of and the record will be updated accordingly.

 

Safety of Images and Videos

 

• Staff will receive information regarding the safe and appropriate use of images as part of their safeguarding training and responsibilities.
• All members of staff (including volunteers) will ensure that all images are available for scrutiny and will be able to justify any images in their possession.
• Images will not be kept for longer than is to be considered necessary. A designated member of staff (Data Controller or DSL) will ensure that all photographs are permanently wiped from memory cards, computer hard and portable drives or other relevant devices once the images will no longer be of use.
• The Data Controller and/or DSL reserve the right to view any images taken and/or to withdraw or modify a member of staffs’ authorisation to take or make images at any time.
• Any apps, websites or third party companies used to share, host or access children’s images will be risk assessed prior to use.
• The school/setting will ensure that images always are held in accordance with the General Data Protection Regulation (GDPR) and suitable child protection requirements (if necessary) are in place.
• Photographs will be disposed of should they no longer be required. They will be returned to the parent or carer, deleted and wiped or shredded as appropriate. Copies will not to be taken of any images without relevant authority and consent from the Data Controller and/or DSL and the client/parent/carer.

 

Publication and sharing of images and videos

 

• Images or videos that include children will be selected carefully for use e.g. only using images of children who are suitably dressed.
• Images or videos that include clients/children will not provide material which could be reused.
• Client/Children’s full names will not be used on the website or other publication (e.g. newsletters, social media channels) in association with photographs or videos unless explicit consent has been given. For example, a student has a successfully auditioned for a role in a show and there is an article written about them.
• The school/setting will not include any personal addresses, emails, telephone numbers, fax numbers on video, on the website, in a prospectus or in other printed publications.

 

Usage of apps/systems to share images with parents

 

• Impresario Theatre School uses social and online platforms (Facebook, Instagram, You tube channel and our Impresario Theatre School website) to upload and share images of children.
• The uses of these systems have been appropriately risk assessed and the Principal has taken steps to ensure all data stored is held in accordance with the GDPR.
• All users of the aforementioned platforms are advised on safety measures to protect all members of the community e.g. using strong passwords, logging out of systems after use etc.
• Parents/carers will be informed of the Impresario Theatre School’s expectations regarding safe and appropriate use (e.g. not sharing passwords or copying and sharing images) prior to being given access. Failure to comply with this may result in access being removed.

 

Safe Practice when taking images and videos

 

• Careful consideration is given before involving clients, very young or vulnerable children when taking photos or recordings, who may be unable to question why or how activities are taking place.
• The school/setting will discuss the use of images with client, children and young people in an age appropriate way.
• A client, child or young person’s right not to be photographed is to be respected. Images will not be taken of any child or young person against their wishes.
• Photography is not permitted in sensitive areas such as changing rooms, toilets, etc.

 

Use of Images/Videos of Children by Others

 

Use of Photos/Videos by Parents/Carers

 

• Parents/carers are permitted to take photographs or video footage of events for private use only.
• Parents/carers who are using photographic equipment must be mindful of others (including health and safety concerns) when making and taking images.
• The opportunity for parents/carers to take photographs and make videos can be reserved by the school/setting on health and safety grounds.
• Parents/carers are only permitted to take or make recording within designated areas of the school/setting.
• Photography is not permitted in sensitive areas such as changing room, toilets etc.
• The right to withdraw consent will be maintained and any photography or filming on site will be open to scrutiny at any time.
• Parents may contact the school/setting Data Controller/DSL to discuss any concerns regarding the use of images.
• Photos and videos taken by the school/setting and shared with parents should not be shared elsewhere (e.g. posted on social media site), to do so may breach intellectual property rights, data protection legislation and importantly may place members of the community at risk of harm.

 

Use of Photos/Videos by Children

 

• The setting will discuss and agree age appropriate acceptable use rules with children regarding the appropriate use of cameras, such as places children cannot take the camera (e.g. unsupervised areas, toilets etc.).
• The use of personal devices e.g. mobile phones, tablets, children’s own digital cameras, is covered within the school/settings mobile phone policy found in our terms and conditions.
• All staff will be made aware of the acceptable use rules regarding children’s use of cameras and will ensure that children are appropriately supervised when taking images for official use.
• Members of staff will role model positive behaviour to the children by encouraging them to ask permission before they take any photos.
• Photos taken by children for official use will only be taken with parental consent and will be processed in accordance with the General Data Protection Regulation (GDPR).
• Parents/carers will be made aware that children will be taking photos/videos of other children and will be informed how these images will be managed by the setting e.g. will be for internal use by the setting only (not shared online or via any website or social media too).
• Photos taken by children for official use will be carefully controlled by the setting and will be checked carefully before sharing online or via digital screens.
• Still and video cameras provided for use by children and the images themselves will not be removed from the setting.

