MusicAbility CIC Privacy Notice

This Privacy Notice is written to comply with the General Data Protection Regulations (GDPR), which came into force on 25 May 2018. It applies to information we (MusicAbility Community Interest Company) collect about individuals who interact with our organisation. It explains what personal information we collect and how we use it.
If you have any comments or questions about this notice, please contact us at info@musicabilitycic.uk

Who we are

MusicAbility CIC is a registered community interest company (no. 10789988) based in West Penwith, Cornwall.
Since 2017 we have delivered specialised music services in education, staff development and cultural awareness, and have also provided music psycho/therapy programmes delivered by HCPC registered therapists.
Our music education provision includes public performances and events, tuition, staff training and music service development on a national level. Our music therapy provision supports people with needs and conditions which include autism, life-limiting illness, emotional and behavioural problems, learning and physical disabilities, mental and physical health and dementia. We also offer awareness sessions for staff and parents, provide postgraduate and return-to-work placements, give regular talks and workshops to students, local groups and related professionals, provide clinical supervision and present our work at professional conferences.

What is GDPR?

The General Data Protection Regulations introduce new responsibilities, including the need to demonstrate compliance, more stringent enforcement and substantially increased penalties than the previous Data Protection Act (DPA) which it supersedes. MusicAbility is aware of its responsibilities under the GDPR Regulations and has reviewed and updated data protection practices to ensure that we meet the enhanced GDPR requirements.

Personal data that we process and how they are used

MusicAbility needs to keep a limited amount of data on individuals and is committed to keeping data safe and secure. Many of the people MusicAbility supports are children, young people and vulnerable adults and their privacy is very important to us.
MusicAbility CIC is the data controller of your personal information, and is registered with the Information Commissioner’s Office (the ICO).
The following table explains the types of data we collect and the lawful basis, under current data protection legislation, on which this data is processed.
This privacy policy relates to information we collect about:

  1. People who use our services
  2. People who support our services
  3. People who apply to work or volunteer with us
  4. People who use our website and social media accounts

This notice provides information on:

  • How we use your personal information
  • Your rights to access and correct the information we hold about you
  • How to contact us for queries or complaints about our use of your personal information, and to unsubscribe from newsletters and other communications

1a. People who use our music therapy services

We provide music therapy to people in Cornwall and occasionally across other parts of the country. In order to do this effectively, we need to collect personal information so that we can provide our music therapy service safely and appropriately. This means that under the GDPR Regulations, the legal basis for processing this data is legitimate interest.
We manage this information separately to other data we collect and use it to:

  • Help us plan and deliver the services you receive
  • Help us keep you informed about the service you receive
  • Ensure we have accurate contact details for you
  • Ensure that we can work effectively with other people and organisations who provide you with support and care

We collect information from you directly. This may be when you give it to us through completing the forms we ask you to fill in before you begin using our service, and through subsequent communication we receive from you with regards to the service we provide.
We collect your information indirectly when it is shared with us by independent organisations such as those who provide you with support and care. These independent organisations will only share your information with us when you have given permission for them to do so. For more information on how third parties process your data, please read their Privacy Policy.​

1b. People who access music education, music activities and courses

All data in this category are supplied by parents, guardians and young people over the age of 16, and will be used to help us communicate with you and look after your health and safety when in our care in Cornwall, or out of county. The legal basis for processing this data is consent (you have given your active consent).

2. People who support our services and public events

We are grateful to receive support from individuals, groups and organisations. This support is given in a variety of ways, including subscribing to email updates about our work, making a donation or legacy, joining our Community Mentors and fundraising on our behalf.
We need to collect personal information to ensure that we can administrate this support effectively. We ask for your name and your preferred method of contact. We may also ask for a valid postal or email address and, if you are making a donation or becoming a Community Mentor, relevant bank details. Under the GDPR Regulations, the legal basis for processing this data is consent (you have given your active consent) and legitimate interest (this information is necessary for us to fulfil your intention of donating money and your expectation of receiving a confirmation message). We will use this information to:

  • Ensure we can provide any information you’ve asked us for
  • Ensure we know how you would like to be contacted
  • Manage your donation or other support
  • Maintain a record of your relationship with us
  • Understand how we can improve the service we offer and the information we provide
  • To further our organisational aims, including fundraising activities

We may use your data to contact you from time to time by post, email and phone with news and information about MusicAbility CIC that we feel may be of interest to you, such as fundraising and other events and activities. We will not use your personal information for such purposes if you have indicated that you do not wish to be contacted.

