We keep your information safe and use it only to help you learn music, stay in touch about lessons, and keep everyone protected.
We follow UK data-protection laws and never sell your information.
We only share it with trusted services that help us run lessons and payments (like MyMusicStaff and Stripe).
We have cameras in some studios and record office calls to keep people safe.
If you (or your parent/guardian) ever want to see, change, or delete your information, just email benanamusicstudio@gmail.com.
You can also ask us not to use your photos or videos for marketing — that’s always your choice!
(Full Privacy Notice below explains everything in more detail.)
Benana Music Studios Ltd – Privacy Notice (Data Protection and GDPR)
Effective date: 20 October 2025
Version 2.0 Last updated to include clearer children’s-data protections, Auto-Pay and payment-processor details (MyMusicStaff & Stripe), enhanced CCTV and call-recording transparency, and strengthened data-security measures.
Version 2.1 – Updated July 2026
Updated to reflect the Data (Use and Access) Act 2025 changes now in force, including data-protection complaints handling, children’s data considerations, subject access requests and other amendments to UK data protection law.
1. Who We Are
Benana Music Studios Ltd (“we”, “our”, “us”) provides music lessons, workshops, and related educational services. We are the Data Controller for personal information we collect and use about students, parents/guardians, enquiries, website visitors, applicants, and suppliers.
Benana Music Studios Ltd operates under the trading names “Benana Music Studio” and “Benana Music Studios.” All services are supplied by Benana Music Studios Ltd (“we”, “us”, “our”).
There is CCTV at our Bitterne Park, City Centre locations and at Pure Rehearsal Studios (see Section 9). View CCTV Policy here.
Contact details:
Email: benanamusicstudio@gmail.com
Telephone: 07728 836428
Address: 33 Queens Terrace, Southampton, England, SO14 3QB
Responsible person for data protection: Ben Faux
(We are registered with the Information Commissioner’s Office (ICO).)
We continually review our data practices to comply with the Data (Use and Access) Act 2025 and related amendments to UK GDPR and PECR.
2. The Information We Collect
We collect only what we need to deliver services safely and effectively:
- Identity & Contact Data: names, addresses, emails, phone numbers; for children, name/age and parent/guardian details, emergency contact when provided.
- Lesson & Service Data: bookings, timetables, attendance, progress notes.
- Payment & Transaction Data: invoice amount/date, status, last 4 digits of card; we do not store full card details (Stripe processes these).
- Communication Data: emails, SMS/WhatsApp lesson communications, enquiry records.
- Audio/Visual Data: CCTV video & audio (at Bitterne Park, Queens Terrace and Pure Rehearsal Studios) and business call recordings (main office line only).
- Photos/videos for marketing only with explicit consent.
- Technical/Website Data: IP address, device/browser info, usage, cookies/analytics (see Section 17).
- Online Lessons: when online lessons use platforms such as Zoom/Google Meet/Skype, those platforms process data under their own privacy notices; we do not record sessions unless we tell you first and obtain consent.
- Recruitment Data: CVs, contact details, work history, references for applicants (Section 18).
- Consent & Preference Records: opt-ins/opt-outs (marketing, media, cookies), stored securely (e.g., Google Drive / Adobe e-sign).
- Safeguarding Notes (when relevant): limited information needed to protect students and meet legal duties.
- Complaints/Support Records: details necessary to investigate and resolve issues.
Special category data (sensitive personal information), such as relevant health information, is only processed where necessary. Where we process special category data, we identify both an appropriate lawful basis under Article 6 UK GDPR and an additional condition for processing under Article 9 UK GDPR and, where applicable, the Data Protection Act 2018. Depending on the circumstances, this may include explicit consent, vital interests, or substantial public interest conditions such as safeguarding. Access is restricted to those who need the information.
3. How We Collect Data
- Directly from you (via forms, email, phone, WhatsApp, portal).
- From staff entries (e.g., attendance, lesson notes).
- Automatically via our website (cookies / analytics).
- From CCTV systems and call recordings.
- Our website includes a chat assistant powered by HubSpot, which uses cookies and processes personal data when you start a conversation or complete a form.
If we receive your data from someone else (for example a referral or public social-media source), we’ll let you know within one month.
