Privacy Policy

LMFL Limited is the data controller for the information described here. We are registered in England and Wales (company number 14022691) at 25 Badminton Road, Downend, Bristol BS16 6BB, United Kingdom.

When you contact us or ask for the brochure: your name, email address, your message, and (for the brochure) the student's main instrument and age group, and whether you'd like just the brochure or the brochure plus news about our courses.

When you sign up for our emails: your name and email address, and how you signed up.

When you book a place, we ask for: • The student: name, date of birth, gender, nationality, email and phone (if they have them). • Parent or guardian (for students under 18): name, relationship to the student, email, phone and home address. • An emergency contact for the course. • Course details: package, instrument or voice, level and experience, teacher preference, modules, add-ons, airport transfers and instrument rental. • Health and welfare: medical conditions and medication, dietary requirements, and any learning or access needs. This is "special category" information, and we take extra care with it (see section 4). • Photo consent: whether we may use photos and videos of the student. • Other: whether the student has attended before, how you heard about us, and interest in a scholarship.

During the course: attendance, welfare and safeguarding notes where needed, and photos and videos of concerts and course life (only for students whose families have agreed).

When you visit our website: basic, anonymous statistics about visits (such as pages viewed and the type of device). See section 11.

• To answer your questions, and to email you the brochure when you ask for it. • If you tick "The brochure, plus news about our courses and how to book", to send you two short follow-up emails about the course (a typical day, and how to book) and our newsletter. If you tick "Just the brochure, please", we send you the brochure only. Every email has an unsubscribe link. • To send our newsletter, only if you've signed up for it (in the website footer, or by ticking the news box on the brochure form). • To process your booking, plan the course (timetables, tutors, rooms, meals, transfers) and take payment. • To look after students' health, safety and welfare during the course, and contact families in an emergency. • To share photos and videos of the course on our website, brochure, emails and social media, only if the family has agreed. • To keep proper financial and business records, and to improve our courses and website.

We don't sell your information, and we don't use it for automated decision-making.

• Contract: to deal with your booking and run the course. • Consent: for our newsletter and the brochure follow-up emails (which you choose by ticking the box on the form), and for photos and videos. You can withdraw consent at any time, for example by clicking "unsubscribe" in any email. • Legitimate interests: to answer enquiries and send the brochure you asked for, and to keep business records and improve our services. • Legal obligation: for accounting, tax and safeguarding duties. • Health information: we use it only to keep students safe and well, based on the explicit consent of the parent or guardian (or the adult student), or where needed to protect someone's vital interests in an emergency. It is seen only by the staff who need it to care for the student.

Our courses welcome students from age five, so we do hold information about children. For students under 18, bookings must be made by a parent or guardian, who gives the information and makes the choices about photos and emails on the student's behalf. We send marketing emails to adults only: to parents and guardians, or to adult students.

We only share what is needed, with: • Our tutors and course staff, who see what they need to teach and look after students (for example, a student's timetable, or dietary and medical information for those caring for them). • Giggleswick School, our venue, where needed for accommodation, meals, and health and safety. • Emergency services or medical staff, if a student needs help. • Service providers who run our systems for us, under contracts that require them to keep it safe and use it only on our instructions: Framer (our website), Tally (our booking and contact forms), Airtable (our booking records), MailerLite (our emails and mailing list), Make (which passes your details from our forms to our mailing list if you agree to emails), and our email and file storage providers. • Authorities, if the law requires it (for example HMRC or for safeguarding).

After you book, we email you an invoice. Payment is by bank transfer only, using the details on that invoice.

Some of our providers store information outside the UK, for example in the European Union or the United States. When they do, we make sure it is protected by safeguards recognised under UK law, such as UK adequacy regulations (including the UK–US "data bridge") or the UK's approved data transfer agreements.

• Enquiries and brochure requests: 2 years from your last contact. • Mailing list: until you unsubscribe. • Booking and payment records: 6 years after the course (for tax and accounting). • Health, dietary, access and emergency details: deleted 6 months after the course ends, unless needed for an incident or safeguarding matter. • Safeguarding records: as long as required by safeguarding guidance. • Photos and videos: as long as we use them; you can ask us to stop using new ones at any time.

Only people who need information can see it. We use secure, reputable providers, a password manager and two-step login on our accounts. No system is perfectly secure, but we take care and will tell you and the ICO if a serious breach happens, as the law requires.

Our website is hosted by Framer, which records basic, anonymous visit statistics to help us understand how the site is used. Some pages also use these third-party services: • Google Fonts: to display the fonts on our pages. • YouTube: video thumbnails, and privacy-enhanced video embeds that load only when you press play. • Google Maps: only if you choose to load or open the map. • Tally: the booking and contact forms embedded on our site.

These services may set their own cookies when you use them. You can block or delete cookies in your browser settings.

Under UK data protection law you can ask us to: • give you a copy of the information we hold about you; • correct anything that's wrong; • delete your information, or limit how we use it; • stop using it for marketing (or simply click "unsubscribe" in any email); • transfer it to you or another organisation.

You can also object to how we use it, or withdraw your consent at any time. Parents and guardians can make these requests for their children. Email info@lmfl.org; we'll reply within one month. There's no charge.

If you're unhappy with how we've handled your information, please tell us first.

How to complain to us: email info@lmfl.org with "Data complaint" in the subject. We'll acknowledge your complaint within 30 days and tell you the outcome. You can also complain to the ICO.

Information Commissioner's Office (ICO): ico.org.uk, 0303 123 1113.

We'll update this policy when the way we use information changes, and change the date at the top. If a change is significant, we'll let you know.

LMFL Limited, 25 Badminton Road, Downend, Bristol BS16 6BB, United Kingdom

Email: info@lmfl.org