Return to Derby Piano Academy · Manage privacy preferences

Draft UK privacy and cookie notice

DRAFT — prepared 8 October 2026. Business details and verbal permission wording were confirmed on 8 October 2026; record-keeping practice was clarified on 9 October 2026 and remains under review. Provider, transfer, analytics-property and lawful-basis checks remain outstanding. This is not a final approved privacy notice.

Who is responsible and how to contact us

Edward Rudak is a sole trader trading as Derby Piano Academy and is the data controller. Business correspondence address: 183 Nottingham Road, Spondon, Derby, DE21 7GZ, United Kingdom. Privacy enquiries: edrudak@proton.me or 01332 480619. Business website: pianolessonsderby.co.uk.

Information used for enquiries and tuition

For enrolled students, including those taught exclusively online, we use the student's name and age (not full date of birth), relevant parent or guardian contact details, telephone and email, booking arrangements, attendance, teaching notes, musical progress, lesson charges, payment dates and payment status. We may also use a home address including postcode where required for a specific purpose, as explained below. For students under 18, lesson arrangements and administration are communicated with parents or guardians.

From 8 October 2026, new exclusively online students are not routinely asked for a full home address. We request an address when a specific lesson-related letter or face-to-face arrangement requires it, explaining the purpose at that time. Addresses already held for existing students, and address collection for other lesson arrangements, are being reviewed for necessity and retention. This change does not mean existing address records have already been deleted.

We use this information to respond to enquiries, arrange and deliver tuition, maintain necessary teaching records and administer payments. For adult students and parents or guardians who book lessons, we rely on taking necessary steps at their request before an agreement and performing that agreement. Parents or guardians book and pay for under-18 lessons. We rely on legitimate interests in delivering and administering the requested tuition for necessary ordinary records about a child, with particular regard to the child’s rights and interests. This does not include optional health information. Necessary financial records are kept to meet legal obligations. Optional website analytics relies on consent.

We do not routinely photograph students or record audio or video of lessons, including Google Meet lessons. We do not send newsletters, marketing emails or unsolicited promotional messages.

Health, disability and additional learning needs

An adult student or parent or guardian may voluntarily disclose a health condition, disability or additional learning need relevant to tuition. We do not routinely request diagnoses or medical documents. Health or learning-needs information may nevertheless be volunteered by a student or parent in email correspondence, and a condition has been noted in a private Notion student record. The handling and retention of this information are under review.

From 9 October 2026, the agreed procedure is to ask for clear permission before relying on explicit consent to use special-category information to plan, adjust or deliver tuition. Permission to retain a health-related note is asked for separately. Disclosure is voluntary and consent can be withdrawn. This draft does not claim that permission was obtained for existing records. For an adult, permission should be sought from the student; for a child, who is legally able to give permission must be established.

“Thank you for explaining that. Are you happy for me to take this into account when planning and adapting the piano lessons? I won't make a medical record of it. You can change your mind and withdraw that permission at any time.”

Ed may remember information discussed to help adapt tuition. Some disclosures are also held electronically in email correspondence and Notion. A minimal permission-record procedure was agreed on 9 October 2026 for future use; this does not establish that permission was obtained for earlier records. Volunteering health information does not, by itself, demonstrate explicit permission for Ed to retain it or use it for a specific purpose.

Agreed procedure for future use: where explicit consent is relied upon for processing within the scope of UK data protection law, keep only enough restricted-access evidence to demonstrate who gave permission, when, the specific purpose, the affirmative response, the version of the permission wording and information given, and any later withdrawal. For a child, establish and document who is entitled to give permission. Permission evidence records what was agreed without routinely including diagnoses or a medical history. Existing notes are reviewed separately. Minimal permission evidence will be kept in Edward's private Notion student record. We keep the minimal permission record while relying on the permission, review it when permission is withdrawn or lessons end, and delete it when it is no longer needed unless a specific legal reason requires keeping it longer.

Confirm before publication: distinguish information disclosed solely in an unrecorded conversation from information received or retained electronically, included in teaching notes, or held in a filing system. For the agreed optional health-information purposes, the chosen basis is consent under Article 6(1)(a) and, where the information is special-category data, explicit consent under Article 9(2)(a). Permission must be specific, informed, freely given and demonstrable; agreement to this policy is not individual consent. If permission is withdrawn, stop relying on that consent for future processing; do not assume that another basis can simply be substituted. The agreed verbal wording above is retained, but this draft does not certify the current practice as legally sufficient.

