PRIVACY NOTICE

---

Charlie Hodgson Guitar Tutoring and Charlie Hodgson Music

Version 1.0
Effective from 31 July 2026
Last reviewed: 31 July 2026

AT A GLANCE

I am Charles Hodgson, trading as Charlie Hodgson Guitar Tutoring and Charlie Hodgson Music.

I collect and use personal information so that I can:

• respond to enquiries;
• arrange and deliver guitar lessons, courses and workshops;
• administer online tuition and membership services;
• manage performance, session-musician and private-event bookings;
• keep children and adults safe during lessons and events;
• process payments and maintain business records;
• communicate with pupils, parents, clients, agents and venues;
• publish photographs, recordings, testimonials or reviews where I have a lawful reason and any required permission;
• send information about lessons, workshops and performances where the law permits;
• protect my teaching premises, pupils, visitors and business; and
• meet legal, safeguarding, insurance and tax requirements.

I do not sell personal information.

I do not use personal information to make decisions about pupils or clients solely through automated systems.

Children’s information receives additional protection. I normally communicate with the parent or guardian rather than directly with a child, and I do not publish an identifiable image or recording of a child without the appropriate permission and regard for the child’s own wishes.

1. WHO I AM

The data controller is:

Charles Hodgson
Trading as Charlie Hodgson Guitar Tutoring and Charlie Hodgson Music

Email: contact.charliehodgsonmusic@gmail.com
Telephone: 07709 118932

Websites:

• Charlie Hodgson Guitar Tutoring
• Charlie Hodgson Music

I have not appointed a formal Data Protection Officer. I am responsible for privacy and data-protection matters relating to my business.

References to “I”, “me” and “my” in this notice include Charles Hodgson and the activities carried out under the Charlie Hodgson Guitar Tutoring and Charlie Hodgson Music trading names.

1. WHAT THIS NOTICE COVERS

This notice applies when you:

• visit or communicate through either of my websites;
• make an enquiry by email, telephone, contact form, social media, WhatsApp or another messaging service;
• ask to join a waiting list or mailing list;
• book or attend a private guitar lesson;
• book or attend an online guitar lesson;
• join an adult group, course, membership or Guitar Circle;
• book a child or young person onto lessons, workshops or courses;
• attend an adult or children’s workshop;
• book me as a guitarist, performer, session musician or musical adviser;
• arrange tuition or performances through an agent, concierge, family office, household representative, school, club, hotel or venue;
• engage me for international, in-residence or travel-based services;
• provide a testimonial, review, photograph or recording;
• visit my home teaching premises;
• work with me as a supplier, contractor, photographer, assistant, agent or professional partner; or
• otherwise interact with my business.

Where I work through a school, agency, venue, concierge, household representative or other organisation, that organisation may also be a separate data controller. Its own privacy notice may apply alongside this notice.

1. WHOSE INFORMATION I MAY HANDLE

I may handle information about:

• adult pupils and prospective pupils;
• children and young people receiving tuition;
• parents, guardians and carers;
• emergency contacts;
• adults authorised to collect a child;
• workshop and course attendees;
• Guitar Circle members and waiting-list applicants;
• private-event and performance clients;
• household representatives, estate managers, personal assistants, concierges and family-office contacts;
• wedding clients, venue contacts, hotels and hospitality clients;
• agents, promoters and booking representatives;
• musicians, performers and collaborators;
• suppliers, contractors and assistants;
• people who submit enquiries or join mailing lists;
• people who leave reviews or testimonials;
• website and social-media visitors; and
• visitors recorded by a business-use video doorbell or security camera, where recording is enabled.

1. THE INFORMATION I MAY COLLECT

The information collected depends on the service and circumstances.

4.1 Identity and contact details

This may include:

• full name;
• preferred name;
• title;
• age or date of birth where relevant;
• parent or guardian’s name;
• relationship to a child or pupil;
• postal or billing address;
• email address;
• telephone number;
• social-media username;
• preferred contact method; and
• identity or authority information where I need to confirm parental responsibility, an authorised representative or the person making a data-rights request.

