Data Protection and Privacy Policy

Street Beat / SBDA Studios

Organisation	Street Beat (also branded as SBDA Studios)
Policy owner	Street Beat management
Version	Draft 1.0
Status	Approved
Date approved	Dec 2026
Next review	Dec 2027
Privacy contact	Kim@sbda.online
Data protection lead	Kim Oakley-Duffill

1. Purpose and commitment

Street Beat is committed to respecting privacy and handling personal information fairly, lawfully, transparently and securely. We collect and use information where it is necessary to operate our dance school and social-enterprise activities, communicate with participants and families, deliver classes and events, meet legal obligations, safeguard people and manage our organisation.

This policy applies to both Street Beat’s social-enterprise activities and its commercial dance-school activities. It covers children and young people, adult participants, parents and carers, staff, freelance practitioners, volunteers, contractors, suppliers and other people who interact with us.

Street Beat does not sell participants’ personal data. We do not use personal information for purposes that are incompatible with the purposes explained to the individual, and we restrict access to those who need it.

2. Data protection law

Street Beat will handle personal information in accordance with applicable UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended, and other relevant requirements. We will review our practices when legislation or regulatory guidance changes.

This policy gives a general explanation of our approach. The privacy notice provided when information is collected should give more specific information about the data collected, purposes, lawful bases, recipients, retention periods and individual rights.

3. What personal information we may collect

Depending on a person’s relationship with Street Beat and the activity involved, we may collect:

Contact and identity details, such as name, date of birth, address, email address and telephone number.
Parent or carer contact details, emergency contacts, authorised collection information and relevant family/guardian information.
Class enrolment, attendance, booking, payment, fee, refund and participation records.
Information relevant to safe participation, such as medical conditions, injuries, allergies, access needs, adjustments or emergency information.
Safeguarding, incident, accident, complaint and behaviour records where necessary.
Staff, freelancer and volunteer information, including recruitment, references, role, training, checks, contracts, payment and relevant employment or engagement records.
Photographs, video and audio recordings, including class footage, performances and promotional material, where applicable.
Communications with Street Beat and information submitted through our website, booking platform, forms, email or social media.
Technical information generated through the website or online services, such as basic device, log or cookie information, where those services collect it.

We aim to collect only information that is relevant and reasonably necessary for the stated purpose. We do not intentionally request information that we do not need.

4. Why we use personal information

We may use personal information to:

Register participants, manage bookings, class lists, attendance and communications.
Deliver dance classes, workshops, performances, events, trips and related activities.
Process payments, refunds, accounts and financial records.
Contact parents, carers or participants about timetable changes, cancellations, safety issues, events and services.
Understand and respond to medical, access or support needs and help keep participants safe.
Meet safeguarding, health and safety, insurance, legal, regulatory and record-keeping obligations.
Recruit, engage, support and manage staff, freelancers, volunteers and contractors.
Handle questions, feedback, complaints, incidents and requests to exercise privacy rights.
Promote Street Beat’s work, report on funded projects and share class or performance footage, where the relevant lawful basis and permissions have been established.
Maintain, secure and improve our website, booking systems and services.

5. Lawful and fair use

UK data protection law requires an appropriate lawful basis for processing personal data. Depending on the purpose, Street Beat may rely on steps needed to enter into or perform a contract, compliance with a legal obligation, legitimate interests, consent, or another lawful basis available under the law. For special-category data, such as health information, an additional condition must also apply.

We will explain the relevant purposes and lawful bases in our privacy information. We will not assume that consent is always required or that a general consent form permits every use. Where we rely on consent, it must be freely given, specific, informed and capable of being withdrawn. Withdrawal does not affect processing that took place lawfully before withdrawal.

Information about children will be handled with particular care. We will consider the child’s age, understanding, rights and best interests, alongside the role and legal authority of a parent or carer. We will explain information use in an age-appropriate way where appropriate.

6. Special-category and safeguarding information

Some information requires additional protection, including information about health, disability, racial or ethnic origin, religious or philosophical beliefs, sexual orientation, and certain biometric or other sensitive information. Information about criminal convictions and offences is also subject to specific legal safeguards.

Street Beat will collect or use such information only where necessary, with an appropriate lawful basis and any additional condition required by law. Access will be limited to authorised people. Safeguarding information may be shared with relevant agencies or professionals when necessary and lawful to protect a child or adult, or to meet legal obligations. Confidentiality will not be used as a reason to withhold information where sharing is necessary for safeguarding.

