Sutton Music Trust is part of Cognus Limited, a private company jointly owned by the London Borough of Sutton, local schools, academies and other educational settings.
For more information about how Cognus Limited collects and processes your personal data, and the rights you have under data protection laws, please see this privacy statement issued by Cognus Limited.
This privacy statement outlines how this website processes your personal data and the rights you have.
If you have any questions about this privacy statement or would like any further information, please contact us at suttonmusictrust@cognus.org.uk
Last updated 7 February 2021
Quick navigation
Where we get information from
Most of the information we process is given to us directly by you when you visit our website or sign up to one of our services – for example, when you sign up to our newsletter or complete an application form.
Using our website
This privacy statement outlines how we collect and process your personal information when you visit and interact with suttonmusictrust.org.uk.
Most of the personal information we collect on this website is given to us directly by you – for example, any information you provide for the purpose of submitting an application to us.
Where you provide personal information to us, we will use it only to deliver the service you have requested.
This website does not automatically store personal information other than your IP address and session information (for example, your browser type and length of visit). This is only used for system administration, and to provide statistics used to evaluate the effectiveness of the website.
Cookies
For more information about the cookies we use and why, please click here.
Analytics
When you visit suttonmusictrust.org.uk we use a third-party service, Google Analytics, to collect details of visitor behaviour patterns.
We do this for statistical purposes – for example, for finding out how many users have visited each part of the site. This information is processed in a way that ensures you can’t be identified, and we do not attempt to identify those visiting our website from this data.
Security
We use a third-party web application firewall supplied by WordFence to assist with maintaining the security and performance of our website. The application checks that traffic to our website is behaving as we’d expect and may block traffic that isn’t.
To do this, WordFence will collect and process the following information about you:
- Originating internet protocol (IP) address
- Proxy IP address
- URL accessed
- Complete HTTP header
- HTTP request body
- Cookies
Linode hosts our website and related infrastructure from its datacentre located in London, UK.
Purpose and legal basis for processing
The reason we do all the above is to ensure the continued operation of our website, the services it provides to you, and so we can monitor how it is performing. We may also use this information to make improvements to our website and the services we offer you.
The legal basis we rely on for cookies is consent.
The legal basis we rely on for analytics and security is that it is necessary for the purpose of our or your legitimate interests.
Links to other websites and embedded content
This privacy statement does not cover how other websites might use your personal information – so, where we provide links to the websites of other organisations, we aren’t responsible for how they process your personal information. Instead, please refer to the organisation or website’s own privacy statements to determine how they will use your personal information.
Pages on this site may include embedded content (for example, images and videos). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website.
These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.
Submitting an online application for our ensembles, music academies and peripatetic lessons
We no longer process ensemble, music academy or peripatetic lesson applications through our website. Please see our SpeedAdmin page for more information, or contact us.
When you submit an application for your child to join one of our ensembles, music academies or other groups we collect your personal information and your child’s personal information. This includes your name and contact details, and your child’s name, date of birth, gender and any medical or other important information you think we need to know about them.
We need your name and contact details so we can deal with your enquiry and contact you about any subsequent issues that may arise.
We need information about your child so we can process their application; the information you provide enables us to determine which ensemble, academy or group they are able to join.
When you submit information to us it is reviewed by our members of staff and recorded in our internal IT system.
We use the information to determine if your child is eligible to join one of our ensembles, academies or groups.
We do not carry out any automatic decision making using the information you provide.
Information which is received as part of an application to join an ensemble, music academy or group will be kept for up to one year after the student has stopped receiving instrumental lessons and stopped participating in ensembles. This includes information about the student and their legal guardian.
Registering to attend one of our events
When you sign up to attend one of our events we will ask you for your contact details (full name, e-mail address, contact number) and any additional requirements you might have (such as accessibility needs).
This information helps us to plan our events, communicate with you about them, and ensures we provide you with the best possible experience.
Under construction – please get in touch with us.
Our main legal basis for processing your personal information is that you have given us your consent. Where you have provided consent, you can withdraw it at any time. Occasionally there may be another legal basis that applies.
We use Eventbrite for our event registration and ticketing, who will process your information on our behalf. Eventbrite will keep your information stored for as long as you’re registered to use their services. You can view their privacy policy here.
Using our contact form
When you contact us using our online contact form we collect your full name, email address, and enquiry details so that we can respond to it.
We’ll use the information you give us to respond to your enquiry.
We will keep a record of your enquiry on a relevant internal system.
Our main legal basis for processing your personal information is that you have given us your consent. Where you have provided consent, you can withdraw it at any time. Occasionally there may be another legal basis that applies.
We will retain your information in line with our retention schedule.
The retention will vary depending on the type of enquiry – please contact us for more information on how long we’ll keep this information.