4.2 Information about children and young people

This may include:

• child’s name, age and date of birth;
• parent or guardian details;
• emergency contacts;
• authorised collection arrangements;
• attendance;
• school year where relevant;
• guitar ability and musical experience;
• examination level;
• learning preferences;
• interests and goals;
• SEND, access, sensory or communication requirements;
• relevant health, allergy or medication information;
• behaviour, welfare or safeguarding information;
• parental permissions;
• the child’s own views about photography, recordings or participation; and
• records of accidents, incidents or concerns.

I normally require a parent, guardian or person with parental responsibility to complete booking and consent information for a child.

4.3 Tuition, workshop and musical-development information

This may include:

• current playing level;
• instrument type;
• whether the pupil plays acoustic or electric guitar;
• left- or right-handed playing;
• songs, styles and musicians the pupil enjoys;
• lesson objectives;
• practice notes;
• repertoire;
• examination preparation;
• grades or results voluntarily provided;
• GCSE, A-level or other music-study information;
• lesson attendance;
• progress observations;
• materials provided;
• workshop group and ability allocation;
• performance coaching information; and
• feedback from the pupil or parent.

4.4 Booking and service information

This may include:

• service requested;
• lesson or event dates;
• availability;
• location;
• attendance records;
• calendar invitations;
• cancellations and rescheduling;
• course or membership details;
• booking correspondence;
• contract and consent records;
• deposits and balances;
• joining instructions; and
• records showing which version of the terms or privacy notice was supplied.

4.5 Payment and financial information

This may include:

• amount paid;
• payment date;
• bank-transfer reference;
• invoice details;
• billing contact;
• refund information;
• outstanding balances;
• expenses;
• tax records; and
• information required for accounting, insurance or fraud prevention.

I do not normally collect or retain complete payment-card details. Where a third-party payment service is used, that provider handles card information under its own privacy arrangements.

4.6 Health, allergy, disability and support information

Where relevant to safe and accessible tuition or participation, I may ask for limited information about:

• allergies and intolerances;
• coeliac disease or dietary requirements;
• asthma, epilepsy, diabetes or other relevant conditions;
• prescribed or emergency medication;
• hearing sensitivity or tinnitus;
• mobility or physical restrictions;
• hand, wrist, arm, neck, shoulder or back conditions;
• disability;
• SEND;
• sensory, communication or emotional-support requirements;
• anxiety, mental health conditions or other information that may affect safe participation;
• emergency instructions; and
• reasonable adjustments.

I ask only for information that is relevant to the service, safety, emergency response or reasonable adjustments. I do not require a complete medical history.

4.7 Safeguarding, accident and incident information

This may include:

• attendance and collection records;
• factual notes about an accident or injury;
• first aid provided;
• witnesses;
• concerns about a child or person at risk;
• disclosures made to me;
• concerns about an adult’s conduct;
• communications with parents, emergency services or safeguarding organisations;
• insurance correspondence; and
• allegations or information relating to possible criminal conduct where it is necessary and lawful to record it.

Safeguarding records are kept separately from routine lesson notes and are subject to tighter access controls.

4.8 Photographs, video and audio

This may include:

• photographs taken during lessons, workshops, courses or events;
• video clips;
• audio recordings of playing;
• online lesson recordings where separately agreed;
• a child’s or adult’s image, voice or performance;
• photography and recording permissions;
• records of consent, refusal or withdrawal; and
• information about where material has been published.

Lessons and workshops are not recorded by default.

For promotional use, identifiable images or recordings are normally used only where the required consent has been obtained. For children, I also consider the child’s age, understanding and wishes.

4.9 Performance, private-event and international-service information

This may include:

• client and venue contacts;
• event date, schedule and address;
• household, estate, hotel or venue access arrangements;
• guest or VIP requirements where supplied;
• security and confidentiality instructions;
• repertoire requests;
• event format;
• technical and production information;
• travel and accommodation details;
• emergency contacts;
• dietary or accessibility information relevant to the booking;
• passport or identity information where required for legitimate travel arrangements;
• agent or concierge correspondence;
• contracts, invoices and expenses; and
• information needed to deliver in-residence or international tuition.

I collect sensitive household, guest, travel or security information only where it is needed for the booking. I do not identify private clients, families, children, households or event locations publicly without appropriate permission.

4.10 Website and technical information

This may include:

• IP address;
• browser and device type;
• operating system;
• approximate location derived from IP address;
• pages viewed;
• referral source;
• date and time of visits;
• contact-form submissions;
• cookie identifiers;
• security and spam-prevention information;
• interaction with website features; and
• consent preferences.

