GDPR Policy

WHAM THEATRE SCHOOLS GDPR POLICY

FOR CUSTOMERS & STUDENTS


This privacy policy sets out how WHAM Theatre Schools uses and protects any information that you provide when using our services or website. WHAM Theatre Schools is committed to ensuring that your privacy is protected and that we comply fully with the UK GDPR requirements. As a data controller, we determine the purpose and means of processing your personal data. This policy is effective from 1st May 2018, last updated in April 2025, and is reviewed annually.


WHAT WE COLLECT AND HOW WE USE IT

To provide our services and respond to your enquiries, we may collect the following information:

  • Parent’s name, email, and emergency contact details.
  • Child’s name, age, and medical information relevant to their participation in classes.
  • Venue and class preferences.
  • Address, payment details (e.g., bank account), and date of birth upon enrolment.


LEGAL BASIS FOR PROCESSING DATA:


We process your data under the following legal bases:


  • Consent: For marketing communications and responding to enquiries.
  • Contractual Obligations: To deliver our services (e.g., class enrolment, payment processing).
  • Legal Obligations: For safeguarding and child protection purposes.
  • Legitimate Interests: Retaining limited contact information for historical reference and emergency purposes.


Enquiries made via social media or smartphones may include analytical data (e.g., geographical location), depending on your privacy settings for third-party platforms. Information shared on social media may remain visible even if your account is deleted.


We do not share your information with third parties unless:

  • You have explicitly authorised us to do so.
  • It is required by law.
  • It is necessary for safeguarding purposes.


WHAT WE DO WITH THE INFORMATION WE GATHER

We require this information to:

  • Maintain internal records in a GDPR-compliant database.
  • Improve our services and respond to your enquiries.
  • Enable teaching staff to manage class registers and respond to emergencies.
  • Share necessary details (e.g., name, date of birth) with competition organisers or event coordinators.


SERVICE COMMUNICATIONS:

As part of your membership with WHAM Theatre Schools, we may send you service communications by email. These emails provide important information related to classes, events, holiday clubs, or other updates directly relevant to your membership. These communications are not considered marketing and are sent as a gesture of goodwill to keep you informed. By enrolling with WHAM Theatre Schools, you agree to receive these essential updates.


SAFEGUARDING AND EMERGENCIES:

In safeguarding or child protection emergencies, we may share relevant information with local authorities or social services if a student is at risk.


FIRST AID AND INCIDENT RECORDS

If a student suffers an injury, we record this in our First Aid/Accident Book and may digitise these records. These are retained for a minimum of 3 years for legal and medical purposes.


DATA RETENTION POLICY

We retain data only as long as necessary for its intended purpose:


  • Marketing Consent: Retained indefinitely unless withdrawn.
  • Sensitive Personal Data: Destroyed when contractual agreements end.
  • Trial Applications: Data is removed if enrolment is not completed within 2 months.
  • Inactive Trials: Data is removed 7 days after trial completion if no enrolment is processed.


We conduct regular data sweeps to archive or delete unnecessary information.


YOUR RIGHTS AND ACCESS TO DATA


You have the following rights under UK GDPR:


  • Access: Request a copy of the data we hold about you.
  • Correction: Request updates to inaccurate or incomplete data.
  • Erasure: Request the deletion of your data (where legally permissible).
  • Objection: Object to processing based on legitimate interests.


To exercise these rights, email us at info@whamtheatreschools.com


If you are dissatisfied with our response, you may contact the Information Commissioner’s Office (ICO) at https://ico.org.uk or call 0303 123 1113.


DATA SECURITY AND THIRD-PARTY PROCESSORS

We are committed to safeguarding your data through:

  • Physical, electronic, and managerial procedures.
  • GDPR-compliant third-party processors for services such as payment processing (e.g., GoCardless, PayPal, Stripe) and online classes (e.g., Google Meet, Zoom).


Details of third-party GDPR compliance policies are available on their respective websites.


FRANCHISEES AND DATA PROTECTION

WHAM Theatre Schools operates under a franchise model. Each franchisee is a separate legal entity and acts as an independent data controller for their respective operations. While franchisees are required to adhere to this privacy policy and comply with all UK GDPR requirements, they are also individually registered with the Information Commissioner’s Office (ICO) as data controllers.


Franchisees must:

  • Follow WHAM Theatre Schools' privacy and safeguarding policies.
  • Ensure their own GDPR compliance, including maintaining appropriate safeguards for data protection.
  • Inform parents and students of their ICO registration details upon request.


If you have any questions specific to a franchisee’s data processing activities, please contact them directly.


DATA BREACH POLICY

In the event of a data breach, we will:

  • Assess the risk to individuals.
  • Notify affected individuals and the ICO within 72 hours if required.


MARKETING COMMUNICATIONS

If you have consented to receive marketing emails, you may opt out at any time by clicking "unsubscribe" in the email or contacting us at info@whamtheatreschools.com


Please note, essential communications (e.g. class updates or service communications) will still be sent as they are necessary for service delivery.


If you have any questions about this privacy policy, please contact our Data Protection Officer, Mark Bowman, at info@whamtheatreschools.com