Franchisee Privacy Notice
MONKEY MUSIC OXFORD – PRIVACY NOTICE
1. IMPORTANT NOTICE
This is the Privacy Notice of Louise Grace (UK) Limited trading as Monkey Music Oxford (Company Number 08050563) whose registered office is at The Old White Hart, Oxford Road, Stokenchurch, High Wycombe, Bucks HP14 3SX (referred to in this Privacy Notice as “we”, “us” or “our”) and sets out how we collect and processes your personal data.
We are a franchisee of Monkey Music Limited (registered number 03155505) and operate the Monkey Music business under licence from Monkey Music Limited. Where applicable in this Privacy Notice references to ‘Monkey Music’ include Monkey Music Limited and us.
This Privacy Notice also provides certain information that is legally required and lists your rights in relation to your personal data. Please read this Privacy Notice to understand how we may use your personal data.
This Privacy Notice relates to personal data identifying “you” meaning any of our customers and their children or our suppliers or individuals who browse our website and other individuals outside our organisation with whom we interact. We refer to this information throughout this Privacy Notice as “personal data” and paragraph 3 sets out further detail of what this includes.
We process your personal data subject to UK General Data Protection Regulation (“UK GDPR”) (collectively referred to as “Data Protection Legislation”). Monkey Music takes measures to ensure that data is processed in accordance with Data Protection Legislation.
This Privacy Notice may vary from time to time so please check it regularly. This Privacy Notice was last updated on 10th November 2025 to include amongst other things updated information on how Monkey Music collect and use your personal data for marketing purposes and which service providers we contract with for the purposes of hosting webservices and providing you with direct marketing.
2. HOW TO CONTACT US
This Privacy Notice applies where we are a controller in respect of your personal data – this is where we decide how and why your personal data is processed.
If you wish to:
• correct your personal data held by us,
• opt out at any time from receiving marketing communications from us,
• alter your marketing preferences,
• contact us in connection with our use or processing of your personal data,
• gain access to your personal data, or
• amend your consent preferences
you can do so by emailing us at oxford@monkeymusic.co.uk
Please note that you can also amend your consent preferences in the Parent Zone if you have registered and created an account on the Monkey Music website.
3. THE TYPES OF PERSONAL DATA WE COLLECT ON YOU
We may collect, use, store, share and transfer the following types of personal data about you:
- Individual Data: this includes personal data which relates to your identity (and that of your child if applicable), such as first name, middle name, last name, username or similar identifier, title, date of birth and gender and your contact details such as; your billing address, delivery address, email address and telephone numbers that you provide to us in person, via the Monkey Music website or by telephone including the details you supply when establishing a profile on the Monkey Music website (including health-related personal data);
- Account and Profile Data: this includes personal data which relates to your account or profile on the Monkey Music website or app, such as your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses;
- Advertising Data: this includes personal data which relates to your advertising preferences, such as information about your preferences in receiving marketing materials from us and the third parties we work with and your communication preferences;
- Audio and Visual Data: this includes personal data which is gathered using Monkey Music CCTV or other recording systems in the form of images, video footage and sound recordings that is taken at any venue where the Monkey Music activity is carried out or for promotional purposes;
- Health Data: this includes personal data which is gathered for health and safety purposes including any accident report or claim log or any information you provide about allergies or other medical conditions during the booking process or in one of our locations;
- Economic and Financial Data: this includes personal data which relates to your finances, such as your bank account and payment card details and information which we collect from you for the purposes of the prevention of fraud;
- Sales Data: this includes personal data which relates to the transactions you have conducted with Monkey Music, such as details about payments to and from you, details of subscriptions to the Monkey Music Club or Monkey Music publications;
- Information Technology Data: this includes personal data which relates to your use of the Monkey Music website, such as your internet protocol (IP) address, login data, traffic data, weblogs and other communication data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access the Monkey Music website; personal data gathered using cookies; and
- personal data you provide when applying for a job advertised or to submit a speculative job application and/or your CV.
We may also create personal data about you if you contact us by telephone to make a complaint, for example about our services or goods, then we may make a written record of key details of the conversation so that steps can be taken to address the complaint.
Monkey Music also obtains and uses certain aggregated data such as statistical or demographic data for any purpose (“Aggregated Data”). Aggregated Data may be derived from your personal data but does not directly or indirectly reveal your identity. For example, your Information Technology Data may be aggregated to calculate the percentage of users accessing a specific feature on the Monkey Music website. However, if Monkey Music re-combines or re-connects Aggregated Data with your personal data so that it can directly or indirectly identify you, then this combined data will be treated as personal data which will be used in accordance with this Privacy Notice.
In addition, we may obtain certain special categories of your data (“Special Categories of Data”), and this Privacy Notice specifically sets out how these types of personal data may be processed. The Special Categories of Data are: (i) personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership; and (ii) the processing of genetic data, biometric data for the purposes of uniquely identifying a natural person or data concerning health.
We may also collect information about ongoing screening and criminal record and history checks.
4. THE SOURCES FROM WHICH WE OBTAIN YOUR PERSONAL DATA
Your personal data may be obtained from the following sources:
Directly from you, either in person (at our venue or otherwise), via an email from you, by telephone, via this website or from Monkey Music Limited. This could include personal data which you provide when you:
- place an order for Monkey Music products or services;
- create an account on the Monkey Music website;
- subscribe to Monkey Music publications;
- request information on Monkey Music products or services or for other marketing to be sent to you;
- enter into a competition or promotion; and
- complete a survey from us or give us feedback.