We also apply data protection by design and by default,” ensuring privacy is embedded in our systems and teaching platforms from the outset, especially where children are involved.
4. Why We Use Your Data & Legal Bases
| Purpose | Example data used | Legal basis | Typical retention |
| Manage bookings, lessons and communications | Name, contact, lesson info | Contract | 6 yrs after last lesson |
| Invoicing and Auto-Pay via Stripe/MyMusicStaff | Payment records | Contract + Legitimate Interests | 6 yrs (fiscal) |
| Safeguarding, health & safety or legal duties | Safeguarding notes | Legal Obligation / Vital Interests | To age 25 or 6 yrs after last contact |
| CCTV & Call recording for security and quality | Audio / video footage | Legitimate Interests (security, safeguarding, incident investigation and service quality); Legal Obligation where processing is specifically required by law. | CCTV ≈ 28 days; Calls ≤ 6 months |
| Photos / videos for marketing | Images, names | Consent | Until withdrawn or project end |
| News / event updates | Email / phone | Consent (PECR) | Until withdrawn |
| Recruitment & vetting (DBS checks) | CV, ID docs | Legal Obligation / Consent | ≤ 6 months post-process |
| Website cookies / analytics | Technical data | Consent (PECR) | Varies by cookie |
We do not use automated decision-making or profiling that produces legal or significant effects.
5. Children’s Data
We provide music lessons and related services to children and young people. We take particular care when collecting, using and protecting their personal information.
Where a student is under 18, registration and account information must be completed and managed by a parent, guardian or other responsible adult aged 18 or over. We may still collect and use limited personal information directly relating to the student where necessary to provide lessons, communicate appropriately, maintain lesson records, and support their safety and wellbeing.
We keep only the personal information that is reasonably necessary for these purposes, which may include the student’s name, age, lesson and attendance records, relevant emergency contact details, and other information needed to provide our services safely and effectively.
Safeguarding records are stored securely and access is restricted to authorised individuals who need the information for safeguarding purposes.
Children’s photos or videos are used for marketing only where appropriate consent has been obtained. Consent can be withdrawn at any time.
Where our online services are likely to be accessed or used by children, we take children’s needs, interests and rights into account when deciding how their personal information is collected, used and protected. We aim to provide privacy information in a clear and age-appropriate way and apply data protection by design and by default.
6. Who Has Access to Your Data
- Directors & Operations Manager: management and safeguarding.
- Designated Safeguarding Lead (DSL): child protection oversight.
- Admin Staff: bookings and billing.
- Teachers / Contractors: limited lesson data via MyMusicStaff portal.
All staff and contractors complete GDPR and safeguarding training and must follow our confidentiality standards.
7. Third-Party Service Providers & International Transfers
We use trusted third-party service providers to help us manage lessons, payments, communications, administration and business operations. Depending on the service and the circumstances, these organisations may act as data processors on our behalf or as independent data controllers in their own right.
Our key service providers and other recipients include:
- MyMusicStaff – lesson management, scheduling and student portal.
- Stripe – secure payment processing.
- Monzo Bank Ltd – business banking, payments and financial transactions.
- Google Workspace – email and cloud document storage.
- QuickBooks Online – accounting and financial records.
- Zappie Ltd and SY+ – CCTV, telecommunications and related services.
- SBalance and Agutter Associates – bookkeeping and accountancy services.
- WordPress / MMF – website hosting, management and forms.
- WhatsApp Business – communications with students, parents and other contacts.
- Trello (Atlassian) – internal task management, administration and operational follow-up.
- Business advisers and consultants – limited access where necessary to provide consultancy or administrative support.
- Professional advisers, including insurers, lawyers and auditors – where necessary for professional advice, insurance, disputes or legal matters.
- Authorities and regulators, including the police, courts and the Information Commissioner’s Office – where disclosure is required or permitted by law.
Some of our service providers may process personal information outside the UK. Where personal information is transferred internationally, we take steps to ensure that an appropriate lawful transfer mechanism is in place, such as UK adequacy regulations or approved contractual safeguards, and carry out any assessments required by UK data protection law.
8. Payments and Auto-Pay
Payments are handled through Stripe via MyMusicStaff.
