Privacy and cookies policy

Who we are

Cirencester Music Academy Ltd is responsible for the personal information we use to operate our shop, website, lesson enquiries and student administration.

Our contact details

Cirencester Music Academy Ltd
15 Dyer Street
Cirencester
Gloucestershire
GL7 2PP

Email: info@cirencestermusicacademy.co.uk
Telephone: 01285 708101

If you have questions about your information or wish to exercise your privacy rights, please contact us using these details.

Information we collect

Depending on how you use our services, we may collect:

• Your name, email address, telephone number and correspondence.
• Billing details, purchase history, payment status and collection information.
• Your delivery address and relevant access information where supplier delivery is arranged.
• Student and parent or guardian details, lesson bookings, attendance and relevant teaching records.
• Musical experience, interests, goals and learning preferences you choose to share.
• Website usage information, such as pages visited, device and browser information, IP address and cookie preferences.

We receive information directly from you, from a parent or guardian arranging lessons, and from the providers that support our website, bookings and payments.

Payment providers handle card and other payment credentials. We receive the transaction information needed to manage payments, refunds and accounting.

Shop purchases and payments

We use customer information to process orders, take payments, arrange collection, organise agreed supplier delivery and provide customer support.

Our online shop is hosted by Shopify. Shopify and the payment services selected at checkout process information needed to operate the store and complete transactions.

For supplier-delivered products, we share the necessary name, delivery address, contact details and delivery instructions with the supplier and delivery provider.

Enquiries and lesson administration

Enquiries submitted through our Contact Us form are received in our info@cirencestermusicacademy.co.uk inbox and recorded in a Google Sheet. We use these details to answer questions, manage enquiries and follow up where appropriate.

Lesson registration and student administration are managed through Opus1. Relevant information is used to arrange lessons, communicate about bookings, manage attendance and payments, and support students’ musical progress.

Where a parent or guardian arranges lessons for a child, we use the adult’s contact details alongside the student information needed to provide those lessons. Please provide only information that is relevant to the service.

Within CMA, access to the student experience and specific-needs information described below is limited to the student’s assigned teacher and CMA directors. Service providers may also process information as necessary to operate and support their systems.

Learning preferences and sensitive information

Our registration form includes an optional field about musical experience and specific needs.

Please use this to tell us about musical interests, goals and learning preferences. Please avoid entering medical diagnoses or detailed health information into general enquiry or registration fields.

If health or disability information is relevant to arranging support, contact us so we can discuss what information is necessary and how it will be handled.

Health and disability information requires additional protection. Before retaining or using it to arrange ongoing support, we must identify an appropriate legal condition and explain that use to you. Where we rely on explicit consent, we will ask for it separately; completing a general free-text field is not treated as explicit consent.

You can contact us to discuss, correct or request deletion of sensitive information you have already provided.

Why we use personal information

We use personal information on the following legal bases:

• Contract: to take steps you request before a purchase or booking, and to fulfil purchases and lesson arrangements with you.
• Legitimate interests: to respond to general enquiries, administer lessons and relevant student records, support learning, handle complaints, maintain security and protect our business. Where children’s information is involved, we give particular consideration to their interests and rights.
• Legal obligation: to maintain required financial records and comply with applicable legal requirements.
• Consent: where required for marketing, non-essential cookies or other optional processing.

Where information is needed to fulfil an order or arrange lessons, not providing it may mean we cannot provide the requested service.

Any use of health or other special-category information also requires an additional legal condition, as explained above.

Marketing and service messages

We use contact details to send necessary messages about enquiries, orders, collection, lesson bookings, payments and changes to our services. These messages are separate from promotional marketing.

We have not yet started our own regular promotional email or text campaigns. If we introduce them, we will explain the relevant choices and obtain consent where required. Choosing not to receive marketing will not prevent you from purchasing goods or booking lessons.

Shop features may provide shopping reminders, back-in-stock alerts, price-drop notifications or similar communications, depending on your activity and settings. You can manage these through the relevant message or your Shop account.

You can unsubscribe from promotional messages using the instructions provided or contact us directly.

You have the right to object to the use of your personal information for direct marketing at any time.