7. Photographs, filming and social media

Street Beat may film classes and activities for promotional purposes and to share routines so participants can practise and learn at home. We may also take photographs or record performances. We will explain the relevant purposes, access arrangements and choices through our Photography, Filming and Social Media Policy and our booking or consent process.

We will record and respect people’s stated preferences and opt-outs for the relevant use of identifiable images or footage.
Permission for one purpose does not automatically mean footage can be used for every other purpose. We will consider the appropriate lawful basis for each use.
We will take particular care with images and recordings of children and will consider their wishes, safeguarding needs and any restrictions.
Footage will be accessed, stored and shared through approved arrangements and only by people who need it for an authorised purpose.
Participants or parents/carers should contact Street Beat if their preferences change or if they have a concern about the use of an image or recording.

8. When we share information

Street Beat does not sell participants’ personal data. We may share information only where necessary, appropriate and lawful, for example:

With our booking, website, payment, email, cloud-storage or other service providers who help us operate, subject to appropriate safeguards and contractual arrangements where required.
With staff, teachers, freelancers or volunteers who need the information to deliver activities or carry out their responsibilities.
With parents or carers where appropriate and lawful, taking account of the child’s rights, age, understanding and safeguarding needs.
With emergency services, health professionals, children’s social care, adult safeguarding services, the police, insurers or other relevant bodies where necessary for safety, safeguarding, legal obligations or the establishment or defence of legal claims.
With funders, partners or project evaluators where necessary for a project, funding requirement or reporting purpose; we will minimise or anonymise information wherever possible.
With professional advisers, auditors, internal system managers, or public authorities where required or permitted by law.

We take reasonable steps to check the identity and authority of people requesting personal information. We will not disclose information simply because a third party asks for it; we will consider the request, legal basis, necessity and any risk to the individual.

9. Booking systems and third-party providers

Street Beat uses digital tools and service providers to support bookings, communication, payments, website operation and administration.

Where a provider processes personal data on Street Beat’s behalf, we will take appropriate steps to ensure that the arrangement meets applicable data protection requirements. Providers may also have their own privacy information for data they process under their own responsibility.

10. International transfers and online services

If personal information is transferred outside the United Kingdom, Street Beat will ensure that the transfer is permitted under applicable data protection law and that any required safeguards are in place. Website cookies and similar technologies will be managed in accordance with applicable privacy and electronic communications requirements. Details of non-essential cookies and how to manage preferences should be provided through the website’s cookie information where relevant.

11. Accuracy and keeping information up to date

We take reasonable steps to keep personal information accurate and up to date. Participants, parents/carers, staff and other individuals should tell us when relevant details change, especially emergency contacts, authorised collection arrangements, medical information, access requirements, contact details or payment information.

12. Security and confidentiality

Street Beat will use appropriate organisational and technical measures to protect personal information against unauthorised access, loss, misuse, alteration, disclosure or destruction. Measures may include:

Restricting access to people who need the information for their role.
Using password protection, appropriate account permissions and secure systems.
Keeping paper records in secure storage and disposing of them confidentially when no longer required.
Taking care when sending information by email or sharing documents, particularly where children’s, safeguarding or health information is involved.
Providing staff and relevant representatives with information about their responsibilities for handling data securely.
Reviewing access and security arrangements when systems, roles or providers change.

No system can be guaranteed completely secure. Anyone who suspects a data breach, loss of records, misdirected email, unauthorised access or other security incident must report it promptly to Street Beat management so that the risk can be assessed and any required action taken.

13. How long we keep information

We keep personal information only for as long as it is reasonably necessary for the purpose for which it was collected, taking account of legal, accounting, safeguarding, insurance, funding and dispute-resolution requirements. Different records may need different retention periods.

Street Beat will maintain a retention schedule covering, as appropriate, participant and booking records, financial records, staff and contractor records, consent records, images and footage, safeguarding records, accident records and complaints. Information will be securely deleted or destroyed when no longer needed, unless it must be retained for a lawful reason. Safeguarding records may require longer retention periods than ordinary class records and must be handled in line with the safeguarding policy and relevant guidance.

How long we keep your family’s details

Street Beat Dance Academy (“we”) keeps your family’s details for these periods.

