Swing Dance Cumbria Privacy, Data Protection and Data Complaints Policy
Approved by: Swing Dance Cumbria Committee
Date approved: 18 June 2026
Review date: 18 June 2027, or sooner if our activities, systems or legal duties change
Contact:swingdancecumbria@gmail.com
1. Purpose of this policy
Swing Dance Cumbria is a community-led organisation that runs social dance classes, workshops, socials and events across Cumbria.
We collect and use limited personal information so that we can run classes and events safely, communicate with members and participants, manage bookings and payments, support volunteers, meet safeguarding responsibilities and comply with our legal duties.
This policy explains:
what personal information we collect;
why we collect it;
how we use, store and protect it;
who we may share it with;
how long we keep it;
what rights people have over their personal information;
how people can make a data protection complaint.
We aim to handle personal information fairly, lawfully, transparently and respectfully.
This policy is written to reflect the UK General Data Protection Regulation, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations, and the Data (Use and Access) Act 2025.
2. Who we are
Swing Dance Cumbria is an unincorporated community group.
For data protection purposes, Swing Dance Cumbria is the data controller for the personal information we collect and use.
Swing Dance Cumbria is registered with the Information Commissioner’s Office as a small not-for-profit organisation.
Our appointed Data Leads are:
Ella Smith
Chris January
People can contact the Data Leads by emailing:
We have not appointed a Data Protection Officer because we are not required to do so.
3. Who this policy applies to
This policy applies to personal information relating to:
people who attend our classes, workshops, socials or events;
people who book classes, workshops or events online;
people who pay at the welcome desk;
people who subscribe to our mailing list;
people who contact us by email, website form, social media or in person;
committee members, teachers, DJs, volunteers and helpers;
guest teachers, musicians, performers and event partners;
parents or guardians of under-18s;
anyone involved in a safeguarding, welfare, accident or incident matter.
This policy also applies to committee members, teachers, volunteers and anyone else who handles personal information on behalf of Swing Dance Cumbria.
4. Data protection principles
We follow the main data protection principles. This means we will:
use personal information lawfully, fairly and transparently;
collect it only for clear and legitimate purposes;
collect only what we reasonably need;
keep it accurate and update it where needed;
keep it only for as long as necessary;
protect it against unauthorised access, loss or misuse;
be able to show how we meet our data protection responsibilities.
5. What personal information we collect
We only collect information that is reasonably needed for our activities.
Depending on how someone interacts with Swing Dance Cumbria, we may collect:
Contact and identity information
first and last name;
email address;
phone number, where needed;
emergency contact details, where needed;
parent or guardian contact details for under-18s.
Age-related information
whether someone is over or under 18;
year of birth for under-18s, where needed;
optional birthday information, such as day and month, if someone chooses to share this for birthday jam celebrations.
We do not need someone’s full date of birth unless there is a specific safeguarding, legal or safety reason.
Class, booking and event information
classes, workshops or events booked;
attendance information;
payment status;
concession ticket status, where relevant;
loyalty card information, where relevant;
access or support needs that someone chooses to tell us about.
Payment and financial information
We may process limited payment information, such as:
amount paid;
date of payment;
payment method;
booking or transaction reference;
refund details, where relevant.
Online payments are handled through our booking and payment service providers. Swing Dance Cumbria does not intentionally store full card numbers.
Mailing list and communications information
If someone joins our mailing list or contacts us, we may collect:
email address;
first and last name;
mailing preferences;
consent records;
unsubscribe records;
records of messages sent to or received from us;
email engagement information, such as opens or clicks, where our mailing platform provides this and where this is enabled.
Photos, video and promotional material
We may collect photographs, video recordings or audio recordings at classes, socials, workshops or events.
This may include:
general group or crowd images;
images or video of people dancing;
images or video used for promotion, teaching, archives or social media;
consent or opt-out records.
We will take extra care with images of under-18s and will not generally publish or otherwise use any identifiable images of under-18s unless explicit consent has been granted from the individual and their parent/legal guardian.