Who we share information with

We share information where necessary with providers that support our services, including:

• Shopify, for our online store, checkout and associated shopping services.
• Google Workspace, for email, enquiry forms, spreadsheets and business administration.
• Opus1, for lesson registration, bookings and student administration.
• Payment providers, including those used through Shopify and Opus1, to process payments and refunds.
• Suppliers and delivery providers, where home delivery has been agreed.
• Accounting providers and professional advisers, where needed for financial administration, advice or legal matters.
• Relevant authorities where disclosure is required by law or necessary for an applicable safeguarding purpose.

Some providers process information on our instructions. Others act independently for certain purposes, such as payment security, regulatory compliance or services you use directly.

Shopify and Shop services

Our store has Shopify Network Intelligence enabled. This allows Shopify to use information from interactions with our store alongside information from other merchants and Shopify services to support enhanced features, including personalisation and advertising-related services, subject to applicable privacy choices.

For some of these activities, Shopify is independently responsible for processing your information.

You can learn more about Shopify’s use of personal information and available privacy rights in the Shopify Privacy Policy.

Cookies and website features

Cookies and similar technologies help websites remember information and understand how they are used.

Our website uses:

• Essential technologies, needed for functions such as the basket, checkout, security and remembering privacy choices.
• Analytics technologies, including Google Analytics, to help understand website visits and improve the website.
• Shopify and connected Google features, which may process browsing, shopping and interaction information depending on the features used and your privacy choices.
• Embedded content, such as maps and videos, which may involve third-party providers when loaded or used.

Non-essential technologies require your consent where applicable. Use the website’s cookie controls to accept, reject or manage the available categories.

You can also manage cookies through your browser. Blocking essential cookies may affect features such as the basket or checkout. Browser controls and account settings provided by Google or Shopify may offer additional choices.

For more information, see Google’s Privacy Policy and Shopify’s Privacy Policy.

Information processed outside the UK

Some of our service providers operate internationally, so personal information may be processed or accessed outside the UK.

Where a transfer is subject to UK data protection restrictions, an appropriate transfer mechanism is required. Depending on the provider and destination, this may involve UK adequacy regulations or approved contractual safeguards.

You can contact us for information about the destinations and safeguards applicable to your personal information, including how to obtain a copy of relevant safeguards.

How long we keep information

Our retention policy is:

• Closed enquiries: routine enquiry information is retained for 12 months after the enquiry is closed.
• Former students: routine student profiles and teaching notes are retained for 12 months after lessons end.
• Specific-needs information: reviewed when lessons end and deleted sooner where no longer necessary.
• Financial records: invoices, payment and accounting records are normally retained for six years from the end of the company financial year they relate to, or longer where legally required.
• Safeguarding, complaints and disputes: reviewed separately and retained for as long as necessary for their particular purpose or applicable requirements.
• Marketing preferences: limited records may be retained to ensure that we respect an unsubscribe request.

These periods apply to relevant records in our enquiry inbox, Google Sheets, Opus1 and working exports. Where a record must be kept longer for a separate purpose, we retain only the information needed for that purpose.

Provider backup copies may remain for a limited period under the provider’s backup arrangements before being overwritten or deleted.

Keeping information secure

We restrict access to personal information according to people’s roles and use appropriate account controls and security measures.

Please avoid sending unnecessary sensitive information through general forms or email. Contact us if you need to discuss an appropriate way to share information about lesson support.

Your privacy rights

Depending on the circumstances, you can ask us to:

• Provide access to your personal information.
• Correct inaccurate or incomplete information.
• Delete information where there is no longer a lawful reason to retain it.
• Restrict how information is used.
• Provide certain information in a portable format.

You can object to processing based on legitimate interests, including relevant profiling. You can always object to direct marketing.

Where processing relies on consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

These rights are subject to applicable conditions and exceptions. We may need to confirm your identity before responding.

Contact info@cirencestermusicacademy.co.uk to make a request.

Complaints

Please contact us if you have a concern about how we use your information.

You also have the right to complain to the Information Commissioner’s Office:

ico.org.uk/make-a-complaint

Changes to this notice

We may update this notice when our services or information-handling practices change. Where required, we will bring significant changes to your attention.