Services used

Website hosting and optional analytics

Cloudflare Pages hosts the public review version of this static website at dpa-v2-staging.pages.dev. The staging project was deployed with Edward’s approval on 9 October 2026. It has no custom domain, enquiry form, student database or Pages Functions. The existing business website remains separate from this staging site. Hosting may involve IP addresses, request times, requested pages and browser information for delivery and security. Confirm before publication: Cloudflare’s account-specific agreements, logging and retention arrangements, provider roles and transfer safeguards. No fixed hosting-log retention period has been verified.

Google Analytics 4, measurement ID G-F6RESW4SD9, is implemented in this staging version behind explicit opt-in. It is not approved for unrestricted operation. This implementation loads no Google Analytics script or analytics request before consent. Rejecting analytics leaves it off. Fonts and photographs are served from this website; there are no enquiry forms, advertising pixels or embedded videos.

Cookies, local storage and your choices

The website uses first-party browser local storage under the key dpa.analytics-consent solely to remember your analytics preference. The record contains an accepted/rejected choice, the preference version and the date saved. It has a 180-day validity period and is not sent to a tracking provider. The stored record may remain in browser storage after that period, but the website treats it as expired and asks again. You can also clear it in your browser settings. A separate essential session-storage entry, dpa.analytics-consent.rejected, safeguards rejection in the current tab and lasts for the browser tab session. It is not sent to a tracking provider.

Optional analytics is rejected by default. Accept analytics enables Google Analytics 4 to measure page visits and website use. Google receives technical information, including your IP address in the connection, browser/device information and page activity. The implementation removes query strings and fragments from the page address sent in its initial configuration and disables Google signals and advertising personalisation. Reject analytics leaves the whole website available. There are no marketing or advertising technologies installed.

Use the footer Privacy control on any page to change or withdraw your choice. Choose Reject analytics, or untick Allow optional analytics and save. If your browser blocks storage, your choice applies only to the current page.

After consent, GA4 may set _ga and _ga_F6RESW4SD9 first-party cookies. This implementation requests a 180-day cookie lifetime without automatic renewal. Withdrawing consent disables measurement, clears accessible GA cookies for this website and reloads the page to remove the tracker. Previously sent data is not erased by withdrawal. Google may process information outside the UK.

Confirm before launch: behaviour on the eventual deployment domain and direct Google script delivery; advanced enhanced-measurement options; account-specific Google contractual arrangements and transfer safeguards; and whether any other product integrations apply. The screenshot-confirmed settings are recorded below. Review these disclosures again before publication. A new preference version must be used if the purpose or material details change.

Local verification, 9 October 2026: in an isolated Chrome test, the actual Google script produced both GA cookies with approximately 180-day expiry only after acceptance. Withdrawal cleared these cookies, and a rejected reload made no further Analytics requests. Measurement submissions were blocked throughout. The script was fetched separately and supplied to the browser because direct browser loading was blocked in the test environment. This does not verify a deployed website.

Analytics settings reviewed for this draft

The existing Derby Piano Academy Analytics account was reviewed through screenshots supplied on 8 October 2026. Its website stream uses measurement ID G-F6RESW4SD9. Event data retention is set to 2 months and user data retention to 14 months, with reset on new user activity enabled. These settings do not limit most aggregated standard reports. The retention periods are separate from the browser cookie and consent-preference lifetimes described above.

Google signals is off. Enhanced measurement is enabled for page views, scrolls, outbound clicks, site search, form interactions, video engagement and file downloads; an enabled category does not mean the website contains that feature or that an event has occurred. Email redaction is active; URL query parameter redaction is inactive. Advanced page-view and site-search options have not been inspected.

At account level, sharing for Google products and services, technical support and business recommendations is off. Modelling contributions and business insights is on, for aggregated and de-identified measurement data. No Google Ads accounts or pending link requests were shown. Ads personalisation is allowed at property level in all 307 regions, although this V2 implementation denies advertising consent and disables signals and advertising personalisation in its tag configuration. User-provided data collection appeared not yet configured; the screenshots do not establish whether the existing live site sends User IDs.

The account shows that Google's Data Processing Terms were accepted on 22 July 2025. This confirms the displayed acceptance status, not the completeness of organisation/contact details or the safeguards applicable to every transfer. No Analytics settings were changed during this review. The new website is publicly available on its separate pages.dev staging address; the existing business website has not been replaced. Actual Google-script cookies and withdrawal were tested locally on 9 October 2026 as described above; direct browser script delivery and the eventual deployment domain remain unverified.