Volunteer, teacher and committee information
For committee members, teachers, DJs, volunteers and helpers, we may collect:
contact details;
role information;
availability;
teaching, volunteering or event involvement;
payment or expense records;
emergency contact details, where appropriate;
relevant training, safeguarding or insurance information.
Safeguarding, welfare, accidents and incidents
Where necessary, we may collect information about:
welfare concerns;
safeguarding concerns;
accidents, injuries or incidents;
emergency contact details;
health or access information voluntarily shared with us;
steps taken to respond to a concern or incident.
This information may include special category data, such as health information. We only collect this where necessary and handle it with particular care.
6. How we collect personal information
We may collect personal information when someone:
signs up to our mailing list;
books a class, workshop or event;
attends a class, workshop, social or event;
pays online or at the welcome desk;
completes a form;
contacts us by email, website form, social media or in person;
volunteers, teaches, DJs or joins the committee;
appears in photographs or video at our activities;
raises a safeguarding, welfare, accident or incident concern;
makes a data protection request or complaint.
Most information is collected directly from the person it relates to. Sometimes we may receive information from a parent, guardian, carer, friend, committee member, teacher, volunteer, venue, emergency service, safeguarding body or event partner.
7. Why we use personal information and our lawful bases
We must have a lawful basis for using personal information. The lawful basis depends on what we are doing and why.
Mailing list and newsletters
We use mailing list details to send updates about Swing Dance Cumbria classes, workshops, socials, events and related news.
Lawful basis: consent.
People can unsubscribe at any time by using the unsubscribe link in our emails or by contacting us.
Responding to enquiries
We use contact details and message content to respond to questions, feedback, requests and general communications.
Lawful basis: legitimate interests.
Our legitimate interest is being able to respond to people who contact us and manage the group properly.
Bookings, attendance and class administration
We use booking and attendance information to manage classes, workshops and events, check people in, process attendance, manage capacity, handle waiting lists, issue refunds and keep basic records.
Lawful basis: contract, where someone books or pays to attend; legitimate interests, where we need to manage attendance, safety and administration.
Payments, accounts and financial records
We use payment and finance information to process payments, refunds, expenses, invoices, accounts and financial records.
Lawful basis: contract and legal obligation.
Safety, welfare and emergency contact
We may use emergency contact details, welfare information or health/access information to keep people safe, respond to incidents and provide reasonable support during our activities.
Lawful basis: legitimate interests, vital interests, legal obligation, and, where special category data is involved, explicit consent, vital interests or safeguarding-related public interest conditions where applicable.
Safeguarding
We may use personal information to prevent harm, respond to safeguarding concerns, support children or vulnerable adults, contact parents or guardians, seek advice, refer concerns and meet safeguarding responsibilities.
Lawful basis: legal obligation, legitimate interests, vital interests, and substantial public interest where applicable.
Photos, video and promotion
We may use images or video to promote Swing Dance Cumbria, record community activity, share event highlights, support teaching and maintain an archive.
For general crowd or event images, we may rely on legitimate interests where the use is reasonable, expected and not intrusive.
For close-up promotional images, interviews, testimonials or identifiable images of under-18s, we will explicitly seek consent from both the individual and their parent/legal guardian.
Lawful basis: legitimate interests or consent, depending on the context.
People can tell us if they do not want to be photographed or filmed. We will respect this wherever reasonably possible. People can also ask us to remove images from our own website, mailing list or social media accounts. We may not be able to remove images already printed, shared by others or published by third-party platforms outside our control, but we will take reasonable steps where we can.
Volunteers, teachers, DJs and committee members
We use personal information to manage volunteer roles, teaching arrangements, rotas, expenses, communication, insurance, safeguarding and committee administration.
Lawful basis: legitimate interests, contract where relevant, and legal obligation where records are needed for accounting, safeguarding or insurance.
Social media and online promotion
We use social media to share information about classes, events and community activity.
If someone contacts us through social media, we may use their message and profile information to respond. Social media platforms also process personal information under their own policies.
We do not sell personal information.
We do not use mailing list details for customised online advertising unless a person has been clearly told what this means and has actively chosen that option.