We collect information from you directly. This may be when you give it to us through making a donation, becoming a supporter, signing up to our newsletter or attending one of our events or workshops.

We collect your information indirectly when it is shared with us by independent organisations for example, CAFDonate. These independent organisations will only share your information with us when you have given permission for them to do so. For more information on how third parties process your data, please read their Privacy Policy.

3. People who apply to work or volunteer with us

If you apply to work or volunteer with MusicAbility CIC, we will use the information you supply to us to process your application. Where we want to disclose information to a third party, for example where we want to take up a reference or obtain a ‘disclosure’ from Disclosure Scotland or the Disclosure and Barring Service, we will inform you beforehand. Under the GDPR Regulations, the legal basis for processing this data is consent (you have given your active consent).

4. Visitors who use our website and social media accounts

When you visit www.musicabilitycic.uk we may collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as how many unique visitors the site receives, which pages visitors look at and to compile statistical reports on website activity. This data is anonymous.

Under the GDPR Regulations, the legal basis for processing this data is legitimate interest (it is necessary for us to store a small amount of information, usually through cookies, to deliver functionality that you would expect and to ensure that you can interact with our web site successfully).

Cookies are text files placed on your computer to collect anonymous information. You can set your browser not to accept cookies and remove cookies from your browser. We use cookies to ensure that you can interact with our web site successfully, to identify you when you visit our web site and to keep track of your browsing patterns. The use of cookies does not give us access to the rest of your computer or to personal information about you.

When you email us, the information you send is relayed between different servers, where log files may be kept. This includes your own email provider.

If we do want to collect personal information via the website, email or other digital channels, we will always make it clear and we will explain what we intend to do with it.

This privacy policy is for MusicAbility CIC’s website, email and other digital channels. It does not cover links to external websites. External websites you visit should have their own privacy statement available for you to read.

How we manage your personal data

How long we keep your data

We take the principles of data minimisation and removal seriously and have internal policies in place to ensure that we only ever ask for the minimum amount of data for the associated purpose and delete that data promptly once it is no longer required.

Rights you have over your data

Under the General Data Protection Regulations you have a range of rights over your data, which include the following:

  • Where data processing is based on consent, you may revoke this consent at any time* and we will make it as easy as possible for you to do this (for example by putting ‘unsubscribe’ links at the bottom of all our marketing emails). *We will respond to your enquiry within a month.
  • You have the right to ask for rectification and/or deletion of your information*. In some cases relating to health records, this request must be balanced against other legal requirements to keep records for specified periods. In the case of such conflicts of law, MusicAbility CIC will seek advice from appropriate bodies.
  • You have the right of access to your information.
  • You have the right to lodge a complaint with the Information Commissioner if you feel your rights have been infringed.

A full summary of your legal rights over your data can be found on the Information Commissioner’s website here: https://ico.org.uk/

If you would like to access the rights listed above, or any other legal rights you have over your data under current legislation, please get in touch with us:
Email: info@musicabilitycic.uk

Please note that relying on some of these rights, such as the right to deleting your data, will make it impossible for us to continue to deliver some services to you. However, where possible we will always try to allow the maximum access to your rights while continuing to deliver as many services to you as possible.

Under 16 years old

If you are aged 16 or under – please ask a parent or guardian for their permission before you provide us with any personal information.

Third parties

We will never share your data with third party organisations for marketing purposes.

Security

MusicAbility CIC uses secure digital and physical record keeping systems and has up-to-date antivirus and security software. Personal information is only accessed by authorised personnel.

Changes to this Privacy Notice

MusicAbility CIC may occasionally update this Privacy Notice to reflect regulatory, supporter and service user feedback. We encourage you to check this Privacy Notice every so often so that you remain informed as to how we are using and protecting your data.