Privacy Policy

1. Who we are

Kidstrument is operated by Kidstrument Music Tuition Limited, a company registered in England and Wales under company number 10551429. Our registered office is:

For the public website, sales, account administration and our direct communications, we are usually the data controller. You can contact us at help@kidstrument.co.uk or on 0330 520 1638.

2. Scope and data protection roles

This policy covers the public website at www.kidstrument.co.uk, trial and contact requests, school subscriptions, authorised teacher accounts and related support.

When a school uses Kidstrument and decides why and how staff or school information is entered into the service, the school is normally the controller and Kidstrument acts as its processor. The school's own privacy information applies to that processing. Our contract or data processing terms with the school govern our processor duties.

We remain a controller for our own business administration, security, billing and legal compliance. External websites linked from our pages have their own privacy notices.

3. Personal data we collect

Depending on how you interact with us, we may handle:

• Contact and identity data: name, work email, phone number, job role, school and the contents of an enquiry or support request.
• Trial data: selected school and URN, name, work email, role, trial preferences, email-confirmation status and related timestamps.
• Account data: staff name, work email, school, access permissions and account status.
• Service data: lessons, curriculum plans, completion information, teacher notes and other material an authorised user chooses to save.
• Technical and security data: IP address, browser and device details, request logs, authentication records and information used to detect abuse.
• Billing and administration data: billing contacts, purchase order details, subscription records, invoices and payment status. We do not ask users to send card details through our contact forms.
• Optional measurement data: page visits, interactions, session information and advertising attribution collected by Hotjar or Google only after the relevant consent is given.
• Communication preferences: how and when you prefer us to contact you and any opt-in or opt-out record.

Please do not include confidential pupil information, special category data or safeguarding details in free-text teacher notes or public website forms.

4. Where personal data comes from

We receive personal data:

• directly from you when you use a form, email, phone us or use an account;
• from a school or authorised administrator that asks us to create or manage staff access;
• from public school datasets when we provide school search and matching; and
• from a browser or device when it connects to our service, including optional providers where consent has been given.

5. Why we use personal data and our lawful bases

Where we rely on legitimate interests, we consider the need for the processing, its impact on individuals and whether your rights override our interests. You may object to processing based on legitimate interests; see section 9.

6. Who we share personal data with

We share only what is reasonably necessary with:

• the school or organisation responsible for an authorised account;
• hosting, database, authentication, IT security and technical-support providers;
• email delivery and communication providers used to send confirmations or respond to requests;
• Hotjar for optional experience analytics and Google for optional advertising measurement, only where the relevant consent is active;
• accountants, insurers, professional advisers and payment or invoicing providers;
• a buyer, investor or successor if our business is reorganised, subject to appropriate confidentiality; and
• courts, regulators, law enforcement or other authorities where disclosure is legally required or necessary to protect rights and safety.

Our service providers must handle personal data under contract and may use it only for the agreed purpose. We do not sell or rent personal data.

7. International transfers

Some suppliers, including analytics and technology providers, may process information outside the United Kingdom. Where UK data protection law requires safeguards, we use an adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses, or another lawful safeguard, together with risk assessments and supplementary measures where appropriate.

Contact us if you would like more information about the safeguard used for a particular transfer.

8. How long we keep personal data

We keep data only for as long as it is needed for its purpose. Our normal approach is:

• Contact and demo enquiries: up to 24 months after the last meaningful contact.
• Unsuccessful or unconfirmed trial requests: up to 12 months; email-confirmation links expire after 48 hours.
• Account and service data: for the subscription or account lifetime, then deleted or anonymised within 90 days unless the school asks us to retain or export it, or law requires longer storage.
• Routine security and access logs: normally up to 12 months, unless needed to investigate an incident.
• Invoices, contracts and tax records: normally six years after the end of the relevant financial year or contract.
• Marketing suppression records: kept as long as needed to respect an opt-out.
• Optional browser technologies: for the periods shown in our Cookies Policy.

Backups rotate on a limited schedule. We may retain relevant records for longer where a dispute, legal hold, safeguarding concern or regulatory requirement applies.

9. Your data protection rights

Depending on the processing and lawful basis, you may have the right to:

• ask for access to your personal data and a copy of it;
• correct inaccurate or incomplete data;
• ask for erasure or restriction;
• receive certain data in a portable format;
• object to processing based on legitimate interests or for direct marketing; and
• withdraw consent at any time, without affecting earlier lawful processing.

You have an absolute right to object to direct marketing. Use the unsubscribe option in a message or email us and we will stop.

To exercise a right, email help@kidstrument.co.uk. We may need to verify your identity. We normally respond within one month, and will explain if a lawful exception or extension applies. There is normally no fee.

If Kidstrument processes data only on a school's instructions, we may direct your request to that school or help the school respond.

10. Children's data

Kidstrument is a teacher-led service for schools. We do not create pupil accounts and the public website is not intended to collect personal data directly from children. Schools and staff must not put pupil names, contact details, health information, safeguarding information or other identifiable pupil data into teacher notes or free-text fields.

If you believe a child's personal data has been submitted to us, contact us promptly so we can investigate and take appropriate action.

11. Security

We use proportionate technical and organisational measures designed to protect personal data, including access controls, encrypted connections, credential protection, logging, backups and supplier controls. Access is limited to people who need it for their role. No online service can guarantee absolute security, so users must also keep credentials confidential and report suspected compromise promptly.

12. Contact and complaints

For privacy questions, rights requests or concerns, email help@kidstrument.co.uk or write to the registered office in section 1. Please give us the opportunity to investigate and resolve your concern.

You may also complain to the UK Information Commissioner's Office (ICO). Visit ico.org.uk/make-a-complaint or call 0303 123 1113. You may complain to another competent supervisory authority if that is available where you live or work.

13. Changes to this policy

We review this policy when our services, suppliers or legal obligations change. We will publish the updated version here and change the date at the top. If a change materially affects how we use data, we will take reasonable steps to bring it to affected users' attention and seek fresh consent where required.