 

Use of Images of Clients/Children by the Media

 

Where a press photographer is to be invited to celebrate an event, every effort will be made to ensure that the newspaper’s (or other relevant media) requirements can be met.

 

A written agreement will be sought between clients/parents and carers and the press which will request that a preagreed and accepted amount of personal information (e.g. first names only) will be published along with images and videos.

 

The identity of any press representative will be verified and access will only be permitted where the event is planned, and where press are to be specifically invited to attend. No authorisation will be given to unscheduled visits by the press under any circumstances. Every effort will be made to ensure the press abide by any specific guidelines should they be requested. No responsibility or liability however can be claimed for situations beyond reasonable control, and where the setting is to be considered to have acted in good faith.

 

Use of Professional Photographers

 

• Professional photographers who are engaged to record any events will be prepared to work according to the terms of the settings Child Protection Policy, Image Use Policy Health and Safety Policy and Code of Conduct.
• Photographers will sign an agreement which ensures compliance with the General Data Protection Regulation (GDPR) and that images will only be used for a specific purpose, subject to client/parental consent.
• Photographers will not have unsupervised access to children and young people.

 

Impresario Theatre SchoolGuide to the Use of Images Online

 

Using Images Safely and Responsibly

 

We all enjoy and treasure images of our family and friends; family events, holidays and events are moments we all like to capture in photos or on video. We now have the exciting dimension of adding our images and videos to our online social networks, such as Facebook, YouTube and many other websites. This means that we can easily share our photos and video with family and friends. Whilst this can be very useful to all of us, we must ensure we protect and safeguard all clients children and staff, including those who do not want to have their images stored online.

 

What should we all think about before posting any images or video online and are there any risks?

 

• Once posted and shared online any image or video can be copied and will stay online forever.
• Some children are at risk and MUST NOT have their image put online. Not all members of the community will know who they are.
• Some people do not want their images online for personal or religious reasons.
• Some children and staff may have a complex family background which means that sharing their image online can have unforeseen consequences.
• Therefore, in order to keep all members of the community safe we must all ‘Think Before We Post’ Online.

 

At Impresario Theatre School we are happy for parents and carers to take photos and video of events (as agreed by Impresario Theatre School) for personal use but request that these images are not distributed or put online. This is to protect all members of the community.

 

We thank you for your support!

 

Further Information on the Use of Images and video:

 

• Information Commissioner’s Office: https://ico.org.uk/for-organisations/education/
• Think U Know: www.thinkuknow.co.uk/parents
• Get Safe Online: www.getsafeonline.org

 

 

Section 2 GDPR

 

The General Data Protection Regulation (GDPR) comes into effect on 25th May 2018. It has been agreed that Amy Rackliff, will be appointed as Data Protection Officer (DPO) and is therefore responsible for the safe storage of information relating to our students and parents. This Notice will provide information on how we, Impresario Theatre School are complying with this Regulation.

 

Purpose and Statement:

 

Impresario Theatre School is committed to ensuring the data processed by our charity remains safe and secure.

 

This policy has been written in line with legislative change, including both the Data Protection Act (1998) and the EU’s General Data Protection Regulation (GDPR).

 

Impresario Theatre School has determined the lawful reasons with which it processes personal data:

 

Legal obligation – GDPR Article 6(1)(c)

 

Legitimate interest – GDPR Article 6(1)(f)

 

Contract – GDPR Article 6(1)(b)

 

There is also some limited data we process with consent from the Data Subject; Consent – GDPR Article 6(1)(a).

 

While Impresario Theatre School avoids sharing data with third parties at most times, some data is shared in accordance with our business practices. The sharing of data with third parties will always be consensual with the data subject and/or their parent/guardian, and only if Impresario Theatre School is satisfied that their Data Protection policy is GDPR compliant.

