PRIVACY POLICY — WIRRAL MUSIC FACTORY

Last updated: 13 October 2026

This privacy policy explains how Wirral Music Factory (“WMF,” “we,” “us,” or “our”) collects, uses, stores, and protects your personal data when you visit our website, book lessons, or interact with us in any other way. We are committed to protecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Please read this policy carefully. If you have any questions, you can contact us at any time using the details in Section 1.

October 2026 update: We have added information about paid lesson invoices, the personal data they contain, and storage in the WMF Hub and a restricted Google Drive archive.

1. WHO WE ARE (DATA CONTROLLER)

Wirral Music Factory is a music school based on the Wirral, offering tuition in drums, guitar, bass, piano, singing, violin, flute, saxophone, ukulele, mandolin and music theory to students of all ages, including children.

Data Controller: Matt Duffy
Website: www.wirralmusicfactory.com
Email: md@wirralmusicfactory.com

WMF is registered in England and is the data controller responsible for the personal data collected through our website, booking system, email communications, and in-person interactions. This means we decide how and why your personal data is processed, and we are accountable for doing so lawfully and transparently.

2. WHAT PERSONAL DATA WE COLLECT

We collect different types of personal data depending on how you interact with us. The categories include:

Contact information — your name, email address, phone number, and postal address.

Booking and lesson information — the type of lessons you book, your schedule, and payment details (payments are handled by third-party processors — we do not store your full card details).

Invoice records — the payer’s name, billing address and email address where available; the learner’s name; the tutor’s name; the lesson or lesson-block description, dates and quantity; amounts, discounts, currency, payment method and payment date; and the invoice number and issue date. We also retain the linked booking and payment references and a record of invoice creation, review and archive activity in the Hub. Invoice PDFs do not contain full card details or bank account details.

Student information — age, skill level, lesson preferences, and progress notes used to tailor your tuition.

Children’s information — for students under 18, we collect the child’s name and age along with parent or guardian contact details. This data is collected with parental consent where required (see Section 5).

Website usage data — IP address, browser type, device information, pages visited, and cookie data (see Section 11).

Communication data — the content of emails, enquiry form submissions, and any messages you send us.

Marketing preferences — whether you have opted in to receive marketing emails, and records of when consent was given or withdrawn.

3. HOW WE COLLECT YOUR DATA

We collect personal data in the following ways:

Directly from you — when you fill in a booking form, submit an enquiry, phone us, email us, or speak with us in person at a lesson or event.

Through our website — automatically via cookies and similar technologies when you browse our site (see Section 11).

Through our online booking system — we use Amelia, a WordPress booking plugin, to collect the details you provide when booking lessons and to manage appointments. Booking records are stored in our website’s WordPress database. Third-party services used for payments or booking communications process the information needed to provide those services and have their own privacy policies.

WMF Hub records — authorised staff record payments received, including cash and bank transfers, in our staff Hub. The Hub uses these records, confirmed payment information from Amelia, the linked learner record and billing details supplied by the payer to prepare invoices.

4. WHY WE PROCESS YOUR DATA AND OUR LAWFUL BASIS

Under UK GDPR, we must have a lawful basis for processing your personal data. The table below sets out the purposes for which we use your data and the legal basis we rely on in each case.

PurposeData UsedLawful BasisManaging lesson bookings and schedulingContact details, lesson preferencesContract performance — necessary to deliver the lessons you have bookedCommunicating about lessons (reminders, schedule changes, cancellations)Contact detailsContract performance — necessary to fulfil our obligations to youProcessing paymentsPayment information (handled by third-party processor)Contract performance — necessary to collect payment for services providedSending marketing emails and newslettersEmail address, nameConsent — only sent where you have actively opted inImproving our website and servicesWebsite usage data, cookiesLegitimate interest — to understand how visitors use our site and improve the experienceSafeguarding children and vulnerable adultsStudent age, emergency contacts, relevant medical or additional needs informationLegal obligation and vital interests — to meet our duty of care and safeguarding responsibilitiesResponding to enquiriesContact details, message contentLegitimate interest — to reply to people who contact usMaintaining student records and progress notesLesson notes, skill assessmentsLegitimate interest — to provide quality, personalised tuitionComplying with legal and tax obligationsFinancial records, booking historyLegal obligation — required by HMRC and other regulatory bodies

Where we rely on legitimate interest, we have carried out a balancing test to ensure our interests do not override your rights and freedoms. You have the right to object to processing based on legitimate interest (see Section 9).

