Privacy Policy

1. What we collect

When you book lessons through our booking site, we collect:

• About you (the parent/guardian): your name, email address, phone number, and billing postcode.
• About your child: their name, school year, chosen instrument or group, and lesson day/time.
• Payment information: your card details are collected and stored by Stripe, our payment processor — we never see or store your full card number. We hold only records of payments made (amount, date, status).

We don't collect more than we need to run lessons and take payments, and we don't buy or collect information about you from anyone else.

2. Children's information

Because we teach children, we necessarily hold some information about your child (their name, school year, and lesson details). We collect this from you, the parent or guardian — not from the child — and we use it only to provide their lessons. We take particular care with it.

3. How we use your information, and why we're allowed to

We only send emails needed to run your child's lessons. We do not send marketing emails unless you have separately agreed to receive them, and we never sell your information.

4. Who we share information with

We use a small number of trusted service providers (“processors”) to run the business. They can only use your information on our instructions:

• Stripe — payment processing and secure storage of card details.
• Resend — sending our transactional emails.
• Railway — hosting our booking and payments app.
• Squarespace — hosting our main website.

We may also share information where the law requires it (for example with HMRC, or where necessary for safeguarding), or with professional advisers such as our accountant.

5. International transfers

Some of our providers (such as Stripe, Resend, and Railway) are based in, or store data in, the United States. Where your information leaves the UK, it is protected by legally recognised safeguards — such as the UK Extension to the EU–US Data Privacy Framework or UK-approved contractual clauses — so it receives an equivalent level of protection.

6. How long we keep information

• Enrolment and lesson records: for as long as your child attends, and up to 2 years afterwards in case you return or we need to answer a query.
• Payment and financial records: 6 years after the end of the relevant financial year, as required by UK tax law.
• Email enquiries: up to 2 years.

After these periods, information is deleted or anonymised.

7. Your rights

Under UK GDPR you have the right to:

• Access a copy of the information we hold about you and your child.
• Correct anything that's inaccurate.
• Delete your information (where we no longer need to keep it).
• Restrict or object to how we use it in certain circumstances.
• Portability — receive the information you gave us in a reusable format.

To use any of these rights, email enquiries@rugbymusiccentre.co.uk. We'll respond within one month. There's no fee.

8. Security

Our booking app uses encrypted connections, card details are handled entirely by Stripe (a PCI-DSS certified payment processor), and access to your information is limited to the directors who need it to run lessons.

9. Cookies

Our booking site uses only the cookies necessary for it to function (for example, to keep you signed in during booking and to let Stripe process payments securely). Our main website is hosted on Squarespace, which may set its own cookies — see the cookie notice on that site.

10. Complaints

If you have a concern about how we handle your information, please contact us first and we'll do our best to put it right. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk or 0303 123 1113.

11. Changes to this policy

We may update this policy from time to time. We'll post the current version on our website and flag significant changes by email.