My websites may use services such as website hosting, contact forms, Google reCAPTCHA and website-measurement tools. The actual cookies and similar technologies in use are described in the cookie information available on the relevant website.

4.11 Communications and social-media information

This may include:

• emails;
• contact-form messages;
• telephone notes;
• voicemail;
• SMS or WhatsApp messages;
• social-media direct messages;
• comments;
• enquiries;
• complaints;
• feedback;
• song requests;
• lesson or event discussions; and
• records of marketing preferences.

Social-media services and messaging providers also process information under their own privacy notices.

4.12 Reviews and testimonials

This may include:

• your name;
• profile photograph;
• review text;
• star rating;
• the platform on which the review appeared;
• your consent to reproduce a testimonial; and
• attributed quotation. 

A review posted publicly on Google, Facebook or another platform is controlled in part by that platform. I may respond to the review publicly. I will use a public review from Google in separate promotional material such as my website. Public reviews may be quoted where lawful and fair.

4.13 Security-camera and video-doorbell information

Where business-related recording is enabled, a video doorbell or security camera may record:

• image;
• voice or ambient sound where audio is enabled;
• date and time;
• movement or activity near the entrance; and
• delivery or visitor information.

Security recording is used for safety, crime prevention, property protection, managing access and investigating incidents. 

1. HOW I COLLECT INFORMATION

I may receive information:

• directly from you;
• from a parent, guardian or carer;
• from the child or pupil during lessons;
• from an emergency contact;
• through my websites and contact forms;
• through Typeform or another booking-form provider;
• by email, telephone, WhatsApp, SMS or social media;
• through Google Calendar or another scheduling service;
• through an online lesson or video-conferencing service;
• from an agent, venue, concierge, personal assistant, family office, estate manager, school or household representative;
• from a referral made by an existing client or professional contact;
• from a public business directory, professional website or public social-media profile;
• from Google Business Profile, review platforms or event platforms;
• from a bank, payment provider or accounting system;
• from website cookies and security technologies; and
• from a Ring doorbell or other security system, where enabled.

Where somebody else supplies your information, I ask them to have authority to do so. I will provide this privacy information within the period required by law unless you already have it or a lawful exception applies.

1. WHY I USE PERSONAL INFORMATION AND MY LAWFUL BASES

I must have a lawful basis for every use of personal information.

Depending on the circumstances, I rely on the following bases:

• contract;
• steps requested before entering a contract;
• legitimate interests;
• recognised legitimate interests where a statutory condition applies;
• consent;
• legal obligation; and
• vital interests.

6.1 Responding to enquiries and arranging services

I use contact, availability, musical and booking information to:

• respond to an enquiry;
• discuss whether a service is suitable;
• provide fees and availability;
• arrange an initial lesson or consultation;
• prepare a quotation or proposal;
• reserve a space; and
• enter into a contract.

For adults and contracting clients, the lawful basis is normally taking steps at your request before entering a contract or performing the contract.

Where a parent enters into the contract and the service is for a child, contract normally applies to the parent’s information. I generally rely on legitimate interests for the limited information about the child needed to assess suitability, arrange the service and deliver it safely. My legitimate interest is providing the requested educational service while protecting the child’s interests.

6.2 Delivering private lessons, workshops and courses

I use pupil, parent, booking, attendance and musical-progress information to:

• prepare lessons;
• select appropriate music and exercises;
• monitor progress;
• maintain continuity;
• group workshop attendees by age or ability;
• communicate lesson information;
• manage attendance;
• support grades or examinations where requested;
• deliver accessible tuition; and
• respond to feedback.

For an adult pupil, the lawful basis is normally contract.

For a child whose parent or guardian holds the contract, I normally rely on legitimate interests for the child’s routine tuition and progress information. I consider the child’s best interests, collect only the information needed, and do not use it for unrelated purposes.

6.3 Running the Guitar Circle, online lessons and memberships

I use membership, contact, payment, attendance and musical information to:

• manage waiting lists;
• administer membership;
• send joining links and calendar invitations;
• deliver online sessions;
• provide learning materials;
• manage recurring participation;
• moderate group conduct; and
• communicate service changes.

The lawful basis is normally contract, steps requested before contract or legitimate interests.

Online sessions are not recorded unless this has been explained and separately agreed.