Signing up to our newsletter
If you sign up to receive our newsletter we will ask you to provide your name and your email address.
We need your email address to send you each edition of our newsletter.
We ask you for your first and last name so we can address our newsletters to you, and so we can identify you if you contact us with any questions.
We rely on your consent to process this information. You can withdraw your consent at any time by contacting us or by using the unsubscribe option in any of the newsletter emails you receive from us.
We use this information to:
- Add you to our newsletter mailing list
- Send you regular emails containing our newsletter
- Make you aware of information relating to your subscription – such as a confirmation email or your right to unsubscribe
Our legal basis for processing your personal information is that you have given us your consent. Where you have provided consent, you can withdraw it at any time.
We will keep this information for as long as you remain an active subscriber to our newsletter.
Online learning and delivery of remote activities
Due to the on-going coronavirus (covid-19) pandemic and where possible, we are offering our usual face-to-face music service activities online. To do this, we are using the video conferencing and online collaboration platform, Microsoft Teams.
We use a private edition of Microsoft Teams which is contained within our own Microsoft environment. This gives us greater control over its configuration and privacy settings, which helps us to better safeguard the students and members of staff who use it.
For more information about the steps we have taken to keep everyone safe using this platform, please see this page.
Recordings
For the purpose of safeguarding our students and our tutors, we record every video, audio and message activity which takes place on Microsoft Teams. This includes music academy lessons and peripatetic lessons, as well as our ensemble meetings.
Recordings can only be initiated by Music Trust tutors or Music Trust staff, and every participant receives a notification when this happens which includes a link to this privacy statement. At the end of the meeting the recording is automatically uploaded to Microsoft SharePoint. Recordings can only be accessed by Music Trust staff or, where they initiated the recording or attended the meeting, Music Trust tutors.
Recordings are deleted 21 days after they are uploaded to the platform.
Ensembles
If your child participates in our online ensemble meetings we will create and license an account within our Microsoft environment which they must use to login and take part.
To create an account we will need your child’s name and the ensembles they belong to, and your name and contact email address.
We need your child’s name so they can be identified when taking part in online meetings.
We need their ensemble details to make sure they are added to the correct meeting space in Microsoft Teams.
We need your name and email address so they can be used as recovery contact details in the event you forget the account password.
We use this information to:
- Provision an account in our Microsoft environment, using your child’s name as the basis for their account name.
- Add your child to any relevant ensembles they belong to so they can interact only with those other students who belong to the same ensembles.
- Track participation to ensemble meetings and to ensure only registered students are able to join.
- Send account-related details to the contact email address you provide.
Our main legal basis for processing your personal information is that you have given us your consent. Where you have provided consent, you can withdraw it at any time. Occasionally there may be another legal basis that applies.
We will keep this information in our Microsoft system for as long as your child remains a member of one of our ensembles.
When your child no longer participates in our ensembles we will keep this information stored for up to 12 months, however their account will be deactivated.
Who we share your personal information with
We don’t share your personal information with third parties for the purpose of direct marketing.
Where possible, we try to keep your personal information within the European Economic Area. If we can’t, then we’ll take the appropriate steps to make sure your personal information remains safe.
We use data processors that process personal information on our behalf. These data processors are required to comply with the law, act only on our instructions, not share it with third parties unless we give permission, and to keep it secure.
As part of our Music Hub funding agreement and for administration purposes, we share some student personal information (for example age, gender, name of school attended, and specific educational needs) with Arts Council England for the purpose of tracking progression rates and participation. You can view Arts Council England’s privacy policy here.
There are also some circumstances where we might be legally obliged to share your personal information with a third party. For example, if ordered to do so by a court.
Your rights
You have a number of rights under data protection laws which are set out below. These rights don’t always apply and sometimes there are exemptions we can apply.
You have the right to ask us for a copy of the personal information we hold about you.
You have the right to ask us to correct personal information we hold about you that you think is wrong, or to complete personal information we hold about you that you think is incomplete.
You have the the right to ask us to delete some or all of the personal information we hold about you.
You have the the right to ask us to restrict or stop the processing of information we hold about you.
You have the the the right to object to us processing your personal information.
You have the right to ask us to transfer personal information we hold about you to another organisation, or provide it to you.
You usually won’t have to pay anything to exercise these rights.
If you would like to make a request, please contact suttonmusicservice@cognus.org.uk. We will have one month to respond to you.
What if I’m unhappy with the way you’ve handled my personal information?
Please contact us at suttonmusicservice@cognus.org.uk and a member of our team will deal with your concerns.
If you’re unhappy with our response you can contact the Information Commissioner’s Office at:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Tel: 0303 123 1113 (local rate)
Fax: 01625 524 510