Paid lesson invoices

When enabled for a tutor, our invoice service creates a PDF for a confirmed payment for that tutor’s lesson or purchased lesson block. It can also prepare invoices for previously confirmed payments when we request a historical run. An unpaid booking does not create a paid invoice. Creating an invoice records a payment already received; it does not take another payment.

We use these records to provide evidence of payment, keep accurate accounts, reconcile payments and answer billing queries. Our lawful bases are contract performance when providing the payer with the record of their purchase, and legal obligation where financial records must be retained for accounting and tax purposes. These records are not used for marketing.

The initial service covers Matt Duffy’s own lessons and blocks, invoiced as Wirral Music Factory. It does not give another tutor access to these invoices. Any wider tutor rollout will have its own access controls and clear information about the issuer responsible for the invoice.

5. CHILDREN’S DATA

WMF teaches students of all ages, including children, and we take the protection of children’s personal data very seriously.

Students under 13 — We obtain consent from a parent or guardian before collecting any personal data about a child under 13. A parent or guardian must complete the booking process on the child’s behalf.

Students aged 13–17 — We may collect data directly from students in this age group (for example, during lessons), but we keep parents and guardians informed about the data we hold and how it is used.

Data minimisation — We only collect the minimum personal data necessary to provide tuition safely and effectively. We do not collect more information about child students than we need.

Children named on invoices — where a parent or guardian pays for a child’s lessons, the invoice includes the child’s name and the lesson or block purchased so the payment can be identified. It does not include the child’s date of birth, progress notes, medical information or safeguarding records. A child’s name forming part of an invoice follows the financial-record retention period in Section 8, rather than the shorter period for general children’s records.

Marketing — Children’s data is never used for marketing purposes without explicit parental consent.

ICO Children’s Code — We follow the principles set out in the ICO’s Age Appropriate Design Code (the Children’s Code) when designing and operating services that children are likely to access. This means we default to high-privacy settings, minimise data collection, and do not use children’s data in ways that could be detrimental to their wellbeing.

Data (Use and Access) Act 2025 — We comply with the higher protection duty for children’s data introduced by this legislation, ensuring that the processing of children’s personal data is carried out with particular care and with their best interests as a primary consideration.

6. WHO WE SHARE YOUR DATA WITH

We share your personal data only where it is necessary for the purposes described in this policy, or where we are required to do so by law. We share data with the following parties:

Website hosting and booking services — our Amelia booking system runs within our WordPress website, with booking records stored in our website’s database. Our website hosting and technical service providers may process this data on our behalf to host, maintain and support the booking system. Amelia is a self-hosted plugin, rather than an externally hosted booking platform.
WMF Hub hosting and technical support — our Hub database stores invoice records and PDF copies. Our hosting and authorised technical service providers process this information as needed to operate, maintain and support the Hub.
Google Drive invoice archive — PDF copies are stored in a dedicated folder in WMF’s Google Workspace account, managed by Matt Duffy. Google provides the storage service and processes the files on our behalf under its applicable data-processing terms. The folder is restricted to authorised access and is not publicly shared. The invoice app’s permission is limited to Drive files created by, or explicitly made available to, that app. Customers do not need a Google account for us to keep their invoice.
Payment processors — payments made through our booking system are handled by third-party payment processors (such as Stripe, PayPal or Square), each of which has its own privacy policy and is independently responsible for the payment data they process.
HMRC — we share financial records with HM Revenue & Customs where required by law for tax purposes.

We do not sell your personal data to any third party. We only share data where it is necessary for the purposes described above or where we are legally required to do so.

