Privacy Policy

London Sound Academy Limited
Last Updated: 26 September, 2026

—

1. Who We Are

Owner and Data Controller
London Sound Academy Limited, 209 Arlington Building Bow Quarter, 60 Fairfield Road, London, E3 2UB

Data Protection Officer: Buster Bennett, Director

Owner contact email: [email protected]

London Sound Academy is registered with the Information Commissioner's Office (ICO) as a fee payer.

This policy explains how we collect, use, store and protect your personal data, and your rights under the UK GDPR.

—

2. The Legal Framework

Lawful Bases for Processing

We rely on the following lawful bases under UK GDPR:

Contract — to provide our services, process enrolments and payments, issue certificates, and deliver our educational services. This covers student administration, course delivery, progress tracking, and certification.

Legitimate Interests — for the following specific purposes:

• Analytics: understanding how our website is used so we can improve it and make sure it works well for prospective and current students.
• Marketing to existing students: keeping current and former students informed about relevant courses, workshops, events and opportunities that align with their musical interests and training.
• Fraud prevention and security: protecting our business, our students, and our payment systems from fraudulent activity.
• Improving our services: using feedback and usage patterns to develop better course materials, teaching methods, and student support.
• Staff training and quality assurance: reviewing voicemail recordings to ensure our phone support is helpful and professional.

Where we rely on legitimate interests, we have carried out a Legitimate Interests Assessment to balance our interests against your rights.

Consent — for photography and video recording, and newsletter sign-ups from non-students. You can withdraw consent at any time.

Legal Obligation — to comply with tax, accounting, and other statutory record-keeping requirements (for example, HMRC requirements).

International Transfers

Some of our service providers are based outside the UK, including in the United States. Where we transfer personal data outside the UK, we ensure appropriate safeguards are in place, such as the UK Extension to the EU-US Data Privacy Framework or Standard Contractual Clauses approved by the ICO.

Data Retention

We keep personal data only for as long as necessary for the purposes for which it was collected. UK GDPR does not set fixed retention periods; instead, we determine the appropriate period for each category of data by considering:

• Legal obligations — HMRC requires us to keep financial and payment records for a minimum of six years from the end of the relevant accounting period.
• Contractual necessity — as a music school, students may return years after their initial lessons. We therefore retain student records (including progress notes, attendance, and course history) for a default period of six years from the end of your time as an active student.
• Consent — where processing is based on consent (such as photography or newsletter sign-ups), we keep the data until consent is withdrawn or it is no longer needed.
• Legitimate interests — for analytics, marketing, and security, we keep data only for as long as needed to fulfil those purposes. Analytics and advertising data is typically retained for up to 26 months in line with our providers' default settings, after which it is deleted or anonymised.

Student data is retained for six years from the end of your time as a student, unless you ask us to delete it sooner. You can opt out of our holding your data at any time by contacting [email protected], and we will delete or anonymise it unless we are required to keep it for a legal obligation (for example, financial records held for HMRC).

When a retention period ends, we securely delete or anonymise the data. We do not keep personal data indefinitely "just in case" it might be useful in future.

Children's Data

If you are under 18, we require consent from a parent or guardian before taking photographs or video recordings. We do not knowingly collect data from children under 13 without parental consent.

Data Breaches

In the unlikely event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware of it. If the breach is likely to result in a high risk to you, we will also inform you directly without undue delay.

Automated Decision-Making

We do not make solely automated decisions that have legal or similarly significant effects on you.

—

3. How We Process Personal Data

4. Your Rights and Choices

Your Rights

Under UK GDPR, you have the following rights:

• Right of access — you can request a copy of the personal data we hold about you.
• Right to rectification — you can ask us to correct inaccurate or incomplete data.
• Right to erasure — you can ask us to delete your data where there is no compelling reason for us to keep it.
• Right to restriction — you can ask us to limit how we use your data.
• Right to object — you can object to processing based on legitimate interests or for direct marketing.
• Right to data portability — you can request your data in a structured, commonly used format.
• Right to withdraw consent — where we rely on consent, you can withdraw it at any time.

To exercise any of these rights, contact us at [email protected]. We will respond within one month.

Opting Out of Interest-Based Advertising

In addition to any opt-out feature provided by any of the services listed in this document, Users may learn more about how to generally opt out of interest-based advertising within the dedicated section of the Cookie Policy.

Right to Complain

You have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you are unhappy with how we have handled your personal data.

ICO contact details:
Website: ico.org.uk
Helpline: 0303 123 1113

—

5. Contact Information

Owner and Data Controller
London Sound Academy Limited, 209 Arlington Building Bow Quarter, 60 Fairfield Road, London, E3 2UB

Data Protection Officer: Buster Bennett

Owner contact email: [email protected]

Last Updated: 26 September, 2026

‍