 

How we use your personal data

 

We are committed to protecting your personal data. The only data we collect from you is as submitted by you on the registration form. We will use your sensitive personal data for the purposes of providing our services to you or if we need to comply with a legal obligation. We will use your non-sensitive personal data to (i) register you as a new client, (ii) manage payment, (iii) collect and recover monies owed to us (iv) to manage our relationship with you, (v) send you details of our goods and services (vi) for performance licenses and showcase BOPA applications.

 

Our legal grounds for processing your data are in relation to points (i) to (iv) above are for performance of a contract with you and in relation to (v) above, necessary for our legitimate interests to developour products/services and grow our business. We will not share your details with third parties for marketing purposes except with your express consent.

 

In certain circumstances you can ask us to delete your data. See the section entitled ‘your rights’ below for more information. We may anonymise your personal data (so that you can no longer be identified from such data) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

 

Data retention

 

We will only keep your personal data for as long as is necessary to fulfil the purposes for which we collected it. We may retain your data to satisfy any legal, accounting, or reporting requirements so for example we need to keep certain information about you for 6 years after you cease to be a client for tax purposes. You have the right to ask us to delete the personal data we hold about you in certain circumstances. See section ‘Your rights’ below.

 

Your rights

 

You are able to exercise certain rights in relation to your personal data that we process. These are set out in more detail at

 

https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/

 

Disclosure of your personal data

 

We may have to share your personal data with (i) service providers who provide IT and system administration support, (ii) professional advisors including lawyers, bankers, auditors and insurers (iii) HMRC and other regulatory authorities (iv) third parties to whom we sell, transfer or merge parts of our business or our assets and/or (v) [to other professionals for the purposes of discussing your treatment]/[to my supervisory teachers as part of my teaching training]

 

We require all of these third parties to whom we transfer your data to respect the security of your personal data and to treat it in accordance with the law. They are only allowed to process your personal data on our instructions. In relation to a Subject Access Right request, you may request that we inform you of the data we hold about you and how we process it. We will not charge a fee for responding to this request unless your requestis clearly unfounded, repetitive or excessive in which case we maycharge a reasonable fee or decline to respond.We will, in most cases, reply within one month of the date of therequest unless your request is complex or you have made a largenumber of requests in which case we will notify you of any delay andwill in any event reply within 3 months.

 

If you wish to make a Subject Access Request, please send the request to impresariotheatreschool@gmail.com marked for the attention of the Data Compliance Officer.

 

International transfers

 

Some of our third party providers are businesses outside of the EEA in countries which do not always offer the same levels of protection for your personal data. We do our best to ensure a similar degree of security by ensuring that contracts, code of conduct or certification are in place which give your personal data the same protection it has within Europe. If we are not able to do so, we will request your explicit consent to the transfer and you can withdraw this consent at any time.

 

Keeping your data up to date

 

We have a duty to keep your personal data up to date and accurate so from time to time we will contact you to ask you to confirm that your personal data is still accurate and up to date. If there are any changes to your personal data (such as a change of address) please let us know as soon as possible by signing in to our online portal and updating this information.

 

Data security

 

Protecting your data is important to us and we have put in place security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We also limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know such data. They will only process your personal data on our instructions and they are subject to a duty of confidentiality. We have put in place procedures to deal with any suspected personal data breaches and will notify you and any applicable regulator of a breach where we are legally required to do so.

 

Complaints

 

We are committed to protecting your personal data but if for some reason you are not happy with any aspect of how we collect and use your data, you have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk).

 

We should be grateful if you would contact us first if you do have a complaint so that we can try to resolve it for you.

 

We may change this Privacy Notice from time to time and shall notify you of any changes.

 

General Principles

 

Impresario Theatre School is committed to providing fair and understandable privacy policies in relation to personal data.

 

Impresario Theatre School will, at all times, keep data in secure locations (including, but not limited to, encrypted and access restricted files) and not retain data unnecessarily or past the retention length as set out in this policy.

 

In the rare instance a data processor that is not Impresario Theatre School employee is used, such as a third party, the data subject will either be asked for consent pre to supplying the data or be notified and have the right to object to processing.

 

Impresario Theatre School customers and participants supply their personal data when signing up for classes through our registration form either via the website, or via our online portal.

This is either completed by a parent/guardian or the child themselves if they deemed able to do so.

Personal data may also come to us unsolicited via enquiries through our website and to our generic email account.