7. INTERNATIONAL DATA TRANSFERS

Some third-party services used to operate our website, process payments, store invoice archives or deliver communications may process personal data outside the United Kingdom. Using Amelia does not itself mean that booking records are transferred to a US booking platform: those records are stored in our WordPress database. International transfers depend on the hosting and third-party services involved.

Where this happens, we ensure that appropriate safeguards are in place to protect your data, as required by UK GDPR. These safeguards may include:

UK-approved contractual safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission’s Standard Contractual Clauses, where applicable
The service provider’s compliance with recognised data protection frameworks
A UK adequacy decision covering the destination country, where applicable

We will not transfer your personal data to any country or organisation that does not have adequate protections in place.

Google Drive — Google and its subprocessors may store or process invoice files outside the UK, including in the United States. Google’s data-processing terms describe the applicable safeguards. For covered UK-to-US transfers, Google relies on the UK Extension to the EU–US Data Privacy Framework; see its current transfer arrangements. You can contact us at md@wirralmusicfactory.com for information about the safeguards applicable to your records or a copy of them.

8. HOW LONG WE KEEP YOUR DATA

We keep your personal data only for as long as necessary for the purpose it was collected, or as required by law. The list below sets out our standard retention periods.

Active student records: duration of tuition plus 2 years, to manage the relationship and follow-up queries.
Financial and payment records, including invoices: 6 years after the transaction for accounting and tax record-keeping. This includes the payer and learner information contained in an invoice. A longer period may apply where a specific legal requirement or an unresolved dispute requires us to retain the record.
Email marketing data: until you unsubscribe or withdraw consent.
Website analytics data: 26 months.
Enquiry form submissions: 12 months, to follow up and improve our services.
Children’s general tuition records: duration of tuition plus 1 year, then securely deleted. The financial-record period above applies to information that forms part of an invoice.

The invoice retention period applies to both the Hub’s records and PDF copies and the Google Drive archive. WMF manages retention review and deletion across both locations. Stopping lessons, turning off automatic invoicing or disconnecting Drive does not itself delete accounting records or reset their retention period.

Once retention periods expire, personal data is securely deleted or anonymised so that it can no longer be linked to you.

9. YOUR RIGHTS UNDER UK GDPR

You have the following rights in relation to your personal data. These rights apply in certain circumstances and are subject to some exceptions.

Right of access — You can request a copy of the personal data we hold about you. This is known as a Subject Access Request (SAR) and is free of charge.
Right to rectification — You can ask us to correct any personal data that is inaccurate or to complete data that is incomplete.
Right to erasure — You can ask us to delete your personal data in certain circumstances, for example where we no longer need it or where you withdraw consent.
Right to restrict processing — You can ask us to limit how we use your data in certain situations, for example while we investigate a complaint you have made.
Right to data portability — You can request that we provide your data in a structured, commonly used, machine-readable format so that you can transfer it to another service.
Right to object — You can object to processing that is based on our legitimate interest or that is carried out for direct marketing purposes. Where you object to direct marketing, we will stop immediately.
Right to withdraw consent — Where we process your data based on consent (such as marketing emails), you can withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before you withdrew consent.
Rights related to automated decision-making — We do not carry out any automated decision-making or profiling that produces legal effects or similarly significantly affects you.

To exercise any of these rights, please email us at md@wirralmusicfactory.com. We will respond to your request within one calendar month. No fee is charged for reasonable requests. If a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse to act on it, but we will always explain our reasons.

Invoice queries and corrections — contact us using the email address above if you need a copy of an invoice or want to correct its details. Issued PDFs are retained as accounting records, so changing a billing address affects future invoices rather than silently rewriting an earlier document. We will review any correction, access or deletion request, address inaccurate information and explain any record we must retain for a legal reason.

10. MARKETING COMMUNICATIONS

We send marketing emails — such as newsletters, promotions, and updates about new services — only to people who have given us their explicit consent to do so, in compliance with the Privacy and Electronic Communications Regulations (PECR).

Every marketing email we send contains a clear unsubscribe link. You can also opt out at any time by emailing md@wirralmusicfactory.com and asking to be removed from our mailing list.