Sharing, retention and security

Unsuccessful enquiry information and correspondence are deleted promptly once a decision not to proceed is clear. When a student permanently leaves, ordinary teaching records are deleted from Notion and associated correspondence is deleted from WhatsApp and Proton Mail. Necessary financial and accounting information is retained after departure. For self-employed tax records, the normal HMRC minimum is at least five years after the 31 January submission deadline for the relevant tax year; a different rule may apply to very late returns or other specific circumstances. See HMRC record retention guidance. This does not mean that independent third-party copies or backups are erased instantly.

We use the services identified above for the stated purposes. Confirm before publication: each provider's controller/processor role, contractual privacy terms, international processing and transfer safeguards, backup/deletion arrangements, security practices, and whether any exception to the normal financial retention rule applies. Do not assume all data remains in the UK.

Provider privacy information: Notion, WhatsApp UK, Proton Mail, Google, Mettle and Cloudflare. These explain each provider's own practices; they do not replace confirmation of the terms, account settings and transfer safeguards applicable to Derby Piano Academy.

Processing outside the UK

Some service providers process information outside the UK. Notion describes itself as a processor for personal data uploaded at a customer’s direction, and publishes a Data Processing Addendum covering EU and UK transfer safeguards. Proton Mail states that encrypted server data is stored in Switzerland, Germany or Norway. WhatsApp’s UK policy describes global infrastructure, including Singapore and the United States, and UK contractual transfer mechanisms. WhatsApp Business also has processing terms and a UK transfer addendum whose application depends on the processing concerned. That UK addendum applies to relevant controller-to-processor transfers where WhatsApp LLC is the contracting entity; it does not establish that all WhatsApp processing has the same role.

Google publishes international transfer frameworks, including the UK Extension to the EU–US Data Privacy Framework. Google Meet here uses a personal account; this notice does not assume Google Workspace contractual protections apply. Google describes processing content and technical information to provide Meet and maintain performance and security. Not recording a lesson does not mean no information is processed.

For the Mettle bank account, National Westminster Bank plc acts as a controller for its banking processing. Its privacy notice describes overseas transfers using adequacy or other permitted safeguards. Cloudflare publishes a Data Processing Addendum with UK transfer provisions; Cloudflare Pages hosts the separate V2 staging website. Cloudflare identifies itself as a processor for customer logs and content passing through its services, and as a controller for other processing described in its privacy policy. The inspected staging project has no connected Git repository, resource bindings, environment variables or secrets. No additional Cloudflare analytics integration was added. Cloudflare’s underlying hosting and security logging and retention arrangements remain to be verified.

These are provider-published statements, not a completed assessment of Derby Piano Academy’s accounts. Confirm before publication: the agreements and safeguards applicable to each service, relevant subprocessors and processing locations, any required transfer assessment, and the actual hosting configuration. Contact Ed to request further information about applicable safeguards.

Your rights and complaints

Depending on the circumstances and lawful basis, UK data protection rights include access, correction, erasure, restriction, portability and objection. Where processing relies on consent, you can withdraw it; this does not affect the lawfulness of earlier processing. Edward Rudak personally handles privacy requests and concerns. Email edrudak@proton.me or telephone 01332 480619. A request does not need to use a particular form or legal wording. We may ask for proportionate information to establish identity or authority where needed. We respond within the applicable statutory time limit, normally one calendar month, and explain any lawful extension or refusal. These rights are subject to applicable conditions and exceptions.

You can raise concerns with the Information Commissioner's Office. Teaching and booking decisions are made by Edward; there is no solely automated scoring or decision-making with legal or similarly significant effects. We need sufficient contact and booking information to arrange tuition and explain any particular information needed for the arrangement. If essential details are not provided, we may be unable to arrange the requested lessons. Health information and website analytics are optional; refusing analytics does not affect lessons or website access.

Approval and updates

The business details and verbal permission wording above have been confirmed. The future permission and minimal record-keeping approach was adopted on 9 October 2026; existing records and the remaining implementation details still need review. Before publication, complete the remaining lawful-basis, provider, international-transfer, hosting and analytics-property checks. GA4 is implemented on staging behind explicit opt-in. Edward approved public staging on 9 October 2026. This notice remains a draft for review; staging publication does not constitute approval of a final notice or migration of the live business website.