6.4 Protecting health and safety

I sometimes will use emergency, health, allergy, access and medication information to:

• assess whether reasonable arrangements can be made;
• reduce foreseeable risks;
• plan workshop refreshments;
• make reasonable adjustments;
• respond to illness, injury or an allergic reaction;
• contact a parent or emergency contact; and
• provide relevant information to emergency services.

For adults, the Article 6 basis may be contract, legitimate interests or consent, depending on the circumstances.

For children, the Article 6 basis is normally legitimate interests in delivering the activity safely.

Because health information is special-category data, I normally rely on explicit consent as the additional Article 9 condition for routine information supplied on a medical, allergy or support form.

In a serious emergency where a person is physically or legally unable to consent, I may rely on vital interests to use or disclose information needed to protect life.

Where an incident may lead to a legal or insurance claim, I may retain and use relevant health information for the establishment, exercise or defence of legal claims.

6.5 Safeguarding children and people at risk

I may record, use or share information where I believe this is necessary to:

• protect a child or vulnerable person;
• respond to a disclosure;
• obtain safeguarding advice;
• make a referral;
• cooperate with children’s services, police or another appropriate body;
• prevent or investigate suspected harm or criminal conduct; or
• respond to a safeguarding complaint or allegation.

Depending on the circumstances, I may rely on:

• recognised legitimate interests for safeguarding a vulnerable individual or preventing, detecting or investigating crime;
• legal obligation;
• vital interests;
• legitimate interests; and
• substantial public interest under the Data Protection Act 2018 safeguarding condition.

Consent is not always sought where asking for consent could place somebody at further risk, frustrate a safeguarding response or is otherwise inappropriate.

6.6 Payments, accounts and tax

I use booking, payment, invoice and contact information to:

• collect payment;
• issue invoices or receipts;
• process refunds;
• reconcile bank payments;
• maintain accounting records;
• complete tax returns;
• prevent or detect fraud; and
• respond to HMRC or another lawful authority.

The lawful bases are contract, legal obligation and legitimate interests.

6.7 Performance, event, session and international bookings

I use client, venue, schedule, travel, production and repertoire information to:

• prepare and deliver a performance;
• coordinate with agents, venues, households and suppliers;
• arrange access, travel and accommodation;
• agree technical requirements;
• manage confidentiality and security instructions;
• invoice the client; and
• respond to changes or incidents.

The lawful bases are contract, steps requested before contract and legitimate interests.

Where another person supplies guest, household or staff details, I use only the information needed to deliver the booking.

6.8 Customer service, administration and complaints

I use communications, contracts, attendance, consent, payment and service records to:

• answer questions;
• send service reminders;
• handle changes;
• resolve concerns;
• investigate complaints;
• maintain evidence of agreements;
• improve administration; and
• defend or resolve disputes.

The lawful bases are contract, legal obligation and legitimate interests.

My legitimate interests include running an organised and accountable business, maintaining accurate records and resolving disagreements fairly.

6.9 Photography, video and audio

For identifiable promotional photographs, video or audio, I normally rely on consent.

Consent is requested separately from compulsory booking terms. Refusing promotional media consent does not prevent a pupil or attendee from receiving the service.

For a child, permission will normally be obtained from a parent or person with parental responsibility. I also consider whether the child understands and agrees. I will not require a child to participate in photography if they are uncomfortable, even where a parent has agreed.

Where an event or venue controls its own photography or filming, that organisation’s privacy notice and permissions may apply.

6.10 Testimonials and public reviews

I may use:

• consent for identifiable testimonials supplied privately;
• legitimate interests for responding to public reviews;
• legitimate interests for using an extract from a public review where this is fair and reasonably expected; and
• consent before using a person’s photograph, full name, child’s identity or private booking details alongside a testimonial.

6.11 Marketing, newsletters and workshop updates

I may send information about:

• private lessons;
• workshops;
• courses;
• Guitar Circle sessions;
• future availability;
• performances;
• events; and
• related services offered by my business.

The UK GDPR lawful basis may be consent or legitimate interests. I also comply with the separate PECR rules for email, text, WhatsApp and social-media direct messages.

I send electronic marketing to an individual only where:

• they have consented; or
• the existing-customer soft opt-in applies because their details were collected during a sale or genuine negotiation for a sale of my services, expressed interest in my services, the marketing concerns my own similar services, and they were offered an easy opt-out when the details were collected and in every message.

