Purpose

 

This Privacy Notice explains how ToriArts Studios Limited collects, uses, stores and shares personal information.

​

It applies to students, parents/carers, staff, freelancers, hirers, visitors, people making enquiries, and anyone else whose information is handled by ToriArts.

 

Who we are.

 

ToriArts Studios Limited is a performing arts studio providing activities including dance, singing, drama, musical theatre, aerial arts, studio hire and related services.

​

For data protection purposes, ToriArts Studios Limited is responsible for deciding how personal information is used.

​

Data protection contact: Directors of ToriArts Studios Limited.

​

Contact: Please use the main ToriArts Studios Limited business contact details published on our website or booking information.

​

What personal information do we collect?

 

We only collect information that is needed for a clear business, safety, safeguarding, legal, insurance or service-related purpose.

​

This may include:

​

• student names, dates of birth, parent/carer details and emergency contact details;

• booking, attendance, class, course, studio hire and payment records;

• PAR-Q, medical, access, allergy, injury or support information needed for safety;

• accident, incident, first aid, safeguarding, low-level concern and witness records;

• staff, freelancer, instructor, DBS, suitability, training, qualification and onboarding records;

• studio hire enquiries, approvals, insurance evidence, risk information, and hire records;

• communications sent to or received from ToriArts, including emails, forms and messages;

• CCTV and/or audio recordings where systems are in operation for safety, safeguarding and security;

• website, enquiry and administration information needed to run the business.

​

Why do we use personal information?

 

ToriArts uses personal information to:

​

• provide classes, bookings, studio hire and related services;

• manage registrations, payments, refunds, invoices and business records;

• communicate with students, parents/carers, staff, freelancers, hirers and visitors;

• keep children, young people, adults, staff, freelancers, hirers and visitors safe;

• manage health, safety, first aid, emergency, safeguarding and welfare matters;

• Check staff, freelancer, instructor and hirer suitability where relevant;

• meet legal, safeguarding, health and safety, accounting, insurance and regulatory duties;

• respond to concerns, complaints, incidents, accidents, claims, requests or disputes;

• protect the premises, equipment, business, staff, students, hirers and visitors.

 

Our lawful basis for using information

 

ToriArts uses personal information only where there is a lawful reason to do so.

 

Depending on the circumstances, this may include:

​

• Contract or steps before a contract — for example, to provide classes, bookings, studio hire or related services.

• Legal obligation — for example, safeguarding, health and safety, accounting, record keeping or employment-related duties.

• Legitimate interests — for example, running the studio safely, managing bookings, protecting the premises, handling enquiries and keeping appropriate business records.

• Vital interests — for example, using or sharing information in an emergency to protect someone’s life or safety.

• Consent — where consent is specifically required.

 

Where we process health, medical, safeguarding, DBS or other more sensitive information, we only do this where necessary and lawful. This may include safety, safeguarding, legal obligations, insurance, claims handling, employment or suitability checks, or explicit consent where required.

​

whom we may share information with

 

We do not sell personal information.

​

We may share information where necessary and appropriate with:

​

• ToriArts directors, staff, instructors, freelancers or authorised administrators who need the information to do their role;

• parents/carers, where appropriate and lawful;

• emergency services, medical professionals, local authority safeguarding teams, LADO, police, regulators or other agencies where required or appropriate;

• insurers, brokers, legal advisers, accountants, professional advisers or claims handlers;

• booking, payment, email, form, cloud storage, website and business software providers used by ToriArts;

• hirers, external providers or other third parties only where necessary, lawful and appropriate.

 

Bookings, payments and third-party systems

 

ToriArts uses trusted business systems to manage bookings, payments, records, forms, documents and communications.

​

These may include booking platforms, payment providers, Google Workspace, accounting software, email systems, website tools and other business administration services.

 

Where third-party systems are used, they are expected to process information securely and only for appropriate business purposes.

 

Some providers may process or store information outside the UK. Where this happens, ToriArts expects appropriate safeguards to be in place.

 

CCTV and audio recording

 

CCTV and/or audio recording may be used at ToriArts Studios Limited for safety, safeguarding, security, incident management and protection of the premises.

 

Signs will be displayed where CCTV and/or audio recording is in use.

​

Footage is only accessed by authorised directors unless disclosure is lawful or necessary, for example, for safeguarding, police, emergency services, insurance, legal, safety or security reasons.

