Privacy statement

Privacy statement

Sutton Music Service is part of Cognus Limited, a private company jointly owned by the London Borough of Sutton, local schools, academies and other educational settings.

For more information about how Cognus Limited and Sutton Music Service collect and process your personal data, and the rights you have under the Data Protection Act 2018 and General Data Protection Regulation, please see this privacy statement issued by Cognus Limited.

This privacy statement outlines how this website processes your personal data.

Last updated 6 September 2020

Quick navigation

Using our website

This privacy statement outlines how we collect and process your personal information through

Sutton Music Service may receive some personal information from you through this website – for example any information you provide for the purpose of submitting an application to us.

Where you provide personal information to us, we will use it only to deliver the service you’ve requested.

This website does not automatically store personal information other than your IP address and session information (for example, your browser type and length of visit). This is only used for system administration, and to provide statistics used to evaluate the effectiveness of the website.


To achieve this our website uses cookies, which are tiny text files that are downloaded to your computer, to improve your experience.

The table below outlines the cookies we set, why we set them, and how long they last for.

Cookie name

Cookie expiry

Cookie purpose


1 Year

Used by the content network, Cloudflare, to identify trusted web traffic.


1 Year

Stores the user’s cookie consent state for the current domain.


1 Day

Used to check if the user’s browser supports cookies.


When you visit our website we use a third party service, Google Analytics, to collect details of your behaviour patterns.

We do this for statistical purposes – for example, for finding our how many users have visited each part of our site. This information is processed in a way that ensures you can’t be identified. 


We use a third party web application firewall supplied by WordFence to assist with maintaining the security and performance of our website. The application checks that traffic to our website is behaving as we’d expect. The application may block traffic that is not using our site as expected – to do this, WordFence will process your IP address.

We also use another third party web application firewall supplied by Cloudflare. The application checks that traffic to our website is behaving as we’d expect and may block traffic that is not using our site as expected. To do this, Cloudflare will process your IP address.

We rely on the Privacy Shield Framework to transfer your information to Cloudflare servers which are located in the US. They hold this information for up to seven days.

We also perform regular vulnerability scans of our servers which host this website, using the industry-leading vulnerability management software, Qualys.

Links to other websites and embedded content

This privacy statement does not cover how other websites might use your personal information – so, where we provide links to the websites of other organisations, we aren’t responsible for how they process your personal information. Instead, please refer to the organisation or website’s own privacy statements to determine how they will use your personal information.

Pages on this site may include embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website.

These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.

Submitting an online application for our ensembles, music academies and peripatetic lessons

When you submit an application for your child to join one of our ensembles, music academies or other groups we collect your personal information and your child’s personal information. This includes your name and contact details, and your child’s name, date of birth, gender and any medical or other important information you think we need to know about them.

We need your name and contact details so we can deal with your enquiry and contact you about any subsequent issues that may arise.

We need information about your child so we can process their application; the information you provide enables us to determine which ensemble, academy or group they are able to join. 

When you submit information to us it is reviewed by our members of staff and recorded in our internal IT system.

We use the information to determine if your child is eligible to join one of our ensembles, academies or groups.

We do not carry out any automatic decision making using the information you provide.

Information which is received as part of an application to join an ensemble, music academy or group will be kept for up to one year after the student has stopped receiving instrumental lessons and stopped participating in ensembles. This includes information about the student and their legal guardian.

Registering to attend one of our events

When you sign up to attend one of our events we will ask you for your contact details (full name, e-mail address, contact number) and any additional requirements you might have (such as accessibility needs).

This information helps us to plan our events, communicate with you about them, and ensures we provide you with the best possible experience.

Under construction – please get in touch with us.

We use Eventbrite for our event registration and ticketing, who will process your information on our behalf.  Eventbrite will keep your information stored for as long as you’re registered to use their services. You can view their privacy policy here.

Using our contact form

When you contact us using our online contact form we collect your full name, email address, and enquiry details so that we can respond to it.

We’ll use the information you give us to respond to your enquiry.

We will keep a record of your enquiry on a relevant internal system.

We will retain your information in line with our retention schedule.

The retention will vary depending on the type of enquiry – please contact us for more information on how long we’ll keep this information.

Signing up to our newsletter

If you sign up to receive our newsletter we will ask you to provide your name and your email address.

We need your email address to send you each edition of our newsletter.

We ask you for your first and last name so we can address our newsletters to you, and so we can identify you if you contact us with any questions.

We rely on your consent to process this information. You can withdraw your consent at any time by contacting us or by using the unsubscribe option in any of the newsletter emails you receive from us.

We use this information to:

  • Add you to our newsletter mailing list
  • Send you regular emails containing our newsletter
  • Make you aware of information relating to your subscription – such as a confirmation email or your right to unsubscribe

We will keep this information for as long as you remain an active subscriber to our newsletter.

Online learning

Due to the on-going coronavirus (covid-19) pandemic and where possible, we are offering our usual face-to-face music service activities online.  To do this, we are using the video conferencing and online collaboration platform, Microsoft Teams. We have chosen to use this over other services due to added security controls we can leverage for safeguarding, and for how the platform stores and processes Music Service data – including your personal data if you choose to engage with us on it.

For the purpose of safeguarding our students and our tutors, we record every video, audio and message activity which takes place on Microsoft Teams. This includes music academy lessons, peripatetic lessons and also our ensemble meetings. Recordings are initiated by music tutors or music service staff and every participant will receive a notification when this happens which includes a link to this privacy statement. At the end of the meeting the recording is automatically uploaded to Microsoft Stream, a video storage platform.  These recordings can only be accessed by Music Service staff as well as our tutors, who can only access recordings which they initiated.

Recordings are deleted 21 days after they are uploaded to the platform.

Our Microsoft Teams and Microsoft Stream data is stored and processed in the United Kingdom. We do not transfer this data outside of the European Economic Area. 

Who we share your personal information with

We don’t share your personal information with third parties for the purpose of direct marketing.

Where possible, we try to keep your personal information within the European Economic Area. If we can’t, then we’ll take the appropriate steps to make sure your personal information remains safe.

We use data processors that process personal information on our behalf. These data processors are required to comply with the law, act only on our instructions, not share it with third parties unless we give permission, and to keep it secure.

As part of our Music Hub funding agreement and for administration purposes, we share some student personal information (for example age, gender, name of school attended, and specific educational needs) with Arts Council England for the purpose of tracking progression rates and participation. You can view Arts Council England’s privacy policy here.

There are also some circumstances where we might be legally obliged to share your personal information with a third party. For example, if ordered to do so by a court.