This privacy policy explains how I collect, use and protect personal information when you visit this website, use the invitation-only student portal or associated downloadable student app, or contact me about piano or violin lessons. It applies under UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Who I am
The data controller for this website is Liam Hindson, a sole trader providing private piano and violin tuition from a home studio in Crystal Palace, London. I also offer online lessons throughout the UK.
This website is for prospective and existing students and their parents or guardians. It includes lesson information, an enquiry form, reviews, an introduction video on the homepage, an embedded Google Map on the Contact page, and an invitation-only student portal and app for managing tuition.
What information I collect
Enquiry form. If you use the contact or enquiry form on the homepage or Contact page, I collect:
- name
- email address
- telephone number, if you provide it
- instrument, if you select one
- student age, if you provide it
- lesson format, if you select one
- preferred lesson time, if you select one
- your message
The form is submitted without reloading the page. To reduce spam, it uses a hidden honeypot field, a minimum timing check, a security token, and a limit of three submissions per hour from the same connection. Your IP address is temporarily processed and stored in hashed form in WordPress for this rate limit only.
Student accounts and records. Student and parent or guardian accounts are created by invitation only. When I create and manage an account, I may collect:
- name
- email address
- password, stored securely by WordPress using industry-standard hashing
- whether the account belongs to a student, parent or guardian
- account status and the information needed to manage access
- the student’s instrument, lesson format and usual lesson duration
- lesson dates, times, attendance and lesson history
- bookings, rearrangements, cancellations and availability preferences
- homework, teaching notes made available through the portal and related audio files
- invoices, amounts, payment status and the lessons included in each invoice
- text messages and any voice recordings, videos or other files sent through the portal or app
Invited account holders set their own password using a time-limited link. Security tokens and rate limits are used for sign-in and password-reset requests. A hashed version of your IP address may be stored temporarily for these limits only.
When you sign in, WordPress sets secure session cookies so you can access your account area. These cookies are functional, not used for advertising or analytics.
Messages and media. The portal and app allow account holders to send me text, voice and video messages. These messages, their timestamps and attached files are stored on the website’s hosting. If you choose to record or upload media, the app may ask for permission to use your device’s microphone, camera, photos or files. Access is used only when you choose to record or select something to send.
Live online lessons. For scheduled online lessons, the portal and app provide a live classroom. From 10 minutes before the lesson until it ends, the linked student or parent or guardian, and I, can join a private video room for that lesson only. Joining a live lesson uses the device camera and microphone for the duration of the call. The classroom also supports a shared whiteboard, screen sharing, and optional in-call chat. Live lesson media is processed by Twilio so that the call can take place. Lesson recordings may be stored where recording is enabled for teaching and safeguarding, separately from video messages sent between lessons.
Bookings and availability alerts. Account holders can view lesson dates and use the portal or app to book, rearrange or cancel lessons. They may also provide weekly availability so the system can match them with suitable vacancies, and a holiday lesson preference (including days they are around during school holidays) so they can be notified of matching holiday slots. If push notifications are enabled, the system stores a technical push-subscription identifier and uses it to notify the account holder when a matching lesson time becomes available. Push notifications can be disabled through the app, browser or device settings.
Other contact. If you email, call or message me through WhatsApp, I receive the information you choose to send.
Public website use. Visitors cannot leave comments or upload files through the public part of the website. Reviews on the site are published by me from existing feedback; visitors cannot submit new reviews through the website.
How I use your information
I use personal information only for legitimate purposes connected with my teaching practice:
- responding to enquiries
- arranging lessons
- communicating with prospective and existing students, and with parents or guardians where relevant
- providing and securing student and parent or guardian accounts
- recording lesson history, homework and student progress
- managing bookings, rearrangements, cancellations and available lesson times
- matching availability preferences with vacancies and sending requested notifications
- providing invoices and maintaining payment and accounting records
- providing live online lessons through the student portal or app
- meeting legal and accounting obligations as a sole trader
I do not sell personal information. I do not share personal information with third parties for their own marketing purposes. I do not use your information for automated decision-making or profiling.
Lawful basis for processing
For enquiries, I usually process information on the basis of legitimate interests — responding to requests about my teaching services. Where you ask me to take steps before tuition begins, I may also rely on steps taken at your request. For existing students, lesson administration, homework, communication, bookings and invoicing are generally processed for the performance of a contract. I rely on legitimate interests where necessary to operate and secure the portal, maintain appropriate teaching records and manage my timetable. Where required by tax or other legal rules, I process information to comply with a legal obligation. You may object to processing based on legitimate interests.
How your information is stored
Enquiry form. Submissions are sent to me by email using WordPress. They are not saved in a separate enquiry database on this website. Your enquiry will exist in my email inbox and in the systems used to deliver or store email.
