Who we are
Lucy Lovick Dance Studio Limited (company number 14935187) is the data controller for the information described here. That means we decide what is collected and what happens to it, and we are answerable for it.
Studio 208, 208 Sydenham Road, London SE26 5SE
[email protected]
07888 657 685
If you want to ask about anything on this page, or make a request about your own or your child's information, email us and say so plainly. You do not need to use any particular form of words.
This policy covers our website, the parent portal, the student and teacher apps, the uniform shop, and the records we keep to run classes. It replaces our previous policy, which described a third-party system we no longer use.
What we hold
If you enquire and do not join, we hold your name, your email address or phone number, your child's name and date of birth, how you heard about us, and whatever you wrote in your message.
If your child dances with us, we hold their name, preferred name, date of birth and address; who their parents and guardians are and how to reach them; emergency contacts; which classes they are in and their attendance; the consents you have given; any health information you have told us about; fees and payments; and notes staff write about how things are going.
If your child uses the learning app, we hold a username, the exercises they have practised, their own record of how confident they feel, and feedback or verification entered by their teacher.
If you buy uniform, we hold your name, email address, phone number, billing address, what you ordered and who it was for, and the reference for the payment. We never hold your card number.
If you only visit the website, see our Cookie Policy. Briefly: a random visit counter, no IP address, no advertising trackers.
Why, and on what basis
UK data protection law asks us to name a lawful basis for each thing we do. Ours are:
| What we do | Why | Lawful basis |
|---|---|---|
| Reply to your enquiry and arrange a trial | You asked us to | Steps taken at your request before a contract |
| Run classes, registers, exams and shows | It is the service you signed up for | Performance of our contract with you |
| Take fees and sell uniform | Same | Performance of our contract, and our legal duty to keep accounting records |
| Keep children safe, including safeguarding referrals | We are required to, and a child's welfare comes first | Legal obligation, and protecting someone's vital interests |
| Health and medical details | So we can teach your child safely | Your explicit consent, or vital interests in an emergency |
| Photographs and video | To record and promote the school | Your consent, which you can withdraw |
| Email you about your child's classes | Running the school | Performance of our contract |
| Marketing email to people who have not joined | Telling you about classes you enquired about | Our legitimate interests, and you can opt out at any time |
| Measuring how the website is used | Making the site easier for families to use | Our legitimate interests |
| Keeping the site and accounts secure | Preventing fraud and abuse | Our legitimate interests |
Where we rely on consent, you can take it back whenever you like and we will stop. Taking back consent does not undo anything we did while it was in place.
Health information
Health information about a child counts as special category data, and the law sets a higher bar for it. We take that seriously.
What we ask for. Conditions we should know about such as asthma, epilepsy or diabetes, allergies, medication, and any additional needs or support that would help us teach your child well.
Who can see it. Access is restricted to staff who need it. Our system separates a short note a teacher needs in the room, for example that a child carries an inhaler, from the fuller detail, which fewer people can open. Every time a member of staff opens medical detail, that is recorded.
Where it never goes. Health information is not used for marketing, and it is never sent to an advertising or analytics service.
One thing we would ask of you. Please put health information in the medical or registration form we send you, rather than in the general message box on the Contact page. The forms mark those questions as sensitive, which is what triggers the extra protection described above. A general enquiry message is treated as ordinary correspondence, so medical detail written there does not get the same handling. If you have already done this and would like it moved, email us and we will sort it out.
Photographs and video
We photograph and film classes, shows and events. We ask for your consent first, and you can change your mind at any time by emailing us.
We do not publish children's names alongside their pictures on the website or on social media. Our media library holds the original files.
Video for the student learning app is served privately and is not publicly accessible.
Who else sees it
We do not sell your information and we never will. We share it in four situations.
Companies that run parts of the service for us. They act on our instructions and cannot use your information for their own purposes.
| Company | What they handle |
|---|---|
| Stripe | Card payments for uniform. You enter your card on Stripe's own page, so we never see it |
| Resend | Sending our emails, and telling us whether they arrived |
| Cloudflare | Protecting and speeding up the website, and storing photographs, video and files you upload |
| AI service providers | Helping staff with routine office work |
Organisations we have to deal with to run the school, such as the ISTD for dance exams, or the local authority for performance licences. We ask your permission before sending your child's details for these, and we only send what is needed.
Safeguarding and the law. If we are worried about a child's safety, we will pass information to the people who need it, and we will not ask permission first. We also comply where the law or a court requires it.
If the school changes hands, records would transfer to the new owner, and we would tell you.
Where it is kept
The school's records live in our own database, on our own server in London, rather than on a shared commercial platform.
Photographs, video, files you upload and our encrypted backups are stored with Cloudflare, on storage set to keep them within Europe.
Some of the companies listed above operate outside the UK. Where information reaches them, it is protected by the safeguards UK data protection law requires for international transfers.
How long we keep it
We keep records for as long as we need them, then dispose of them safely. Some periods are fixed by law, for example accounting records. Others follow our retention schedule, which we will share on request.
These are the automatic ones built into the website itself:
| What | How long |
|---|---|
| Website visit measurement | Individual events 90 days, daily totals 2 years |
| Server request logs | 14 days |
| A part-finished form saved in your browser | 7 days |
| Files uploaded to a form but never submitted | 7 days |
| Encrypted backups | Up to 190 days, depending on the backup |
When a child leaves, we do not simply delete everything. Some records have to be kept, particularly safeguarding and accounting records. When the retention period for a person's records runs out, we remove names, contact details and addresses and redact personal notes and medical text, while keeping the consent and financial history we are obliged to hold. That process needs sign-off before it runs.
How we protect it
- Everything travels over an encrypted connection, and our server accepts traffic only through our security provider.
- Staff accounts require two-step sign-in. Access is granted section by section, so staff see only the parts of the system their role needs.
- Medical detail, safeguarding notes and privacy tools sit behind further restrictions, and access to them is logged.
- Backups are encrypted, stored separately, and checked automatically.
- Passwords are stored as hashes, never in readable form. Security links in emails are single use.
- Files you upload to a form are stored with unguessable names and can only be downloaded by staff through the system, which records who did so.
No system is perfectly secure, and we will not pretend otherwise. If something goes wrong in a way that puts you at risk, we will tell you and the Information Commissioner, as the law requires.
Your rights
You have the right to:
- Be told what we hold and what we do with it, which is what this page is for.
- See a copy of your own or your child's information.
- Correct anything wrong.
- Ask us to delete information, where we do not have a good reason to keep it.
- Restrict what we do with it while a question is being sorted out.
- Object to processing based on our legitimate interests, including marketing.
- Take your information elsewhere in a portable form.
- Withdraw consent you have given, at any time.
Email [email protected] and tell us what you want. We will respond within one month. If we cannot do what you ask, we will explain why.
Being straight with you about two things. Handling these requests is a manual job for us at present rather than a button you can press, and our self-service tools for this are still being built. And some records, particularly safeguarding, accounting and consent records, we are obliged to keep even if you ask us to delete them. We will always tell you which parts we have kept and why.
Where a child is old enough to understand, these rights are theirs, and we will deal with them directly where that is appropriate. For younger children, parents and guardians exercise the rights on their behalf.
Complaints
Please come to us first. Email [email protected] and we will look into it.
If you are not happy with how we have handled it, you can complain to the Information Commissioner's Office, the UK regulator for data protection, at ico.org.uk or on 0303 123 1113. You can go to them at any point, but it usually helps to let us try first.