Our marketing emails may contain small tracking pixels that help us understand whether emails are being opened and which links are being clicked. This information is used solely to improve the relevance and quality of our communications.

Opting out of marketing will not affect essential service communications about your lessons, such as booking confirmations, schedule changes, or cancellations. Those are sent under our contractual obligation to you and will continue as long as you are an active student.

11. COOKIES

Cookies are small text files placed on your device when you visit a website. They help the site work properly, remember your preferences, and understand how visitors use the site.

Our website uses the following types of cookies:

Essential cookies — These are necessary for the website to function correctly (for example, keeping you logged in or remembering items in a booking form). They cannot be switched off.

Analytics cookies — We use Google Analytics to understand how visitors interact with our website, such as which pages are most popular and how long people spend on the site. Google Analytics uses cookies to collect this data. IP addresses are anonymised so that individual visitors cannot be personally identified through analytics data alone.

Third-party cookies — Some cookies may be set by third-party services embedded in our website, such as Google Maps. These cookies are governed by the privacy policies of the respective third parties. Our booking form uses Amelia within our WordPress website.

Non-essential cookies (analytics and third-party cookies) are only placed with your consent. You can manage your cookie preferences through your browser settings at any time. Most browsers allow you to block or delete cookies — please refer to your browser’s help documentation for instructions. Blocking certain cookies may affect the functionality of our website.

12. WEBSITE CHAT ASSISTANT (MAESTRO)

Our website provides an automated chat assistant called Maestro to answer questions and help you find information.

What it does — Maestro answers general questions about our lessons and services, and can tell you the date and time of your next lesson if you ask.
Looking up your lesson — Before sharing any booking details, Maestro asks for the email address you booked with and the instrument your lessons are for. It only confirms a booking when both the email and the instrument match a lesson on our system, and it only shares limited details: the date, time, lesson type, and your tutor’s first name. It will not reveal any other personal information, anyone else’s booking, or anything about your account beyond your next lesson.
Please use your own details — Because an email address alone is a weak identifier, the instrument acts as a second check. Only enter information that belongs to you.
Messages and logging — Conversations with Maestro are processed by trusted third-party AI and automation providers on our behalf, and may be logged so that we can operate the service, follow up on requests, and improve it. Some of these providers process data outside the UK; where that happens, we rely on the safeguards described in Section 7. Our lawful basis is our legitimate interest in answering enquiries and helping you manage your bookings.
Security check — To protect the chat from automated abuse, we use Cloudflare Turnstile, an invisible check that verifies you are a real person before messages are processed. Turnstile assesses technical signals from your browser and device and does not identify you personally. Its use is covered by the Cloudflare Turnstile Privacy Addendum.
Prefer not to use it? — You can always contact us directly at help@wirralmusicfactory.com instead.

13. DATA SECURITY

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These measures include:

Secure, password-protected systems for storing personal data
Encrypted email communications where appropriate
Limiting access to personal data to only those individuals who need it to carry out their role
Regular review of our data handling practices and security measures

Invoice access — the Hub checks the signed-in account and tutor before allowing access to invoice records. Transfers to Google Drive use encrypted connections, and the credentials used for the connection are encrypted in the Hub. The archive uses restricted folder access; invoices are not published on the website.

In the event of a personal data breach that is likely to pose a risk to your rights and freedoms, we will notify the Information Commissioner’s Office (ICO) within 72 hours and inform affected individuals without undue delay, as required by UK GDPR.

14. HOW TO COMPLAIN

If you are unhappy with how we have handled your personal data, please contact us in the first instance so that we can try to resolve the issue:

Email: md@wirralmusicfactory.com
Data Controller: Matt Duffy

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s independent authority for data protection:

Website: https://ico.org.uk
Telephone: 0303 123 1113
Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

15. CHANGES TO THIS POLICY

We may update this privacy policy from time to time to reflect changes in our practices, the services we offer, or legal requirements. Where we make significant changes, we will notify you by email or by placing a prominent notice on our website.

We encourage you to check back periodically to stay informed about how we are protecting your data. The “Last updated” date at the top of this policy will always reflect when the most recent changes were made.