A person merely appearing on a contact list or having publicly available contact details does not by itself give me permission to send electronic marketing.

Parents’ contact details are used for service administration and, only where permitted, relevant marketing. I do not target children directly with marketing.

You can opt out at any time by replying, using an unsubscribe option where provided, or emailing me. I will keep the minimum information required on a suppression list so that I do not contact you again by mistake.

Service messages, such as lesson reminders, safety information, payment confirmations or workshop changes, are not marketing where their purpose is to administer a service you have requested.

6.12 Website operation, analytics and security

I use technical and website information to:

• operate and secure the websites;
• respond to contact forms;
• prevent spam and misuse;
• diagnose faults;
• understand website use;
• maintain consent preferences; and
• improve website content.

Essential website technologies are used where necessary to provide the service or transmit communications.

For analytics, advertising, embedded media or social-media technologies that are not exempt under PECR, I obtain consent before they are activated.

Where a current PECR exception applies, such as a qualifying statistical-purpose technology, I provide the required information and a simple way to object.

The lawful basis under data-protection law may be legitimate interests for essential security and website operation, or consent where consent is required.

6.13 Video doorbell and security

Where business-use recording is enabled, I rely on legitimate interests for:

• visitor and pupil safety;
• property security;
• crime prevention;
• managing access;
• confirming deliveries; and
• investigating an incident.

I consider whether recording is necessary and proportionate and restrict access to footage.

6.14 Legal claims, insurance and regulatory requirements

I may use or disclose information to:

• notify or correspond with an insurer;
• obtain legal advice;
• establish, exercise or defend legal rights;
• comply with a court order;
• respond to law enforcement;
• meet health-and-safety or safeguarding responsibilities; and
• cooperate with a regulator.

The lawful bases may include legal obligation, legitimate interests, recognised legitimate interests and legal claims.

1. SPECIAL-CATEGORY AND CRIMINAL-OFFENCE INFORMATION

Special-category information includes health, disability, racial or ethnic origin, religious beliefs, sexual orientation and certain other sensitive information.

I do not routinely request most of these categories. They may, however, arise through:

• allergy or health forms;
• disability and access arrangements;
• dietary requirements linked to religion;
• safeguarding disclosures;
• complaints or incidents; or
• information voluntarily shared by a pupil or parent.

Whenever I process special-category information, I identify:

• an Article 6 lawful basis; and
• a separate Article 9 condition.

The conditions I may use include:

• explicit consent;
• vital interests where the person cannot consent;
• the establishment, exercise or defence of legal claims; and
• substantial public interest for safeguarding children or individuals at risk.

Information about alleged or proven criminal offences is processed only where there is a lawful basis and a relevant legal condition or official authority. It is restricted to those who need it.

Where required by the Data Protection Act 2018, I maintain an Appropriate Policy Document covering compliance, retention and deletion.

1. CHILDREN’S INFORMATION

Children have their own data-protection rights.

I take additional precautions by:

• collecting children’s information mainly through a parent or guardian;
• limiting collection to what is needed for tuition, safety and administration;
• using children’s best interests as a central consideration;
• providing a short child-friendly explanation where appropriate;
• communicating through the parent or guardian rather than privately with the child, unless a suitable arrangement has been agreed;
• avoiding direct marketing to children;
• not publishing a child’s full name, address, school or private family information;
• requesting separate permission for photographs and recordings;
• considering the child’s own wishes about photography and publication;
• restricting access to health and safeguarding information;
• avoiding unnecessary sharing;
• applying shorter retention periods to routine information where possible; and
• responding to a competent child’s own data-rights request.

A parent does not automatically own the child’s personal information. Where a child is competent to understand and exercise their rights, I will take their wishes and confidentiality into account.

If an online service is offered directly to a child and consent is the lawful basis, the additional rules for children’s online consent and age verification will be followed.

1. INFORMATION THAT IS REQUIRED AND INFORMATION THAT IS OPTIONAL

Some information is needed to enter into or administer a booking. This may include:

• contracting adult’s name and contact details;
• pupil’s name;
• age where the service has an age requirement;
• service and scheduling information;
• payment information;
• emergency and parent details for children;
• information needed to deliver the service safely; and
• any information required by law or insurance.