If we decide to use custom audience advertising, retargeting tools, tracking pixels or similar tools, we will review the data protection position first, update this policy, and ask for any consent required before using personal information in that way.
Lawful basis: legitimate interests or consent, depending on the activity.
Legal, insurance and regulatory matters
We may use personal information where necessary to meet legal duties, maintain insurance, respond to official requests, handle disputes, report incidents or cooperate with regulators.
Lawful basis: legal obligation and legitimate interests.
8. Special category data
Special category data includes information about health, disability, racial or ethnic origin, religion, sexual orientation and other sensitive matters.
Swing Dance Cumbria does not routinely collect this type of information.
However, people may voluntarily tell us about health conditions, disabilities, access needs, injuries, safeguarding concerns or welfare issues. We may also record relevant information if there is an accident, incident or safeguarding concern.
Where we process special category data, we will only do so where necessary and where we have an additional lawful condition, such as:
explicit consent;
protecting vital interests;
safeguarding children or vulnerable adults;
establishing, exercising or defending legal claims;
meeting legal obligations.
We will restrict access to this information to people who genuinely need it.
9. Under-18s
Swing Dance Cumbria welcomes young people where our activities are suitable for them.
Where someone is under 18, we may ask for:
confirmation that they are under 18;
year of birth;
parent or guardian contact details;
relevant emergency contact details;
information needed for safeguarding or safety.
We will use this information to help manage participation safely, communicate appropriately, and meet safeguarding responsibilities.
Children and young people have rights over their personal information. Where appropriate, we will explain things in clear language and take account of the young person’s age, understanding and best interests.
A parent or guardian may make a request or complaint on behalf of an under-18. We may need to check that they have authority to act on the young person’s behalf.
We will take particular care before publishing identifiable images or video of under-18s.
10. Direct marketing and mailing list
We only send marketing emails to people who have agreed to receive them, unless another lawful route clearly applies.
Our newsletters may include information about:
weekly classes;
workshops;
socials;
events;
guest teachers;
community news;
relevant swing dance opportunities.
People can unsubscribe at any time by:
clicking the unsubscribe link in one of our emails; or
emailing swingdancecumbria@gmail.com.
If someone unsubscribes, we may keep a minimal suppression record so that we do not accidentally email them again through the same mailing list.
We do not sell mailing list details.
We do not share mailing list details with other organisations for their own marketing.
11. Cookies, website tools and similar technologies
Our website may use cookies and similar storage or access technologies.
These may include:
essential cookies needed for the website to work;
security cookies;
booking system cookies;
payment processing cookies;
cookies used by embedded tools or linked third-party services;
analytics cookies, if enabled;
marketing or advertising cookies, only if enabled and only where appropriate consent has been obtained.
We will provide clear information about cookies and similar technologies used on our website, including what they are for and whether third parties are involved.
We will not intentionally set non-essential cookies or similar technologies that require consent unless people have had a genuine choice to accept or reject them.
Where our website links to external platforms, such as Facebook, Instagram, YouTube, Mailchimp or a booking/payment platform, those organisations may use their own cookies and process personal information under their own privacy policies.
We are not responsible for the privacy practices of external websites, but we will take reasonable care when choosing services that we use for Swing Dance Cumbria.
12. Who we share personal information with
We do not sell personal information.
We do not share personal information for unrelated third-party marketing.
We may share personal information only where necessary and appropriate, including with:
authorised Swing Dance Cumbria committee members, teachers, volunteers or helpers;
Mailchimp or another mailing list provider;
Squarespace or another website provider;
Squarespace Scheduling, Acuity Scheduling or another booking provider;
payment processors used for online payments;
Google, Gmail, Google Drive or similar services used for email, files or administration;
social media platforms where people interact with our pages or content;
venues, guest teachers, musicians or event partners where necessary for event administration;
insurers, accountants, banks or legal advisers where necessary;
emergency services, safeguarding bodies, local authorities or regulators where necessary;
the Information Commissioner’s Office, where required.
We expect service providers that process personal information for us to handle it securely and lawfully.