We never see or store full card details.
You may cancel Auto-Pay any time by contacting us. Stripe is PCI-DSS compliant and uses end-to-end encryption.
We are moving to a cashless model; bank transfer may be used in exceptional cases where required.
9. CCTV Monitoring
Benana Music Studios Ltd operates CCTV with video and audio recording at its Bitterne Park and Queens Terrace teaching locations for security, safeguarding, safety, protection of people and property, and the investigation of specific incidents or concerns. Our primary lawful basis is our legitimate interests.
Recordings are stored securely on password-protected local systems with access restricted to authorised individuals. Footage is normally retained for approximately 28 days unless required for longer for a specific safeguarding matter, incident, complaint, investigation, insurance claim or legal matter. Where necessary and lawful, relevant footage may be shared with appropriate authorities, insurers, safeguarding bodies, legal advisers or regulators.
CCTV is not routinely monitored live or used for routine performance monitoring, although footage may be reviewed where there is a specific and legitimate reason.
CCTV at Pure Rehearsal Studios is operated separately by Pure Rehearsal Studios Ltd.
For full details, including camera locations, audio recording, access, retention and individual rights, please see our separate CCTV and Audio Surveillance Policy.
9A. Telephone Call Recordings
Business calls recorded via Communicator by Zappie for training, quality, and safeguarding. Caller details logged (number, time, duration). Basis: legitimate interests + legal obligation (if safeguarding). Retention: up to 6 months unless needed longer for a specific matter.
DPIAs have been completed for both processes and are reviewed annually.
10. Data Security
We apply technical and organisational measures to keep your data safe:
- Encrypted devices and secure passwords for all systems.
- Two-factor authentication for remote access.
- Role-based access controls and audit logs.
- Regular staff training on GDPR and safeguarding.
- Data backups and secure deletion after retention periods.
11. Your Rights
Under UK data protection law, including the UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025, you may have the following rights in relation to your personal information:
- Right of access – request access to the personal information we hold about you. When responding to a request, we will carry out reasonable and proportionate searches as required by data protection law.
- Right to rectification – ask us to correct personal information that is inaccurate or complete information that is incomplete.
- Right to erasure – ask us to delete your personal information in certain circumstances.
- Right to restriction of processing – ask us to restrict how we use your personal information in certain circumstances.
- Right to withdraw consent – where we rely on your consent, for example for certain marketing or use of photos and videos, you can withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn.
- Right to object – object to processing where we rely on legitimate interests. For example, you may ask us to stop processing your personal information for purposes such as CCTV or call recording. We will stop processing unless we can demonstrate compelling legitimate grounds to continue, or the processing is required for the establishment, exercise or defence of legal claims.
- Right to data portability – request that certain personal information you have provided to us is transferred to you or, where technically feasible, to another organisation, where this right applies.
- Right to complain – make a data protection complaint to us and lodge a complaint with the Information Commissioner’s Office (ICO) if you are concerned about how we have handled your personal information.
These rights do not apply in every situation. Whether a particular right applies will depend on the circumstances, the type of personal information involved, and the lawful basis on which we process it. Some rights may also be restricted where we are required or permitted by law to retain or continue processing information, for example certain financial, safeguarding or legal records.
To exercise any of your rights or make a data protection complaint, please contact us at benanamusicstudio@gmail.com.
We will respond to requests within the timeframes required by data protection law, normally within one month. Where permitted by law, this period may be extended for complex or multiple requests, and we will let you know if an extension is required.
12. Data Breaches
If a data breach poses a risk to your rights or freedoms we will:
- Notify the ICO within 72 hours, and
- Inform affected individuals as required.
13. Marketing and Communications
- Service communications: We may contact students and parents about lessons, bookings, payments, closures, safeguarding and other matters necessary to provide our services.
- Marketing communications: We send promotional emails, texts or WhatsApp messages where permitted by law and provide an easy way to opt out.
14. Recruitment and Teacher Data
We process applicant data (contact, CV, references, DBS status) to assess suitability and meet safeguarding requirements.
We keep recruitment records for up to 6 months after a decision, unless required longer for legal reasons.
DBS details (record number and date only) are stored securely and separately.
