EYM’s Data Controller, as defined in GDPR legislation, is Jean Murray, Director of EYM.
EYM’s lawful basis for processing an individual’s personal data is three-fold.
1) Consent – the individual has given clear consent for EYM to process their, or their child’s, personal data for a specific purpose.
2) Contract – the processing is necessary for a contract EYM has with the individual, or because they have asked EYM to take specific steps before entering into a contract.
3) Legitimate Interest – the individual or their child has attended EYM classes or one-off events such as Come & Sing Days and is likely to be interested in being informed about further EYM events.
Staff & Assistants
Contact details of staff and assistants are stored securely by EYM both on a desktop computer & on paper.
Contact details of former staff and assistants are also kept in a similar way, in order to enable EYM to offer more work in the future & to keep former staff and assistants informed of EYM events. Former staff and assistants can ask to have these details removed at any time.
EYM holds this information solely for the administration of its activities.
Copies of any references EYM is asked to provide for staff & assistants are kept securely.
Children & Parents
Names, addresses, phone numbers, email addresses, children’s dates of birth & classes attended are stored securely by EYM both on a desktop computer & on a card index.
Similar details of potential pupils are kept securely on waiting lists.
EYM holds this information both for the administration of its activities and in order to try to ensure the safety of the children & to be able to contact parents in an emergency.
Contact details are only shared with EYM staff members or trustees as necessary in order to try to ensure the safety of children, for the administration of EYM activities or, with the consent of parents, in order to enable staff and parents to have direct communication about individual pupils.
No details are shared with third parties without permission from parents.
Similar details of past EYM members and those who have attended one-off events such as Come & Sing Days, are kept securely in order to be able to inform them about special events. These details can be removed at any time on request.
Parents are asked when their child joins EYM, & annually thereafter, to sign a form either giving or withholding consent for EYM to keep their contact details & their child’s name and date of birth until they ask for them to be deleted & for their child to be included in any publicity photos taken at EYM.
Hard copies of any personal information no longer needed is shredded.
EYM’s website contains a Contact Form. Messages sent using this form are sent in the same way as standard emails and do not entail the retention of any extra data.
This policy was last reviewed in July 2020.