Return to Derby Piano Academy · Website privacy

Privacy and cookie notice

Last updated: 12 October 2026.

Who is responsible

Edward Rudak, a sole trader trading as Derby Piano Academy, is the data controller. Business correspondence address: 183 Nottingham Road, Spondon, Derby, DE21 7GZ, United Kingdom. For privacy questions or requests, email [email protected] or call 01332 480619.

Enquiries, bookings and tuition

We use contact details and information you provide to answer enquiries, arrange and deliver lessons and administer payments. Student records may include name, age (not full date of birth), parent or guardian contact details, booking arrangements, attendance, teaching notes, musical progress, charges and payment status. For students under 18, lesson arrangements and administration are communicated with parents or guardians.

New exclusively online students are not routinely asked for a full home address. An address may be requested for a specific letter or face-to-face arrangement, with the purpose explained. Existing addresses are reviewed for necessity.

For adults and parents or guardians booking lessons, necessary enquiry and booking information is used to take steps at your request before an agreement and to perform that agreement. Necessary ordinary records about children support our legitimate interests in delivering and administering requested tuition, taking their rights and interests into account. Financial records are also retained to meet legal obligations. If essential booking details are not supplied, we may be unable to arrange lessons.

Health and additional learning needs

Sharing a health condition, disability or additional learning need is voluntary. We do not routinely request diagnoses or medical documents. Such information may be received in correspondence or retained in teaching records. The handling of existing records is being reviewed; this notice does not establish that consent was obtained for earlier records.

We ask for explicit consent before using optional health information to plan or adapt tuition, and ask separately before retaining a health-related note. The lawful basis for these optional purposes is consent and, for special-category information, explicit consent. For a child, we establish who is entitled to give permission. A minimal permission record documents who agreed, when, the purpose and what information was given, without routinely recording a diagnosis. Consent can be withdrawn by contacting Ed, and we then stop relying on it for future use. Permission records are reviewed when consent is withdrawn or lessons end.

Services and sharing

We use the following services for these purposes:

We do not send newsletters or unsolicited marketing messages. We may disclose information where required by law.

Website information and cookies

This static website has no enquiry form or student database. Fonts and images are served from the website. Hosting involves technical information, such as IP addresses and request details, needed to deliver and protect the site; our basis is legitimate interests in operating a secure, reliable website.

Google Analytics and Cloudflare Web Analytics are disabled on DPA V2. This version does not load the Google Analytics tag or use optional analytics or advertising cookies. No analytics consent choice is needed. On loading, it attempts to clear accessible GA cookies and old analytics preferences left by earlier testing; this does not erase data already sent to Google.

Links to WhatsApp and other external services take you to services with their own privacy practices. If optional analytics is introduced later, this notice and the website controls will be updated before it runs.

Keeping information

Unsuccessful enquiry information is deleted when a decision not to proceed is clear. When a student permanently leaves, ordinary teaching records and associated correspondence are deleted from Notion, WhatsApp and Proton Mail. Necessary financial information is retained for legal and accounting purposes. The usual minimum for self-employed tax records is five years after the 31 January submission deadline for the relevant tax year; specific circumstances can require longer retention. See HMRC guidance.

Provider copies and backups may follow different retention schedules; deletion from our records does not instantly erase independent provider records. Hosting and security information is retained by Cloudflare according to its service practices and legal requirements, rather than a fixed period controlled by Ed.

International processing

Some providers process information outside the UK. Their roles and safeguards vary by service and account. Google Meet uses a personal account; this notice does not assume Google Workspace terms apply. Cloudflare’s Data Processing Addendum includes UK transfer provisions. Google publishes its international transfer frameworks. You can contact Ed for information about safeguards relevant to your information.

Notion publishes a data-processing addendum for customer data. WhatsApp Business publishes a UK transfer addendum for relevant processor transfers; its application depends on the contracting entity and processing concerned. Proton Mail states that encrypted server data is stored in Switzerland, Germany or Norway. OpenAI’s UK privacy information describes overseas processing and transfer safeguards, including standard contractual clauses and the UK addendum. A personal ChatGPT account does not establish the contractual protections of a business service.

Provider information: Notion, WhatsApp Business App and WhatsApp UK, Proton Mail, Google, Mettle, OpenAI and Cloudflare. These notices describe their own processing.

Your rights

Depending on the circumstances, you have rights of access, correction, erasure, restriction, portability and objection. Where we rely on consent, you can withdraw it without affecting the lawfulness of earlier processing. Contact Ed using the details above. No particular form or legal wording is needed. We may request proportionate information to establish identity or authority and normally respond within one calendar month, explaining any lawful extension or refusal.

You can complain to the Information Commissioner’s Office. Booking and teaching decisions are made by Ed; we do not use solely automated decisions with legal or similarly significant effects.

Updates

We update this notice when relevant practices change. The privacy information for DPA V2 does not describe the separate existing WordPress website before migration.