Last updated: 17 June 2026
1. Who We Are
Stardust Dance Academy (“Stardust”, “we”, “our”, “us”) is a UK-based dance school operating in Northstowe and Cambridge. We are the Data Controller responsible for deciding how and why your personal data is used.
Data Controller: Stardust Dance Academy – Sole Trader
Address: 6 Pedersen Way, Northstowe, Cambridge CB24 1BJ, United Kingdom
Contact: Available via the Contact Us form.
Telephone: 07933 746 995
If you have any questions about this notice, your data rights, or how we handle your information, you can contact us using the details above.
2. The Purpose of This Policy
This policy explains:
What personal data we collect and why.
How we use and store it.
The lawful bases under the UK General Data Protection Regulation (UK GDPR).
How long we keep your data.
Your rights as a parent, carer, or student.
3. How We Collect Personal Data
We collect personal data directly from you when you:Register or book a trial via our Studio Portal.Complete online forms on our website hosted on our website platform.Contact us by email, phone, or social media.Attend our classes, workshops, or events.Provide media consent forms.
We may also receive information from third-party processors who support our administration systems.
4. The Personal Data We Process
Parents and Guardians
•Full name, email address, and phone number(s).
• Billing and payment details (handled securely by our payment providers).
• Emergency contact information.
• Communication preferences.
Children / Students
• Full name and date of birth.
• Medical or allergy information (Special Category Data).
• Attendance and progress records.
• Photographs or videos, where explicit consent has been given.
We do not collect or request unnecessary information.
5. Why We Process Personal Data and Our Lawful Bases
Class registration and management
Class management and enrolment
Contract – necessary to deliver our service
Health & Safety
Payments and invoicing
Vital interests / Legal obligation
Payment processing
Website hosting and form collection
Contract / Legal obligation
Communication with parents
Email communication
Legitimate interest
Marketing & Social Media
Data automation between systems
Consent (can be withdrawn anytime)
Website analytics and cookies
Point-of-sale payments
Consent (via cookie banner)
6. Special Category Data (Health Information)
We only collect medical or health information necessary to ensure a student’s safety and ability to participate in classes.Our lawful basis for this processing is Article 9(2)(a) – explicit consent, and Article 9(2)(c) – vital interests when necessary in an emergency.
Such data is treated as confidential and accessed only by authorised staff.
7. Children’s Data
• Children’s data is processed only with the consent of a parent or guardian.
• No personal data is collected directly from a child without parental involvement.
• Images and videos are used only when media consent is provided through a separate form.
We do not use children’s data for direct marketing.
8. Data Sharing and Processors
We share personal data only with trusted third-party processors, each receiving only the data needed for its purpose under data-protection terms. By category, these are:
A current list of the specific processors we use is available on request — just ask via our contact form.
9. International Data Transfers
Some of our processors are located outside the UK/EEA. Where data is transferred or stored outside the UK, we ensure equivalent protection through: UK International Data Transfer Addendum (IDTA); or Standard Contractual Clauses (SCCs) approved by the ICO.
You can request a copy of these safeguards by contacting us.
10. Data Retention
Student & parent records
Retained while enrolled and for up to 12 months after withdrawal
Medical & emergency data
Retained for duration of enrolment only
Marketing data
Retained until consent withdrawn
Financial records
6 years (HMRC requirement)
Accident / incident reports
5 years minimum
Photographs / videos
Until consent withdrawn or the student leaves the school
Website enquiry submissions are retained for 12 months, then automatically deleted.
11. Security Measures
We take security seriously and implement appropriate measures, including:
• Multi-factor authentication (MFA) for all admin systems.
• Encryption and password protection for sensitive files.
• Secure cloud storage with controlled access.
• Staff confidentiality agreements and annual data protection training.
In the unlikely event of a personal data breach, we will notify affected individuals and the ICO in line with our Data Breach Response Procedure.
12. Your Data Protection Rights
You have the following rights under UK GDPR:
• Access – to request a copy of the data we hold.
• Rectification – to correct inaccurate or incomplete data.
• Erasure – to request deletion when data is no longer necessary.
• Restriction – to limit how we process your data.
• Portability – to request transfer of your data to another provider.
• Objection – to object to processing under legitimate interests.
• Withdraw consent – at any time, where processing is based on consent.
To exercise these rights, contact us via the contact form.
We will respond within one calendar month.
If you remain dissatisfied, you have the right to complain to the Information Commissioner’s Office (ICO):
Wycliffe House, Water Lane, Wilmslow SK9 5AF | www.ico.org.uk | 0303 123 1113.
13. Cookies and Web Tracking
Our website uses:
• Essential cookies for functionality and security.
• Cookieless, privacy-first analytics and a heatmap that set no cookies, collect no personal data, and require no consent.
• Embedded media cookies (e.g. YouTube) only on pages with an embedded video player, set only with your consent.
For more detail, please see our Cookie Policy.
14. Changes to This Policy
We review this policy annually and whenever our processing activities change.
The latest version is always available at www.stardustdanceacademy.com/about/privacy. We encourage you to review it regularly.
Legal Summary:
This version of the policy:
• Meets the transparency requirements of UK GDPR Articles 12–14.
• Provides all mandatory information under Article 13(1–2).
• Documents lawful bases per Article 6(1).
• Handles special category data per Article 9(2).
• Satisfies international transfer provisions per Chapter V.
• Aligns with the ICO’s Accountability Framework for small businesses.