 

To attend any of Impresario Theatre Schools activities participants/parents/guardians must agree to some processing of their personal data. This is due to Legitimate Interests – GDPR Article 6(1)(f), Legal Obligation GDPR Article 6(1)(c), Contract – Article 6(1)(b) and/or Consent – Article 6(1)(a).

 

Should Impresario Theatre School be unable to process participant’s data, we would be contravening both our Health & Safety and Child Safeguarding policies. We would also be ignoring best practice regarding working with children/vulnerable adults.

 

Our participants must remain safe at all times, therefore information about participants must be collected in order to create registers and accurate student records. This information is also used to provide students with appropriate classes, including dividing students into age groups.

 

Special category data is only collected with the consent of the data subject. Special category data Impresario Theatre School collects includes but is not limited to: Medical/Disability information, Income information, Ethnicity, Gender and Sexuality.

 

As physical activity providers it is essential that this consent is given should a participant have any medical/disability needs. This allows us to incorporate participants safely into classes. It is also used in assessing if we can incorporate participants safely into classes.

 

Income information is only collected in instances where a participant applies to attend our classes at a concessionary price, or on a bursary. This financial support is means tested, and therefore is subject to documented proof. Proofs of entitlement to concession are shredded after the entitlement has been noted.

 

Ethnicity and other sensitive data is to provide information to funding bodies for statistical purposes. This data is always provided to third-parties as quantified data (i.e. cumulative numerical data only with no identifying information relating to any data subject).

 

Personal data and some special category is collected.

 

It is essential to our primary function (providing classes to participants) that we are provided, and allowed to process and store the following:

 

Participant Personal Data:

 

Full Name – GDPR Article 6(1)(f)

 

Date of Birth – GDPR Article 6(1)(f)

 

Home Address – GDPR Article 6(1)(f)

 

Sex – GDPR Article 6(1)(f)

 

Permission to go home alone – GDPR Article 6(1)(f)

 

School/Educational Institution – GDPR Article 6(1)(f)

 

Exam results (vocational exams taken through Impresario Theatre School only) – GDPR Article 6(1)(f)

 

Classes attended/Price paid – GDPR Article 6(1)(f)

 

Participant Special Category Data:

 

Medical Information/History – GDPR Article 9 (a)

 

Disability Information – GDPR Article 9 (a)

 

Ethnicity – GDPR Article 9 (a& j) – further explicate consent sought

 

Gender/Sex – GDPR Article 9 (a& j) – further explicate consent sought

 

Sexuality – GDPR Article 9 (a& j) – further explicate consent sought

 

Parent/Guardian Personal Data:

 

Name – GDPR Article 6(1)(f)

 

Address – GDPR Article 6(1)(f)

 

Email Address – GDPR Article 6(1)(f)

 

Mobile Telephone Number – GDPR Article 6(1)(f)

 

Work/Home Number – GDPR Article 6(1)(f)

 

Emergency Contact Number – GDPR Article 6(1)(f)

 

Parent/Guardian Special Category Data:

 

Concession Type – further explicate consent sought

 

Documented proof of financial need – further explicate consent sought

 

Bank Details – further explicate consent sought in the instance of refunds etc.

 

Impresario Theatre School transports data with all due diligence. Enrolment forms are sent to Impresario Theatre School through an encrypted email server directly from our website which has controlled access. Received enrolment forms are stored on an encrypted email server for no more than 6 months. Received paper enrolment forms are destroyed after no more than 4 weeks.

 

Data received through enrolment forms is uploaded manually into our database software. Our database is stored both in encrypted files on office-based hardware and backed up regularly in our encrypted cloud-based server. Access to these files is restricted through password protection and only available to authorized staff members.

 

Hard copies of registers and emergency contacts are carried by authorized staff members. They are locked away while not in use. When they are no longer in use or out-dated, they are destroyed thoroughly.

 

Waiting lists are stored on an encrypted cloud-based server.

 

Our standard retention policy (without the data subject’s right to access, rectification and erasure etc.) is THREE YEARS post final attendance.

 

Exceptions to our retention policy:

 

• Financial records are kept for 6 years due to legal obligation
• First Aid records are kept for 21 years due to legal obligation
• Photo consent may be kept indefinitely
• Child Safeguarding records are kept indefinitely on a case-by-case basis, the minimum these will stored for is 6 years due to legal obligation
• Bank details are deleted after the action concerning them is complete
• Enquiries that do not turn into bookings with current classes are deleted after they have been dealt with
• Impresario Theatre School does not actively share data with third parties, however there are certain instances where sharing information is crucial to our business processes.

