[School name] privacy notice for customers
Version: [x.x] · Reviewed: [month year]
1. Introduction
[School name] is committed to protecting your and your child's personal information. This notice explains how we collect, use, store and protect it. We comply with the UK GDPR and are registered with the Information Commissioner's Office (ICO registration number: [number]).
Data controller: [legal name], [address].
2. What information we collect
- Your name, email address and phone number
- Your child's name, date of birth and gender
- Medical or special educational needs relevant to swimming tuition
- Lesson attendance and progress records
- Disciplinary records or complaints raised by or involving you
- If you hire the pool: the Group Leader's details and booking history
3. Medical and SEN information
Medical, health, disability or special educational needs information may be special category data. We process it only where needed to give safe and suitable tuition, manage health and safety, and make reasonable adjustments. Alongside our Article 6 lawful basis, we rely on an Article 9 condition, which may include explicit consent or another condition relevant to swimmers' health, safety and welfare.
4. How we use your information
To manage bookings, keep swimmers safe, track progress and send updates and feedback. We may contact people on our waiting list about lesson spaces or holiday lessons they have asked about.
5. Lawful basis
- Contract, Article 6(1)(b): providing lessons, managing bookings and accounts, and talking to you about lessons.
- Legitimate interests, Article 6(1)(f): running the school safely and effectively, including attendance, progress, waiting lists, enquiries, safety procedures and complaints. We rely on this only where our interests are not overridden by yours or your child's.
- Legal obligation, Article 6(1)(c): legal, tax, accounting, health and safety, safeguarding and insurance duties.
- Consent, Article 6(1)(a): optional purposes such as photographs or videos. You can withdraw consent at any time.
6. Who we share information with
We share personal information only with trusted providers who process it for us under written contracts:
| Provider | Purpose |
|---|---|
| [Booking system, e.g. ClassBase] | Registration, bookings and lessons |
| [Email provider] | Service emails and waiting list updates |
| [SMS provider, if used] | Text message reminders |
| [Direct Debit provider] | Collecting lesson fees |
| [Card payment provider] | Immediate payments, e.g. private hire |
We may also share information where the law requires it, or with emergency services or safeguarding agencies where needed to protect someone's safety.
7. Transfers outside the UK
Some of our providers, or their suppliers, may store or access data outside the UK. Where this happens, the transfer is protected by UK adequacy regulations, the UK International Data Transfer Agreement or Addendum, or the UK Extension to the EU-US Data Privacy Framework.
8. Security and retention
We store information securely using password-protected systems. We keep personal data for up to [six] years unless the law requires longer.
9. Your rights
You can access your data, ask for corrections or deletion, withdraw consent, object to or restrict processing, and complain to the ICO.
Contact [email] for any data request.
10. Changes to this notice
We may update this notice. Changes will be posted on our website and, where appropriate, emailed to you.
Optional sections (delete if they don't apply)
CCTV
We use CCTV in public areas of the pool building for safety and security. It is not actively monitored. Recordings are kept for [30] days unless needed to investigate an incident. Our lawful basis is legitimate interests, Article 6(1)(f).
Accident and incident records
We record accidents, incidents and first aid given, which may include health information. We keep these for [3] years, or for a child until they reach [21], in case of a later claim.