Privacy Policy

Last updated: 20 July 2026

This Privacy Policy explains how Maple Grove Piano ("we", "us", "our") collects, uses, stores, and protects personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and guidance from the Information Commissioner's Office (ICO).

1. Data controller

Name: Hannah Brooks — Maple Grove Piano
Address: 42 Station Road, Orpington, Kent BR6 0SA, United Kingdom
Email: [email protected]
Phone: 01689 874221
Website: vividmomentbook.pics

To exercise your data protection rights or raise a concern, contact us using the details above. We aim to respond within one month.

2. Personal data we collect

Depending on your relationship with us, we may process:

• Identity and contact data: names, addresses, email addresses, phone numbers, emergency contact details.
• Student data: age, school, grade level, lesson attendance, progress notes, exam entries, safeguarding records where relevant.
• Financial data: fee payment records, invoices, bank transfer references (we do not store full card details).
• Communication data: emails, phone messages, contact form submissions, and correspondence.
• Technical data: IP address, browser type, device information, pages visited, cookie data (see our Cookie Policy).
• Special category data: health or disability information only where you voluntarily provide it to help us adapt teaching — processed with your explicit consent.

We do not knowingly collect data from children under 13 without parental consent. For students under 18, we typically hold data provided by a parent or guardian.

3. How we use your data

We process personal data for:

• Responding to enquiries and arranging trial lessons.
• Delivering piano tuition, scheduling lessons, and tracking progress.
• Processing termly fee payments and maintaining accounts.
• Communicating about recitals, exam dates, timetable changes, and safeguarding matters.
• Complying with legal obligations (tax, regulatory requests).
• Improving our website through analytics where you have consented to non-essential cookies.
• Sending occasional news about the studio to existing customers — you may opt out at any time.

4. Lawful bases

Under UK GDPR we rely on:

• Contract (Art. 6(1)(b)): processing necessary to deliver tuition services.
• Legal obligation (Art. 6(1)(c)): tax and accounting records.
• Legitimate interests (Art. 6(1)(f)): studio administration, safeguarding, and website security.
• Consent (Art. 6(1)(a)): optional analytics, marketing, and special category health data.

5. Data sharing

We may share personal data with:

• Exam boards (ABRSM, Trinity) when entering students for examinations.
• Payment processors and our bank for fee collection.
• IT and website hosting providers under data processing agreements.
• Accountants and legal advisers where necessary.
• Authorities if required by law or to protect a child's welfare.

We do not sell personal data. Where data is transferred outside the UK, we ensure appropriate safeguards such as UK International Data Transfer Agreements or adequacy regulations.

6. Retention

• Active student records: duration of tuition plus one year.
• Financial records: 6 years (HMRC requirements).
• Enquiry records: 2 years if no enrolment follows.
• Cookie consent records: 12 months.

7. Your rights

You have the right to access, rectify, erase, restrict processing, data portability, and to object to processing based on legitimate interests or direct marketing. You may withdraw consent at any time. You also have the right to lodge a complaint with the ICO at ico.org.uk.

Contact [email protected] to exercise these rights. We may need to verify your identity before responding.

8. Security

We implement appropriate technical and organisational measures to protect personal data, including secure storage of paper records, password-protected devices, and limited access to student information. No system is completely secure; please protect your own login details and devices.

9. Changes

We may update this policy periodically. The "Last updated" date will reflect changes. Significant updates will be communicated where appropriate.