 

Third Parties/Data Processors:

 

Impresario Theatre School does not actively share data with third parties, however there are certain instances where sharing information is crucial to our business processes.

 

Freelance Teachers: As many of Impresario Theatre School teachers are freelance staff, we have confidentiality and data processor agreements in place. Teachers will never be provided with personal details aside from participant’s names and any medical information that is pertinent to the running of a class.

 

NHS Track and trace:

 

Responding to the Coronavirus advice from the Government is an obligation on all schools in England. The development of the NHS ‘Track and Trace’ scheme is a key part of the government plan to manage Coronavirus. As we respond to Government guidance and the wider opening of leisure facility’s/dance schools, the safety and well-being of pupils, staff, visitors and their families is a priority. Plans to manage a safe return are in place, however our responsibility extends beyond the school gates. We hold a lot of data and, as part of our statutory duty, it may be necessary for us to share that data on request by Public Health with NHS Track and Trace workers, so that we play our part in making the programme as effective as possible. It is likely that we will be asked to provide contact details if a case of Coronavirus or a suspected case arises in our school. There is an obligation to support the Government and we will provide details if requested to do so. We will be sharing data on the basis that this is a Public Duty (see below) and that, in the case of any health data, it is necessary for the public interest, as set out.

 

Our first response will be to try and contact individuals directly ourselves to manage information and data sharing. However, in some cases we may be required to provide it to the new service. Please be assured we will keep a record of information that we share. This privacy notice should be read alongside the other GDPR and Data Protection policies and notices in our privacy policy and terms and conditions. NHS Test and Trace and the law on protecting personally identifiable information known as the General Data Protection Regulation (GDPR), allows Public Health England to use the personal information collected by NHS Test and Trace. The section of the GDPR that applies is: Article 6(1) (e) ‘‘processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller’ As information about health is a special category of personal information, a further section of the GDPR applies: Article 9(2) (g) processing is necessary for reasons of public interest in the area of public health or ensuring high standards of quality and safety of healthcare’ Public Health England also has special permission from the Secretary of State for Health and Social Care to use personally identifiable information without people’s consent where it is in the public interest. This is known as ‘Section 251’ approval and includes the use of the information collected by NHS Test and Trace to help protect the public from Coronavirus. 2 The part of the law that applies here is Section 251 of the National Health Service Act 2006 and the associated Health Service (Control of Patient Information) Regulations 2002.

 

Class Manager:

 

Class Manager (‘we’ or ‘us’ or ‘our’) are committed to ensuring the security and protection of the personal information that we process, and to provide a compliant and consistent approach to data protection. We have always had a robust and effective data protection program in place which complies with existing law and abides by the data protection principles. However, we recognise our obligations in updating and expanding this program to meet the demands of the GDPR and the UK’s Data Protection Bill.

 

Class Manager are dedicated to safeguarding the personal information under our remit and in developing a data protection regime that is effective, fit for purpose and demonstrates an understanding of, and appreciation for the new Regulation. Our preparation and objectives for GDPR compliance have been summarised in this statement and include the development and implementation of new data protection roles, policies, procedures, controls and measures to ensure maximum and ongoing compliance.

 

Full GDPR document and privacy policy can be found at www.classmanager.com/gdpr

 

Child Performance Licensing:

 

In order to process child performance licences, Impresario Theatre School are legally required to provide some personal data to local councils (including but not limited to: full name, date of birth and school details). This is an optional consent, which will be sought at the time of sending participation consent forms. Impresario Theatre School is satisfied that their GDPR process is thorough and any data will be stored in a secure environment, and not unnecessarily retained.

 

Child Safeguarding Concerns:

 

In the unlikely event Impresario Theatre School has a safeguarding concern in relation to one of our participants, Impresario Theatre School are legally required to provide data to the safeguarding board at the local council. Impresario Theatre School is satisfied that their GDPR process is thorough and any data will be stored in a secure environment, and not unnecessarily retained.

 

Event Programmes:

 

Impresario Theatre School may occasionally produce programmes for events. These will only ever contain the first name and first initial of a child’s last name (unless otherwise consented to). The name of a child’s class may also be included. Participants/their Parent and/or Guardians may choose if they want to be included in the programme when they agree to participate at an event.

