Essex Circus Academy is the data controller and is committed to complying with our legal responsibilities under data protection law. We take your privacy seriously and will ensure your personal information is kept secure.

When we collect, use, share, retain or do anything else with your personal information (known collectively as ‘processing’) we are regulated under the General Data Protection Regulation (GDPR) and are responsible as ‘controller’ of your information.

This notice applies to you if you are:

• An existing or prospective member of our Academy

• A person with parental responsibility for a member or an individual attending the premises

• A contractor, supplier or contact of the business

• An existing or prospective employee or volunteer

Information Essex Circus Academy collect about students

The categories of personal information we process includes:

• Main contact and emergency details

• Student date of birth

• Any relevant medical conditions, disabilities, allergies, previous significant injuries and additional related information

• Other relevant individual needs for example, information about learning or other support needs.

• Details of any reasonable adjustments or steps taken to support your individual needs

• Attendance and achievement records

• Any communications from, to or relating to you

• Details relating to standards of conduct

• Any accident or incident reports including details of injuries

• Website cookies which may include IP address, browser identifier and the time of access (if you use our website)

• Bank details for direct debit payments (customer details are stored via Stripe and not accessible to our employees)

• When you create an account, the system automatically sets up several cookies to save your login information and your screen display choices. Login cookies last for two days, and screen options cookies last for a year. If you select “Remember Me”, your login will be saved. If you log out of your account, the login cookies will be removed.

• Our website may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction if you have an account and are logged in.

• For users that register on our website, we store the personal information they provide in their user profile. Users can see, edit, or delete their personal information. Website administrators can also see and edit that information.

Information Essex Circus Academy collect about employees and volunteers

If you are an employee or volunteer, we may also record other information about you to support you and fulfil our legal requirements such as:

• Qualifications, training records and proof of DBS.

• Annual leave and sickness record

• National insurance, tax, pension and bank payment details

• Proof of eligibility to work in the UK

• Performance review, appraisal, disciplinary records and communication relating to these and your development.

Our purposes for processing information about you

We use the information we hold about you for a variety of purposes. Data protection law requires us to tell you what our legal reason is for each purpose.

• Contractual purposes. When you ask us to provide you a service, we usually need to use information about you to provide this product and/or service, for example:

• To contact you to confirm arrangements.

• To notify you about changes to terms and conditions.

• To process payments or send you receipts required.

• To provide you with the benefits and services to which you have subscribed.

• For safeguarding and safety purposes.

Legal obligations

We have a duty of care to ensure it is safe for you or your child to take part in circus activities. Some individuals may be at risk of harm from participating as a result of a pre-existing condition. It is vital that you let us know if there is any reason why taking part in circus activities may be unsafe prior to participation. With your agreement, we will review any information you provide and work with you for effective support. We may need to ask you for more information to help us to best meet you or your child’s needs. We will keep a record of any steps we take to support inclusion.

If you are wishing to volunteer or work for us, we will ask you to complete a DBS check as we have a legal obligation to do so.

When we retain information about you, even after you are no longer taking part in circus activities, this is often because we are required to do so by law such as records, we are required to keep for business and accounting purposes.

Legitimate interests

We rely on legitimate interests for the following purposes:

• Responding to communications, concerns or complaints and seeking feedback from you about our services.

• Holding emergency contact information

• Maintaining attendance registers, achievement records and waiting lists

• Filming for development purposes. On occasion, we may film during a session for instructor development purposes. These will not be used for any other purpose without prior consent.

Individual rights and consent

We rely on consent in the following circumstances:

• To use your email or telephone numbers for internal marketing purposes

• To take photographs and video to promote the Academy on our website, social media accounts and in communications.

When you have given us your consent for your personal information to be used for a particular purpose, you have the right to withdraw this consent at any time, which you may do by contacting us in writing on info@essexcircusacademy.co.uk

You have the right to be informed about how your information is processed, to access personal data held about you, to have your data rectified if it is inaccurate and to have your data deleted (except if there is a valid lawful reason to retain it).

If you object to processing, we will restrict the processing of your information for the purpose to which you are objecting whilst we review your objection.

Special categories of personal data

Special categories of personal data are a category of information that is more sensitive and requires greater protection. It is unlawful for organisations to process this type of information unless an additional legal condition applies. We will only process this type of information if one of the following applies:

• You have given your explicit consent or have made this information public.

• We are required to do so to establish, exercise or defend a legal claim.

• We are required to do so to comply with employment or social security or social protection law.

• There is a substantial public interest in doing so or it is in your vital interests, and you are unable to provide consent.

Why we share information about you

• Complying with legal and/or regulatory responsibilities

• We may be required to share information with bodies such as Her Majesty’s Revenue & Customs (HMRC), Health & Safety Executive (HSE), Police and Information Commissioner’s Office (ICO).

• We may also share information with other organisations to safeguard children. Any information that is shared will be strictly limited to what is required to ensure children are protected from harm and will be carried out in accordance with the law and relevant government guidance.

• We may be required to share information by our insurance underwriters.

• Obtaining legal or professional advice.

• Obtaining a service from a third party. All service providers are contractually required to ensure your information is secure and cannot use this information for their own purposes. We only disclose information that is strictly necessary to deliver the service.

Data retention and transferral

If you do not renew your subscription or cease to have a relationship with the Academy, we will delete any information you provided within two years except for any financial/accounting records which need to be retained for six years in line with UK tax law.

Video footage that has only been taken for developmental purposes will be retained only for as long as it is required for that purpose.

Photographs and other video footage captured for promotional purposes will be retained for up to two years then deleted unless they may remain in active use on websites and social media. Please be aware that social media platforms may process the data in line with their own policies and procedures.

We will not transfer or store your personal data outside the UK.

Additional information

To exercise any of your rights or if you have any questions about our privacy notice please contact: info@essexcircusacademy.co.uk

While we hope to be able to resolve any concerns you have about the way that we are processing your personal data, you have the right to lodge a complaint with the Information Commissioners Office (ICO) if you believe your data has been processed in a way that does not comply with the GDPR or have any wider concerns about our compliance with data protection law. You can do so by calling the ICO helpline on 0303 123 1113 or via their website.

We have appropriate security measures in place to prevent personal information from being accidentally lost, or used or accessed in an unauthorised way. We limit access to your personal information to those who have a genuine reason to need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.