If required information is not supplied, I may be unable to confirm or safely deliver the booking.

Optional information includes:

• marketing consent;
• photography and recording permission;
• testimonials;
• social-media tags;
• interests that are not needed for lesson planning; and
• non-essential demographic information.

Refusing optional consent does not affect the core service.

1. WHO I MAY SHARE INFORMATION WITH

I share only the information needed for the relevant purpose.

Recipients may include:

• the pupil, parent or contracting client;
• an authorised parent, guardian, carer or emergency contact;
• assistants or photographers working under my instructions;
• another tutor or musician where the client has agreed or this is needed for a joint service;
• website and hosting providers;
• booking and form providers, including Typeform where used;
• email, calendar and cloud-storage providers, including Google services where used;
• video-conferencing providers, such as Google Meet or Zoom where used;
• messaging providers, including WhatsApp;
• payment, banking and accounting providers;
• Google Business Profile and review platforms;
• social-media providers, including Meta platforms;
• website-security and spam-prevention services, including Google reCAPTCHA;
• Ring or another security-system provider where recording is enabled;
• agents, concierges, venues, hotels, promoters and booking partners;
• travel and accommodation providers where needed for an agreed booking;
• examination boards or educational organisations where requested and appropriate;
• insurers and insurance brokers;
• accountants, solicitors and professional advisers;
• HMRC;
• emergency services;
• local-authority children’s services, safeguarding partnerships or the police;
• courts, regulators and public authorities where disclosure is required or lawfully requested; and
• a prospective purchaser or successor if the business is sold or transferred, subject to suitable confidentiality and data-protection arrangements.

I do not sell or rent personal information to third parties for their own marketing.

Where a service provider acts as my data processor, I use appropriate contractual terms requiring it to protect the information and act only on authorised instructions.

Some third parties, such as banks, social-media companies, review platforms, venues, agents and travel providers, act as separate controllers under their own privacy notices.

1. INTERNATIONAL DATA TRANSFERS

Some service providers may process information outside the United Kingdom. This may apply to providers of:

• website hosting;
• contact forms;
• email and calendars;
• cloud storage;
• video conferencing;
• social media;
• messaging;
• security systems;
• analytics; and
• online booking or payment services.

Where a restricted international transfer takes place, I use an appropriate legal transfer mechanism, which may include:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved standard contractual clauses;
• another approved safeguard; or
• a limited statutory exception where permitted.

I also consider whether supplementary security or contractual measures are required.

You may contact me for further information about the safeguards applying to a particular provider.

1. AI-ASSISTED AND AUTOMATED TOOLS

I do not make decisions about eligibility, ability, safeguarding, pricing, pupil progress or access to services solely through automated processing.

I may at times use an approved AI-assisted tool to help with limited administrative tasks, such as drafting routine correspondence, organising non-sensitive notes or preparing general marketing copy.

AI output is reviewed by a person before use. I do not permit an AI tool to make decisions about a pupil or client.

1. HOW LONG I KEEP INFORMATION

I keep personal information only for as long as it is needed for the purpose for which it was collected, including legal, tax, safeguarding and insurance requirements.

My standard retention approach is:

13.1 Enquiries that do not become bookings

Normally 36 months after the last meaningful contact, unless you ask to remain on a waiting list or there is another reason to retain the correspondence such as legitimate interest previously.

13.2 Waiting lists

Normally up to 36 months, with periodic review. Information is removed sooner if you ask to leave or the waiting list is closed.

13.3 Adult booking, contract, payment and attendance records

Normally six years after the final service or end of the relationship, where needed for tax, contract, insurance and legal-claim purposes.

13.4 Routine adult lesson and progress notes

Normally up to two years after the final lesson, unless they form part of a complaint, claim, safeguarding matter or longer-term course record.

13.5 Routine children’s lesson and progress notes

Normally up to two years after the final lesson, unless they are required for continuity, a dispute, safeguarding, insurance or legal purposes.

13.6 Children’s booking, consent and attendance records

Normally six years after the end of the service.

Where a record may be relevant to a child’s injury claim, significant incident, safeguarding matter or insurer requirement, it may be retained for longer, potentially until the child’s 25th birthday or another period supported by current safeguarding, insurance or legal advice.

13.7 Health, allergy, medication and emergency information

Routine information is normally deleted within three months after the relevant workshop, course or tuition relationship ends.