15. Data Retention Summary
| Data Type | Typical Retention Period |
| Student / Parent records | 6 years after last lesson |
| Invoices & payments | 6 years after financial year end |
| Safeguarding / incident reports | Until age 25 or 6 years after last contact |
| Accident book | 3 years (21 if child) |
| CCTV footage | ≈ 28 days |
| Call recordings | ≤ 6 months |
| Recruitment applications | ≤ 6 months |
| Marketing consent logs | Until withdrawn or 3 yrs after last contact |
Complaint files may be retained longer where needed to resolve disputes or meet legal obligations.
16. Cookies and Tracking Technologies
Our website uses cookies and similar technologies to operate securely, provide essential website functions, understand how our website is used and improve your experience.
The types of cookies and similar technologies we may use include:
- Strictly necessary technologies – required for essential website functions, security and services you request. Where the applicable legal exemption applies, these may be used without consent.
- Analytics technologies – used to help us understand website traffic and how visitors use our website, including through Google Analytics (GA4). Where consent is required, these technologies are activated only after you have given consent.
- Social media and embedded-content technologies – third-party services, such as Instagram or Google Maps, may use cookies or similar technologies when embedded content is displayed or used. Where consent is required, these technologies are activated only after you have given consent.
You can manage or withdraw your consent for non-essential cookies and similar technologies at any time through our cookie consent settings. Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn.
Where cookies or similar technologies involve the processing of personal information, we process that information in accordance with this Privacy Notice and applicable UK data protection law.
For more information about the specific technologies we use, their purposes, providers and retention periods, please see our separate Cookie Policy and cookie consent settings.
17. Changes to This Notice
We review this Notice regularly and update it when laws or systems change.
The latest version and effective date are shown above.
Significant changes will be communicated by email or through the student portal.
18. Complaints
If you are unhappy with how we have handled your personal information, you have the right to make a data protection complaint to us.
You can make a complaint by emailing benanamusicstudio@gmail.com. Please include enough information for us to understand your concern and investigate it properly.
We will acknowledge your complaint within 30 days of receiving it and will investigate and respond without undue delay. We may contact you if we need further information to investigate your complaint.
We will take appropriate steps to help you make a complaint where needed.
If you are not satisfied with our response, or you remain concerned about how we have handled your personal information, you can complain to the Information Commissioner’s Office (ICO).
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113
19. Version Control
Version 2.1 – July 2026
Updates include:
- Updated the Notice to reflect changes to UK data protection law following the Data (Use and Access) Act 2025.
- Expanded the section on individual rights, including restriction of processing and updated subject access request wording.
- Added updated information about data protection complaints and complaint handling.
- Strengthened information about the processing of children’s personal data and children’s access to online services.
- Updated CCTV information and aligned it with the separate CCTV and Audio Surveillance Policy.
- Updated the list of third-party service providers and clarified that providers may act as processors or independent controllers depending on the circumstances.
- Updated international transfer wording.
- Updated the cookies and tracking technologies section and removed services that are no longer in use.
- Made minor corrections and clarifications throughout the Notice.
Version 2.0 – Effective 20 October 2025
Major updates:
- Added a plain-English At-a-Glance summary (child-friendly layer) and unified scope (students, parents/guardians, teachers/contractors, applicants).
- Introduced a lawful-basis table mapping purposes → example data → legal basis → retention (ICO transparency best practice).
- Clarified children’s data handling, parental registrations, and media consent rules.
- Expanded CCTV and call-recording transparency (purposes, legal bases, retention) and confirmed DPIAs in place.
- Clarified international transfers (Canada adequacy; SCCs/UK IDTA where required) and listed key processors (MyMusicStaff, Stripe, Google, QuickBooks, Zappie, WordPress/MMF, WhatsApp).
- Strengthened data-security summary (encryption, 2FA, RBAC, secure deletion) and tightened retention table.
- Updated PECR-compliant marketing consent/opt-out wording and cookie transparency (separate Cookie Policy link).
- Standardised contact details (benanamusicstudio@gmail.com) and controller address.
20. Contact Us
Benana Music Studios Ltd
Email: benanamusicstudio@gmail.com | Tel: 07728 836428
33 Queens Terrace, Southampton, England, SO14 3QB