​

Footage is not kept longer than necessary unless it is needed for an incident, concern, investigation, claim, safeguarding matter, legal issue or insurance purpose.

​

Safeguarding, welfare and safety information

​

Safeguarding, welfare, medical, PAR-Q, accident and incident information is handled carefully, and access is restricted.

​

Some information may need to be shared with safeguarding agencies, emergency services, insurers, legal advisers, regulators or other appropriate people where this is necessary, lawful and in the interests of safety or welfare.

​

We may not always be able to keep information confidential if someone may be at risk of harm, if there is a legal duty to share it, or if disclosure is needed for safeguarding, safety, insurance or legal reasons.

​

How long do we keep information?

 

ToriArts keeps personal information only for as long as needed for the purpose it was collected, including legal, safeguarding, insurance, accounting and business record requirements.

​

Retention periods may vary depending on the type of record.

​

General enquiries that have not progressed
 

Usually up to 12 months unless needed for a complaint, claim, safeguarding, legal or business reason.

​

Booking, attendance, payment and finance records
 

Usually up to 6 years for accounting, tax, insurance and business record purposes.

​

PAR-Q, medical, access and support information
 

Kept while relevant to participation and safety, then reviewed and removed when no longer needed unless linked to an incident, claim or safeguarding matter.

​

Accident, incident, first aid and near miss records
 

Kept long enough to meet health and safety, insurance and legal claim requirements. Child-related records may need to be kept longer.

​

Safeguarding and welfare records
 

Kept securely and for as long as required for safeguarding, legal, regulatory, insurance or best-practice reasons.

​

DBS, suitability and recruitment records
 

DBS certificate copies are not kept longer than necessary. Suitability decisions and recruitment records are kept securely in line with safer recruitment and legal requirements.

​

Studio hire records and evidence
 

Kept for business, safety, insurance, safeguarding and legal purposes, then reviewed when no longer needed.

 

CCTV/audio footage
 

Kept only as long as necessary unless needed for an incident, concern, investigation, claim, safeguarding matter, legal issue or insurance purpose.

​

Where a record is connected to a concern, complaint, incident, accident, safeguarding matter, insurance issue, legal claim or dispute, it may be kept for longer where this is necessary and lawful.

​

How we keep information secure

 

ToriArts takes practical steps to protect personal information, including restricting access to confidential records, using trusted systems, limiting access to those who need it, and keeping sensitive safeguarding, DBS, medical, incident and CCTV information controlled.

​

Staff, freelancers and authorised users are expected to handle personal information confidentially and only use it for appropriate ToriArts purposes.

​

Data breaches

 

If a personal data breach happens, ToriArts will record what happened, contain the issue where possible, assess the risk, and decide whether the Information Commissioner’s Office and/or affected individuals need to be notified.

 

Where a breach is likely to result in a risk to people’s rights and freedoms, ToriArts will report it to the Information Commissioner’s Office without undue delay and, where required, within 72 hours of becoming aware of it.

 

Affected individuals will also be told where required.

 

Your rights

 

Individuals have rights under data protection law. These may include the right to:

​

• request access to personal information held about them;

• ask for inaccurate information to be corrected;

• ask for information to be deleted in some circumstances;

• ask for the use of information to be restricted in some circumstances;

• object to certain uses of information;

• withdraw consent where consent is the lawful basis for processing;

• complain to the Information Commissioner’s Office if they are unhappy with how their information has been handled.

 

Requests should be made to ToriArts Studios Limited using the main business contact details.

​

We may need to confirm identity before responding to a request.

​

Children and parent/carer requests

 

ToriArts works with children and young people, so some information will relate to students under 18.

​

Parents/carers may usually help manage information and bookings for their child, but ToriArts will consider the child’s age, understanding, welfare, confidentiality and legal rights when handling requests about a child’s personal information.

​

Marketing and communications

 

ToriArts may contact students, parents/carers, hirers or enquirers about bookings, classes, studio hire, payments, safety information, changes, administration and related services.

​

Marketing messages will only be sent where lawful and appropriate. People can ask ToriArts to stop sending marketing communications.

​

Complaints

 

If someone is unhappy with how ToriArts has handled their personal information, they should contact ToriArts first so the concern can be reviewed.

​

They also have the right to complain to the Information Commissioner’s Office.

​

Review

 

This Privacy Notice will be reviewed at least annually or sooner if there are significant changes to ToriArts activities, systems, legal requirements, safeguarding arrangements, insurance requirements or data protection practice.