If there has been an accident, medical event, safeguarding concern, complaint or potential claim, relevant information is retained with the incident record for the applicable longer period.

13.9 Accident and incident records

Adult records are normally kept for six years after the incident.

Records involving a child may be kept until the child’s 25th birthday or for another period required by the insurer or legal advice.

13.10 Financial and tax records

Normally six years after the end of the relevant tax year, or longer where required by HMRC, an investigation or another legal obligation.

13.11 Performance, event and travel bookings

Contracts, invoices and core booking records are normally kept for six years after the event or end of the contract.

Temporary access lists, guest information, security details and copies of travel identity documents are deleted promptly when no longer needed, normally within 30 days after the booking unless a legal, tax, insurance or incident reason requires longer retention.

13.12 Photographs, video and audio

Promotional material is retained while it remains in use and the relevant permission or lawful basis remains valid.

Where consent is withdrawn, I stop future use and remove material under my control where reasonably possible. Withdrawal does not make earlier lawful use unlawful and may not remove copies already printed, shared or controlled by another platform or person.

Records showing the permission that applied may be kept for up to six years after the material’s final use.

13.13 Online lesson recordings

Sessions are not recorded by default.

Where a recording is specifically agreed, the purpose and retention period will be stated before recording. Unless another period has been agreed, recordings are normally deleted within 90 days.

13.14 Website and cookie information

Retention varies according to the technology used and is stated in the cookie information on the relevant website.

13.15 Video-doorbell and security footage

Not usually always deleted as sometimes needs to be kept / footage is needed to investigate an incident, crime, complaint or insurance matter.

13.16 Marketing information

Kept while you remain subscribed or while another lawful marketing basis continues.

Inactive marketing records are periodically reviewed. A minimal suppression record may be kept for as long as necessary to honour an opt-out.

13.17 Data-rights requests and privacy complaints

Normally six years after the request or complaint is closed, where needed to demonstrate how it was handled.

I may shorten or extend a period where the law, an insurer, a regulator, safeguarding guidance, an ongoing dispute or the circumstances require it.

1. HOW I PROTECT INFORMATION

Measures may include:

• password-protected accounts and devices;
• multi-factor authentication where available;
• current device and software security;
• restricted access;
• separate storage of safeguarding information;
• limited access to health information;
• locked storage for necessary paper records;
• secure disposal and confidential shredding;
• encrypted or secure cloud services where available;
• business-controlled email and storage;
• consent and access controls for photographs;
• regular review and deletion;
• secure backups;
• processor contracts;
• separating business records from personal household files;
• avoiding group emails that unnecessarily expose addresses;
• obtaining permission before creating groups that expose telephone numbers;
• checking recipient details before sending sensitive information; and
• maintaining a personal-data breach procedure.

No electronic system is completely risk-free. If a personal-data breach occurs, I will contain and assess it, keep an incident record, notify the ICO within the legal period where required, and inform affected people without undue delay where the risk is high.

1. MARKETING PREFERENCES

You have an absolute right to object to direct marketing.

You can ask me to stop at any time by:

• replying to the message;
• using an unsubscribe option where provided;
• emailing contact.charliehodgsonmusic@gmail.com; or
• calling 07709 118932.

I will act on the request and may retain a small suppression record containing enough information to ensure you are not contacted again.

I will not require you to receive marketing as a condition of booking lessons or workshops.

I do not pass mailing-list information to another business so that it can market its own services to you.

1. COOKIES AND SIMILAR TECHNOLOGIES

My websites may use:

• cookies;
• local storage;
• tracking pixels;
• embedded media;
• scripts;
• security tags;
• device information; and
• similar storage or access technologies.

These may be used for:

• essential website operation;
• contact forms;
• spam and security protection;
• remembering privacy choices;
• website statistics;
• embedded media;
• social-media functions; and
• advertising, where used.

A separate cookie notice or consent tool should identify the current technologies, providers, purposes and durations.

Non-essential technologies are not activated before consent unless a current PECR exception applies. It must be as easy to reject or withdraw consent as it is to accept it.

The website currently uses Google reCAPTCHA on contact forms. Google may process device, browser, interaction and security information under its own privacy arrangements.

