Privacy Policy

1. Who we are

Morningside School of Music is the data controller responsible for your personal data. We are a private music school based in Edinburgh, established in 1999, registered in Scotland under company number SC328271 (VAT registration GB947211035).

Postal address: 138 Comiston Road, Morningside, Edinburgh, EH10 5QN
Phone: 0131 447 1117
Email: reception@morningsideschoolofmusic.co.uk

If you have any question about this policy or how we handle your data, please contact us using the details above, or write to our Director directly at director@morningsideschoolofmusic.co.uk.

2. The information we collect

Depending on how you interact with us, we may collect:

• Enquiry details you give us through our website contact form or the “which instrument suits you” quiz: name, email address, phone number, instrument of interest, and any message you write. When you submit the contact form, your enquiry is delivered to our reception inbox by our email provider (Resend), and a copy is held securely by our hosting provider (Cloudflare) as a short-term backup so that no enquiry is lost.
• Registration and booking details you give us when you or your child sign up for lessons, including name, date of birth, address, emergency contact and payment details. These are collected and stored on our behalf by our lesson-booking platform, MyMusicStaff, not on this website.
• Job applicant details you give us if you apply to teach with us, including your CV, qualifications and contact details, submitted through our online application form and stored securely on our own systems for our management team to review.
• Safeguarding and welfare information relevant to pupils under 18 or vulnerable adults, held only where necessary for their safety, in line with our safeguarding commitments and PVG (Protecting Vulnerable Groups) obligations under Disclosure Scotland.
• CCTV footage recorded at our Comiston Road premises for the safety and security of pupils, staff and visitors, as described in our safeguarding page.
• Technical and usage data collected automatically by our hosting provider (Cloudflare), such as IP address, browser type and pages visited, used only for security, performance and fraud-prevention purposes.

We do not collect payment card details directly on this website. Lesson fees are processed through MyMusicStaff and gift vouchers through our separate online shop, each of which has its own security measures and privacy practices.

3. Children’s data

Many of our pupils are under 18. Where we hold information about a child, it is provided and controlled by a parent or legal guardian, who registers the child, manages their booking, and can request access to or deletion of their child’s data at any time. We only collect the minimum information needed to teach safely, keep in touch with parents, and meet our safeguarding obligations.

4. Why we process your data (our lawful basis)

5. Who we share data with

We do not sell your personal data. We share it only with the following categories of third party, each acting as a processor or joint controller for a specific purpose:

• MyMusicStaff, our lesson booking, scheduling and billing platform, used to manage pupil registration and payments.
• Cloudflare, our website hosting and security provider. Cloudflare Web Analytics also gives us a basic, cookieless count of visits to the site.
• Google Analytics, which measures how the website is used, but only for visitors who accept analytics cookies. If you decline, or never answer the cookie banner, the Google Analytics script is never loaded and no data about your visit is sent to Google. See our Cookie Policy for the cookies involved and how to change your choice at any time.
• Google Maps, embedded on our contact page to show our location.
• Resend, the email provider that delivers website enquiries to our reception inbox.
• Meta Platforms (Facebook and Instagram) and Google, our advertising partners, used to promote the school (see “Marketing and advertising audiences” below).
• We may also disclose personal data where required by law, to protect the safety of a pupil or member of the public, or to Disclosure Scotland as part of the PVG scheme.

Some of these providers may process data on servers outside the UK. Where this happens, we rely on their standard contractual clauses or an equivalent UK-approved safeguard to ensure your data remains protected to UK standards.

Marketing and advertising audiences

To promote the school to the right people, we run adverts on platforms such as Facebook, Instagram and Google. As part of this we may use the contact details we already hold for existing clients (such as an email address or phone number) to create a “custom audience”, and to help these platforms find new people with similar characteristics (a “lookalike” or “similar” audience).

Before any of this information is shared with an advertising platform it is irreversibly hashed, turned into a scrambled code, on our side, so the platform cannot read your actual email address or phone number. We never sell your data, and we never share the content of your lessons, your child’s details or any safeguarding information for advertising.

We rely on our legitimate interest in promoting the school, and you have the absolute right to object. If you would prefer we did not include your details in our advertising audiences, email reception@morningsideschoolofmusic.co.uk and we will remove them. You can also control ad personalisation directly in your Facebook, Instagram and Google account settings.

6. How long we keep your data

We keep enquiry details only as long as needed to respond to you. Pupil registration and safeguarding records are kept for as long as you remain a pupil, and for a limited period afterwards where we have a legal or safeguarding reason to do so (for example, financial records for HMRC purposes, or child protection records in line with statutory guidance). CCTV footage is retained for a short rolling period before being automatically overwritten, unless needed for an active investigation.

7. Your rights

Under UK GDPR, you have the right to:

• Ask us what personal data we hold about you and why (right of access)
• Ask us to correct inaccurate or incomplete data (right to rectification)
• Ask us to delete your data where there is no good reason for us to keep it (right to erasure)
• Ask us to restrict how we use your data (right to restriction)
• Object to us processing your data on the basis of legitimate interests (right to object)
• Ask us to transfer your data to another organisation (right to data portability)
• Withdraw consent at any time, where we rely on consent

To exercise any of these rights, contact us at reception@morningsideschoolofmusic.co.uk. We will respond within one month. If you are unhappy with how we have handled your data, you also have the right to complain to the UK’s data protection regulator, the Information Commissioner’s Office (ICO).

8. Keeping your data secure

We use appropriate technical and organisational measures to protect the personal data we handle, including secure hosting, restricted access to booking and safeguarding records, and working only with reputable, GDPR-compliant third-party providers.

9. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or in the law. The “last updated” date at the top of this page shows when it was last revised. We encourage you to review it periodically.

10. Contact us

Morningside School of Music, 138 Comiston Road, Morningside, Edinburgh, EH10 5QN · 0131 447 1117 · reception@morningsideschoolofmusic.co.uk

See also our Terms of Service and Cookie Policy.