Where we use a third-party service provider, that provider may act as our processor, an independent controller, or in some cases a joint controller. This depends on the service and how it is used.
13. International transfers
Some of the services we use, such as mailing list, website, booking, payment, email, file storage or social media platforms, may process personal information outside the UK.
Where this happens, we will take reasonable steps to make sure appropriate safeguards are in place, such as UK adequacy regulations, standard contractual clauses, the UK International Data Transfer Agreement, the UK Addendum to EU standard contractual clauses, or another lawful transfer mechanism.
14. How we protect personal information
We take reasonable steps to protect personal information.
These include:
limiting access to people who need it for their role;
using password-protected systems;
using two-factor authentication where available and practical;
keeping paper records secure;
avoiding unnecessary copies;
not sharing personal information through personal social media accounts;
taking care when sending emails to groups;
deleting or archiving records when they are no longer needed;
restricting access to safeguarding, welfare and incident records;
making sure committee members and volunteers know where to direct data protection concerns.
Committee members, teachers and volunteers must not use personal information for their own purposes.
Personal information should not be downloaded, copied, forwarded or stored outside agreed Swing Dance Cumbria systems unless there is a clear reason and appropriate protection is in place.
15. How long we keep personal information
We keep personal information only for as long as necessary.
The exact period depends on the type of information and why we collected it and the retention period
Mailing list records - Until the person unsubscribes or asks to be removed. We may keep a minimal suppression record to avoid contacting them again.
General enquiries -Usually up to 12 months after the enquiry is resolved, unless it becomes part of a booking, complaint, safeguarding, finance or legal record.
Booking records- Usually up to 3 years after the relevant class, workshop or event, unless needed for finance, insurance, complaint or legal reasons.
Payment and accounting records - Usually 6 years after the end of the relevant financial year.
Drop-in attendance and welcome desk records - Usually up to 12 months, unless needed for finance, safeguarding, insurance, complaint or legal reasons.
Emergency contact details- Only for the event, class block or period for which they are needed, unless linked to an incident.
Accident or incident records - Usually at least 3 years, or longer where safeguarding, insurance or legal reasons apply.
Safeguarding records- Kept securely and only for as long as necessary, following safeguarding requirements and the nature of the concern.
Volunteer, teacher and committee records- For the period of involvement, then usually up to 6 years where needed for finance, insurance, safeguarding or legal reasons.
Photos and videos- Kept while they remain relevant for community, archive or promotional purposes. We will review published images periodically and consider removal requests.
Data protection requests and complaints- Usually 6 years after closure, so we can show how we handled the matter.
We may keep anonymised information for longer where individuals can no longer be identified.
16. Data breaches
A data breach means a security incident that leads to personal information being lost, destroyed, altered, disclosed without permission, or accessed by someone who should not have access.
Examples include:
sending an email containing personal information to the wrong person;
losing a paper register;
unauthorised access to a mailing list, booking system or email account;
accidental publication of private information;
loss or theft of a device containing personal information.
Any actual or suspected data breach must be reported immediately to the Data Leads at:
The Data Leads will assess the breach, record what happened, take steps to reduce harm, and decide whether the breach needs to be reported to the Information Commissioner’s Office.
Where a breach is likely to result in a risk to people’s rights and freedoms, we will report it to the ICO within 72 hours of becoming aware of it, unless an exception applies.
Where a breach is likely to result in a high risk to individuals, we will also tell the affected individuals without undue delay.
17. People’s rights
People have rights over their personal information.
Depending on the circumstances, these may include the right to:
be told how we use their personal information;
access the personal information we hold about them;
ask us to correct inaccurate information;
ask us to delete information;
ask us to restrict how we use information;
object to how we use information;
withdraw consent, where we rely on consent;
ask for a copy of information in a portable format, where this applies;
object to direct marketing;
complain to us;
complain to the Information Commissioner’s Office.
These rights are not always absolute. Sometimes we may need to keep or use information because of legal, safeguarding, insurance, financial or legitimate organisational reasons.
To make a request, email:
We will usually respond within one month.
We may ask for proof of identity if we need to confirm who is making the request. We will not ask for more identification than necessary.