 

Examination Entry:

 

In order to enter examinations, Impresario Theatre School must provide some personal data to examination boards (currently Impresario Theatre School work with: LAMDA. This sharing of data is to be consented to by the data subject and/or parent/guardian upon being entered for the exam.

 

Schools:

 

Impresario Theatre School must sometimes share personal data with schools (names, DOB and payment information) when taking part in an internal class in order for them to check persons attending. This also helps the school work out Impresario Theatre School’s payment in terms of renting space. Impresario Theatre School is satisfied that their GDPR process is thorough and any data will be stored in a secure environment, and not unnecessarily retained.

 

Any data subject with personal data stored within Impresario Theatre School is entitled to the rights of:

 

Access

 

You may contact Impresario Theatre School at any time to access all data held relating to you and/or your children. Impresario Theatre School will ensure that we respond to a subject access request without undue delay and within one month of receipt. If the information request will also include data regarding others, Impresario Theatre School has the right to refuse the request or take steps in order to obtain consent from other involved parties. The right of access does not apply to Impresario Theatre School’s legal obligations such as Child Safeguarding records.

 

Rectification

 

You may contact Impresario Theatre School at any time in order to rectify data held relating to you and/or your child(ren). Impresario Theatre School will ensure that we respond to a rectification request without undue delay and within one month of receipt. The right to rectification does not apply to Impresario Theatre School’s legal obligations such as payment record information.

 

Erasure

 

You may contact Impresario Theatre School at any time in order to erase data held relating to you and/or your child(ren). Impresario Theatre School will ensure that we respond to an erasure request without undue delay and within one month of receipt. The right to erasure does not apply to Impresario Theatre School’s legal obligations such as First Aid records.

 

Restrict Processing

 

You may contact Impresario Theatre School at any time in order to restrict the data we process relating to you and/or your child(ren). Impresario Theatre School will ensure that we respond to a request to restrict processing without undue delay and within one month of receipt. However, due to our legitimate interest in most of the data collected- we may have to revoke your membership with Impresario Theatre School until the restriction is lifted. This is due to Health and Safety and Child Safeguarding.

 

Data Portability

 

You may contact Impresario Theatre School at any time in order to obtain the data we process relating to you and/or your child(ren) and reuse it across different services. Impresario Theatre School will ensure that we respond to a request to restrict processing without undue delay and within one month of receipt. Please note, this does not apply to Impresario Theatre School’s legal obligations.

 

Objection

 

You may contact Impresario Theatre School at any time in order to object to the processing of data relating to you and/or your child(ren). Impresario Theatre School will ensure that we respond to a request to restrict processing without undue delay and within one month of receipt.

 

However, due to our legitimate interest in most of the data collected- we may have to revoke your membership Impresario Theatre School until the restriction is lifted. This is due to Health and Safety and Child Safeguarding.

 

Rights related to automated decision making including profiling

 

You may contact Impresario Theatre School at any time in order to object to profiling relating to you and/or your child(ren). Impresario Theatre School  will ensure that we respond to a request to restrict processing without undue delay and within one month of receipt. However, due to our legitimate interest in most of the data collected- we may have to revoke your membership with Impresario Theatre School until the profiling restriction is lifted. This is due to Health and Safety and Child Safeguarding. Impresario Theatre School has a lawful reason for profiling; Legitimate Interests and consent. None of Impresario Theatre School’s decision making is automated. Profiling is only used in circumstances where a participant may have certain health/disability needs which may prevent them from taking part in classes (as it would be unsafe to do so).

 

Any and all verbal requests are noted, and then contacted again either via phone or email to verify the request. Verbal requests will be responded to in the time frames mentioned above.

 

Impresario Theatre School often use footage/photos used from shows, performances and classes for marketing purposes both in print media and the website. Participants/their Parent and/or Guardians may choose if they do not wish themselves/their child to be depicted.

 

Some attendees at events may film/take photos for their own personal use (e.g. parents of other participants). Participants/their Parent and/or Guardians may choose if they do not wish themselves/their child to be depicted.

 

Social Media:

 

Impresario Theatre School regularly share photos/videos of students in class, workshops, events and performances through social media platforms including; Instagram, Facebook, Email. These will never be shared with any identifying information (age, location etc.). There may be times where we will share first names, but only with the explicit consent of the parents. All members of staff (PAYE, Freelance and Voluntary) must agree to this Data Protection policy prior to accepting a contract of employment.