When you add a child. When you add a child in the Members App, we may put them on our register straight away, before our office has looked at their details. Our office then checks each new child. If we find a child we didn’t expect, or can’t match to a family, we remove them and delete their details at once. If we remove a child you added, we email you. Any child we keep is covered by the rules below.

A child we decline or remove. If we decline or remove a child, we delete their details at once. We keep a short note of the decision for 30 days: your email address, the date and our reason, but nothing about your child. If we haven’t approved or declined a child within 30 days, we delete their details then, unless they have already been put in a class or marked on a register. In that case our office approves or declines them instead.

When your child leaves. We clear your child’s details 12 months after the latest of these dates: when they were added or approved; when their last class enrolment ended; their last register mark; and when the membership that paid for their classes ended (for a family membership, when that membership ends). Nothing is cleared while one of their classes or memberships is still running. We may keep the details longer only while a live claim or dispute needs them. Clearing deletes your child’s date of birth, address, gender, where they are educated, emergency contacts, health details (medical, additional needs and allergy information), photo and our notes about them. If you withdraw your consent for the health details before then, we delete them at once.

What we keep after that.

Your child’s name becomes “Former student” and a code. We keep their attendance and class history under that code, without their name. This is not anonymous, because our records can still link the code to you as the parent.
Your photography and video consent record: kept for 3 years after clearing, so we can show we had permission for any image still in use, then deleted. We stop using a former student’s photos and videos within those 3 years.
Payment records: kept for 6 years from the end of the financial year, because we must keep accounts for tax. In the app, they name your child only by the code.
Accident records: we keep our accident book until the child turns 21, or for 3 years after the accident if that is later.

Your own details. We delete your contact details 12 months after your last child’s details are cleared, unless you still have a membership, booking or order with us, or are signed up to our news. Your name as the payer stays on the payment records for as long as we keep them.

14. Your data protection rights

Depending on the circumstances and subject to legal exceptions, individuals may have the right to:

Be informed about how their personal information is used.
Request access to the personal information Street Beat holds about them.
Ask us to correct inaccurate or incomplete information.
Ask for information to be erased.
Ask us to restrict how information is used.
Object to certain processing, including processing based on legitimate interests or direct marketing.
Request a copy of certain information in a portable format where the right applies.
Withdraw consent where processing is based on consent.
Raise a concern with the Information Commissioner’s Office (ICO).

These rights are not absolute and may be subject to exemptions or other legal requirements. We will assess each request in accordance with the law. We may need to verify the identity and authority of the person making a request before responding. For children’s information, we will consider who is entitled to exercise the relevant right in the particular circumstances.

15. Making a privacy request or complaint

To ask a question about privacy, exercise a data protection right or raise a concern, contact Street Beat at kim@sbda.online. Please describe the information or issue clearly. We will respond within the timescales required by law and will explain if we need further information or if a lawful exemption applies.

If an individual is unhappy with our response, they may contact the Information Commissioner’s Office (ICO). Current contact information is available at https://ico.org.uk/ and GOV.UK’s data protection guidance at https://www.gov.uk/data-protection.

Street Beat will not penalise anyone for raising a genuine privacy concern.

16. Data breaches

A personal data breach may include accidental loss, unauthorised disclosure, access by someone without permission, theft, alteration or destruction of personal information. Any suspected breach must be reported immediately to Street Beat management. We will record and assess the incident, take steps to contain and mitigate harm, and notify affected individuals or the ICO where required by law and within the applicable timescales.

17. Responsibilities

Street Beat management is responsible for overseeing this policy, providing appropriate privacy information, maintaining suitable systems and responding to requests or incidents. Anyone working for or on behalf of Street Beat must access and use personal information only for authorised purposes, keep it secure, avoid unnecessary sharing, follow instructions and report mistakes or concerns promptly.

18. Review and related policies

This policy will be reviewed at least annually and sooner if legislation, guidance, systems or Street Beat’s activities change. It should be read alongside the website privacy notice, cookie information where applicable, booking and consent forms, Photography, Filming and Social Media Policy, Safeguarding Policies, Health and Safety Policy, and relevant staff procedures.

Approval

Approved on behalf of Street Beat by: Kim Oakley-Duffill

Role: Director

Date: December 2026

Next review date: December 2027