1. YOUR DATA-PROTECTION RIGHTS

Depending on the circumstances and lawful basis, you may have the right to:

• be informed about how your information is used;
• obtain a copy of your personal information;
• correct inaccurate information;
• complete incomplete information;
• request deletion;
• restrict the way information is used;
• object to processing based on legitimate interests;
• object to direct marketing;
• receive certain information in a portable format;
• withdraw consent;
• ask for human intervention in relation to a solely automated decision;
• complain about how your information has been used; and
• complain to the Information Commissioner’s Office.

These rights are not all absolute. For example, I may need to retain information to meet a legal obligation, protect safeguarding interests or defend a legal claim.

Children have these rights in their own name. A parent may exercise a right for a child where the child has authorised the parent or is not competent to exercise the right themselves and the request is in the child’s best interests.

To make a request, contact:

contact.charliehodgsonmusic@gmail.com

Please state that the request concerns personal data.

I may ask for proportionate evidence of identity or authority before releasing information.

I normally respond without undue delay and within one calendar month. The period may be extended where the request is complex or multiple requests have been made, as permitted by law.

There is normally no charge. A reasonable fee may apply, or a request may be refused, where the law allows this because a request is manifestly unfounded or excessive.

1. HOW TO MAKE A DATA-PROTECTION COMPLAINT TO ME

You may complain if you believe I have:

• used personal information unfairly;
• failed to explain how information is used;
• disclosed information incorrectly;
• failed to keep information secure;
• sent unwanted marketing;
• failed to respect a data-protection right; or
• otherwise failed to follow data-protection law.

Please email:

contact.charliehodgsonmusic@gmail.com

Use the subject line:

Data Protection Complaint

Please include:

• your name and contact details;
• the person whose information is involved, where different;
• what you believe has happened;
• when it happened;
• any relevant correspondence; and
• the outcome you are seeking.

I will:

• provide an accessible way to complain;
• acknowledge the complaint within 30 days;
• investigate and make appropriate enquiries;
• keep you informed where the investigation takes time;
• respond without undue delay; and
• explain the outcome and any action taken.

I may ask for information needed to confirm identity or understand the complaint.

1. COMPLAINING TO THE ICO

You may also complain to the Information Commissioner’s Office, the UK regulator for data protection.

I would appreciate the opportunity to address the issue first, although this does not affect your right to approach the ICO.

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113

Search online for “ICO make a complaint” for the current online complaint service.

1. THIRD-PARTY WEBSITES, SOCIAL MEDIA AND PLATFORMS

My websites and communications may link to:

• social-media platforms;
• review sites;
• booking forms;
• video-conferencing services;
• agents;
• venues;
• event platforms;
• travel services; and
• other external websites.

Those organisations control their own websites and privacy practices. You should read their privacy notices before submitting information.

When you comment publicly on social media or a review platform, your name, profile and comments may be visible to others according to your account settings and the platform’s rules.

1. CHANGES TO THIS NOTICE

I review this notice when:

• services change;
• a new provider or platform is introduced;
• data-processing practices change;
• legal requirements change; or
• a privacy risk or complaint indicates that an update is needed.

The latest version will be made available on my websites and will show its effective date.

Where a change would have a substantial effect on how existing clients’ information is used, I will provide an appropriate notice before the new use begins.

1. CONTACT

For questions, rights requests, consent withdrawals, marketing opt-outs or complaints, contact:

Charles Hodgson
Charlie Hodgson Guitar Tutoring and Charlie Hodgson Music

Email: contact.charliehodgsonmusic@gmail.com
Telephone: 07709 118932

CHILD-FRIENDLY PRIVACY SUMMARY

I’m Charlie, your guitar tutor.

To teach you and keep lessons safe, I may need to know:

• your name and age;
• your parent or guardian’s contact details;
• what guitar you play;
• what music you enjoy;
• how your playing is developing;
• whether you need any help or adjustments; and
• who to contact in an emergency.

I keep this information private and use it to organise and teach your lessons.

I do not post a recognisable photograph or video of you for promotion without the right permission. Even where a parent has agreed, you can tell me if you do not want a photograph taken.

If I am worried that you or another child may be unsafe, I may need to tell somebody who can help.

Your information belongs to you. You can ask what I have, tell me if something is wrong or ask me to delete something where the law allows.

You can speak to me or ask your parent or guardian to email:

contact.charliehodgsonmusic@gmail.com