 

Complaints:

 

Complaints in regard to the handling of any personal data can be made directly to Impresario Theatre School’s DPO: (Amy Rackliff Principal).

 

Email: impresariotheatreschool@gmail.com

 

Telephone: 07793140504

 

If you feel that your complaint was not handled in the correct manner, or still have concerns, you may escalate the complaint by contacting the Independent Commissioner’s Office (ICO).

 

ICO Telephone Number: 0303 123 1113

 

Data Breeches:

 

If Impresario Theatre School experiences a data breech of any kind, we have a legal obligation to report this to ICO within 72 hours. The data breech will be reported by the DPO. In the instance they are unavailable to report the breech, the next most senior staff member shall do so. Impresario Theatre School will also inform all the victims of the data breech as soon as possible if there is a high risk of adversely affecting individuals’ rights and freedoms. Impresario Theatre School will store and record all data breeches.

 

Facebook Page (for users) GDPR Policy

 

Purpose and Statement:

 

Impresario Theatre School uses a Facebook page to advertise its services and connect/share with its’ (and a wider) audience. The web address for our Facebook page is: www.facebook.com/impresariotheatreschool

 

Facebook has its own GDPR policies & uses cookies. Please refer to Facebook GDPR policies for further details.

 

Impresario Theatre School is able to process some personal data from interactions with our Facebook page, which is described below, however how Impresario Theatre School processes this data is very limited.

 

Distribution:

 

• To be displayed on our Facebook Page www.facebook.com/impresariotheatreschool
• This policy will be made available to members of the public on request

 

Review and monitoring of policy:

 

• Reviewed annually or in instances of legislative change
• Monitoring is part of Management and Supervision

 

General Principles:

 

• Administrators of the www.facebook.com/impresariotheatreschool Facebook Page are authorised www.facebook.com/impresariotheatreschool staff
• www.facebook.com/impresariotheatreschool does not actively collect, harvest or store any data in connection with Facebook

 

Facebook Posts:

 

Types of Facebook Posts:

 

• Marketing/Advertisement of our various courses, events and workshops
• General News and updates including, but not limited to, student achievements, photos from events

 

If you communicate with impresario theatre school via the page we will respond to your communications & make information available to you that is relevant to those communications. If you choose to ‘like’ the page, you can ‘unlike’ at any time.

 

As a public Facebook page all communication you share to the page can be seen by anyone. If you need to discuss anything privately with impresario theatre school please contact the office.

 

Anonymous Data:

 

Administrators of Facebook Pages can obtain anonymous statistical data on visitors to the page, and those who ‘like’ the page via a function called ‘Facebook Insights’ which Facebook makes available to them free of charge under non-negotiable conditions of use.

 

The data is collected by ‘cookies’, each containing a unique user code, which are active for two years and are stored by Facebook on the device used by visitors to the page. This user code, which can be matched with the connection data of users registered on Facebook, is collected and processed by the Facebook Insight programme.

 

Anonymous Data our Facebook Page collects:

 

• Demographic information (including Age, Sex, Location, Relationship Status, Occupations)
• Internet usage (including times online and length of page visits)
• Sales information (including online purchase history, categories of goods or services)

 

How impresario theatre school may use this data:

 

• www.facebook.com/impresariotheatreschool may use this anonymous data to target marking to specific categories of peoples, and to effectively time manage campaigns (in terms of when to release posts and time lengths of special offers etc).
• www.facebook.com/impresariotheatreschool may also use this data in the evaluation of marketing campaigns.

 

How Impresario Theatre School retain/archive this information:

 

Impresario Theatre School do not remove any of this anonymous data from Facebook (a GDPR compliant company), except in the instance of reporting the effectiveness of advertising campaigns.

 

Non-anonymous Data:

 

Administrators of Facebook Pages can obtain limited personal data about people who choose to ‘like’ and/or ‘follow’ the page and/or communicate with the page.

 

A Facebook user’s Name is actively sent by Facebook to the page administrator as a notification.

The Facebook page contains a list of all users who ‘like’ or ‘follow’ the page.

 

Administrators are also able to access the profile of those who choose to ‘like’ and/or ‘follow’ the page and/or communicate with the page.

 

How Impresario Theatre School retain/archive this information:

 

No record of names are removed from Facebook or used for any purpose.