If a request is unclear, we may ask for clarification. If the law allows us to pause the response period while we wait for clarification or identification, we may do so.
For subject access requests, we will carry out searches that are reasonable and proportionate.
18. Data protection complaints
People have the right to complain to Swing Dance Cumbria if they are concerned about how we have handled their personal information.
A data protection complaint may be about, for example:
how we collected personal information;
how we used personal information;
how we stored or protected personal information;
how long we kept personal information;
whether personal information is accurate;
how we responded to a request about personal information;
a possible data breach;
use of photographs, video, email marketing or online systems.
A person does not need to use legal language or quote data protection law to make a complaint.
How to complain
Complaints can be sent to:
It helps if the email subject line says:
Data protection complaint
but this is not required.
A complaint should include, where possible:
who is making the complaint;
what the complaint is about;
what personal information is involved;
when the issue happened;
what outcome the person is looking for;
any relevant evidence, such as emails, screenshots or booking details.
People can also raise a complaint in person, through social media, by website contact form or through any committee member, teacher or volunteer. However a complaint is received, it must be passed to the Data Leads promptly.
We will avoid discussing personal or sensitive details publicly on social media. If someone complains through social media, we may ask them to move the conversation to email or another private channel.
Complaints made on behalf of someone else
Someone may complain on behalf of another person, such as a child, family member, friend, advocate or representative.
We may need evidence that the person has authority to act on behalf of the individual concerned. This might include written permission, evidence of parental responsibility, power of attorney, or another appropriate form of authority.
We will not disclose personal information to someone else unless we are satisfied they are entitled to receive it.
Complaints from children and young people
Children and young people can make data protection complaints.
We will respond in clear language and take account of the young person’s age, understanding and best interests.
If a complaint suggests an urgent welfare or safeguarding concern, we will consider this quickly and take appropriate action.
What happens after a complaint is made
When we receive a data protection complaint, we will:
record the complaint;
acknowledge it within 30 days of receiving it;
check whether we need any further information or proof of identity;
investigate without undue delay;
take appropriate steps to understand what happened;
keep the complainant informed of progress where the matter cannot be resolved quickly;
explain the outcome without undue delay;
tell the complainant what action we have taken or will take, where appropriate.
If we uphold a complaint, we may take steps such as correcting information, deleting information, changing access permissions, improving our process, updating this policy, giving an apology, or taking other reasonable action.
If we do not uphold a complaint, we will explain why.
Complaining to the ICO
People can complain to the Information Commissioner’s Office if they are unhappy with how we handle their personal information or how we respond to a complaint.
The ICO website is:
The ICO helpline is:
0303 123 1113
We would usually encourage people to contact us first so that we have a chance to put things right.
19. Automated decision-making and profiling
Swing Dance Cumbria does not use personal information to make decisions about people solely by automated means.
We do not carry out profiling that has legal or similarly significant effects on individuals.
Some third-party platforms, such as mailing list, social media, advertising, website or booking platforms, may use automated tools as part of their own services. Their own privacy policies explain how they use personal information.
20. Accuracy
We try to keep personal information accurate and up to date.
People can ask us to correct their information by emailing:
21. Changes to this policy
We will review this policy at least once a year, or sooner if:
data protection law changes;
our activities change;
we start using a new booking, payment, marketing or website platform;
we introduce new uses of personal information;
we identify a problem with the current policy.
If we make significant changes, we will take reasonable steps to draw attention to the updated policy, such as updating the website and, where appropriate, telling mailing list subscribers.
22. Internal responsibility
The Data Leads oversee this policy, but everyone who handles personal information for Swing Dance Cumbria has a responsibility to protect it.
Committee members, teachers, DJs, volunteers and helpers must:
collect only the information they need;
use it only for Swing Dance Cumbria purposes;
keep it secure;
avoid unnecessary sharing;
report any data breach or suspected breach promptly;
pass any data protection request or complaint to the Data Leads as soon as possible.
Failure to follow this policy may result in access to personal information being removed and may be treated as a serious governance matter by the committee.