Spam protection. The website temporarily stores a technical submission count linked to a hashed version of your IP address in WordPress. This is used only for rate limiting and is deleted automatically after a limited period.
Portal records and media. Student profiles, lesson history, availability, bookings, homework, invoices and messages are stored in the website’s WordPress database or protected file storage provided by the website host. Access is restricted to me and the student’s linked account holder. For a child, the linked account is managed by their parent or guardian.
Google Calendar. I connect the portal to my selected teaching calendar using Google’s secure authorisation process. The integration reads relevant event titles, dates, times and status so that I can manage availability. It does not import event descriptions or attendee details. When a lesson is booked, rearranged or cancelled through the website or app, the corresponding Google Calendar event may be created or updated with the student’s name and lesson details. Google therefore processes this information as part of providing its calendar service.
Push notifications. If you enable vacancy notifications, a technical subscription identifier and your notification preferences are stored so a message can be routed through the push notification service used by your browser or device. Notifications are used for lesson availability and booking-related updates, not advertising.
Payments. Invoices and payment status may be displayed in the portal, but payments take place outside the website and app. I do not collect or store payment-card details through the portal.
How long I keep your information
I keep personal information only for as long as needed for the purpose for which it was collected.
Enquiries that do not lead to lessons are generally kept for a reasonable period to respond and follow up, then deleted or archived.
Lesson, homework, availability and message records are normally retained for the duration of tuition and for up to 12 months after tuition ends. The linked portal account may then be disabled and its associated media deleted, unless information needs to be retained for a dispute, safeguarding concern or other legal reason.
Invoices and other financial records may be retained for up to six years to meet accounting and tax obligations.
Sharing your information
I do not sell personal information or share it with third parties for their own marketing. Information is shared only where necessary with service providers that operate the website, store portal data and media, deliver email or push notifications, provide the Google Calendar integration, or provide live video for online lessons. Some providers may process information outside the UK; where that applies, I rely on appropriate safeguards required by UK data protection law.
Cookies
Cookies are small text files stored on your device when you visit a website.
This website does not set analytics or advertising cookies, and I do not use Google Analytics or similar tools. The theme does not set cookies for ordinary visitors.
If you sign in to a student account, WordPress sets secure authentication cookies required for your session.
The downloadable student app may store functional information on your device so that you can remain signed in, use portal features and receive notifications. It does not use this information for advertising.
If you log into the website administration area, WordPress may set additional session cookies. The website loads typefaces remotely from Google Fonts; your browser connects to Google’s servers when pages load, which may involve your IP address being processed by Google. When you view the embedded Google Map on the Contact page, Google may set cookies and receive technical information such as your IP address and device data.
Third-party services
I mention only third-party services used by this website.
WordPress. Content management for pages, reviews and site content.
Website hosting. The hosting provider stores and delivers the website.
Email delivery. Enquiry emails sent through WordPress are delivered by the email service configured for the website.
Push notification services. If you opt into vacancy alerts, the notification service used by your browser or device processes a technical subscription identifier so it can deliver the alert.
ImageKit. Streams the homepage introduction video from ImageKit’s servers.
Google Fonts. Typefaces are loaded remotely from Google’s servers, not hosted on this website.
Google Maps. The Contact page includes an interactive Google Map of my teaching studio. When the map loads, Google may receive your IP address and other technical information under Google’s privacy policy.
Google Calendar. Synchronises my teaching calendar with portal bookings and availability. Google may receive the student’s name, lesson details and timing when calendar events are created or updated.
Twilio. Provides the live video classroom for scheduled online lessons, including camera and microphone streams, optional in-call chat, and any lesson recording that is stored. Twilio acts as a processor for this purpose. Only the linked student or parent or guardian and I can join that lesson’s room.
WhatsApp. Contact links and a floating contact button open WhatsApp, operated by Meta, under its own terms and privacy policy.
Children’s privacy
I teach children as well as adults. Enquiries and portal accounts for children are managed by a parent or guardian. The parent or guardian can access the child’s lesson schedule, homework, invoices, bookings, portal messages and, for online lessons, the live classroom. I use information about a child only to provide and administer their tuition, communicate with their parent or guardian, maintain appropriate teaching records and meet safeguarding or legal responsibilities. If you believe a child’s information has been provided or used inappropriately, please contact me and I will review it promptly.
Your rights
Under UK data protection law, you have rights including access, correction, erasure, restriction, portability in certain circumstances, and the right to object to processing based on legitimate interests.
You may complain to the Information Commissioner’s Office (ICO) at ico.org.uk. I would appreciate the chance to address your concern first. To exercise your rights, contact me below; I aim to respond within one month.
Contact
If you have questions about this privacy policy or how your personal information is handled, please contact me through the contact page on this website, or using the email address or telephone number shown on the site.