Automated technologies, such as CCTV or other recording systems, cookies, server logs and other similar technologies. Monkey Music may automatically collect Information Technology Data about your equipment, browsing actions and patterns by using cookies, server logs and other similar technologies. Monkey Music may also receive Information Technology Data about you if you visit other websites employing Monkey Music cookies. Please see the Monkey Music cookie policy for further details.
Third parties, such as:
- Monkey Music Limited;
- analytics providers (such as Google, CommuniGator and Hotjar);
- webhosting providers (such as Google Cloud, Amazon AWS, DigitalOcean, Cloudflare and Kovalent);
- Monkey Music’s provider of customer feedback (such as Facebook (Meta) and Google);
- advertising networks (such as Facebook, (Meta), X, Instagram, TikTok and LinkedIn);
- search information providers (such as Google);
- providers of technical, payment and delivery services (such as YouTube, Stripe and Opayo); and
- providers of social media platforms (such as Facebook (Meta), X, Instagram, TikTok, LinkedIn, YouTube and Vimeo) for example where you share Monkey Music content through social media, for example by liking Monkey Music on X, Facebook, LinkedIn, TikTok or by following or posting about us on any social media platform;
- publicly available sources, such as Companies House and HM Land Registry and website integration and email marketing providers (such as Mailchimp, Campaign Monitor and Brevo).
5. HOW WE USE YOUR PERSONAL DATA
- For the purposes of relevant data protection legislation, we are the controller of the personal data you provide to us and as a controller we use (or ‘processes’) the personal data we hold on you in accordance with this Privacy Notice.
- Monkey Music Limited is also a controller sometimes but where it is providing a service to us in respect of your personal data and processing your personal data on our behalf in doing so (such as updating class registers and making appointments for the classes) it is acting as our data processor and is not as a controller of your personal data. Please see Monkey Music Limited’s Privacy Notice here for further details https://www.monkeymusic.co.uk/privacy-notice.
The law requires us to have a lawful basis to process your personal data.
Where we may rely on consent
For certain purposes it may be appropriate for us to obtain your prior consent. The legal basis of consent is only used by us in relation to processing that is entirely voluntary – it is not used for processing that is necessary or obligatory in any way.
In the event that we rely on your consent, you may at any time withdraw the specific consent you give to our processing your personal data. In addition you are entitled to object to any other processing of your personal data we carry out where we do so in accordance with our own legitimate interests, a list of which is set out below (please also see below for a list of your rights in this respect). Please note, however, that where you do withdraw your consent or otherwise object to our processing of your personal data then this may impact our ability to provide you with goods and services (e.g. if we cannot contact you to tell you about a venue change or if you withdraw consent to our using any health-related information you provide about your child) and we may continue to rely on other lawful bases to process your personal data for other purposes.
Please contact us using the contact details set out in paragraph 2 to do so. Alternatively, please visit the Parent Zone and alter the consent boxes as appropriate. When you change your choices in the Parent Zone our system will automatically update to take this into account.
Examples of when we may rely on your consent to process your personal data include:
- where, in the provision of our goods and services to you and your child, we need to use the information you provide about your child’s health;
- where we would like to use photos or images taken of you or your child in promotional materials;
- where we sent you information or marketing regarding our products and services that may be of interest to you and exciting new services and activities which Monkey Music thinks you will be interested in; or
- where an opportunity arises to work for or with us or Monkey Music.
We use the consent box mechanism in the Parent Zone to obtain your consent to use your personal data for the specific purposes set out above. You can choose to give your consent to some or all of these purposes. We will comply with the choices you make.
Other legal bases we may rely on
Where we are relying on a basis other than your consent, the lawful basis for processing personal data will be one of the following:
a) the processing is necessary in order for us to comply with our legal obligations (such as compliance with anti-money laundering legislation);
b) the processing is necessary for the performance of a contract you are party to or in order to take steps at your request prior to you entering into a contract;
c) processing is necessary for the establishment, exercise or defence of legal claims;
d) the processing is necessary for the pursuit of our legitimate business interests;
e) the processing is necessary in order to protect the vital interests of an individual e.g. where there is a medical emergency at one of our premises;
f) the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.
Extra conditions for sensitive personal data
Where we are processing your sensitive / special category personal data one of the following conditions will also apply:
a) you have given your explicit consent to the processing;
b) the processing is necessary for the establishment, exercise or defence of legal claims;
c) the processing is necessary to protect an individual’s vital interests where the individual cannot give consent;
d) the processing is necessary for reasons of substantial public interest; or
e) processing is necessary in relation to your or our rights in the field of employment and social security and social protection law which may include in the context of franchising opportunities and job applications.
6. PURPOSES FOR WHICH WE USE YOUR PERSONAL DATA AND THE LAWFUL BASIS
Our processing of your personal data will depend on our relationship with you. Set out below in more detail are the purposes of the processing activities and which of the lawful basis we rely on to do so. We have also identified what our legitimate interests are where appropriate:
Purpose - Performing our contractual obligations to you:
Processing Operation - Processing, performing and sending you surveys in relation to any orders placed by you for goods or services.
Lawful basis relied on under data protection laws (as relevant and applicable) - Processing is necessary:
• for the performance of a contract with you;
• in connection with our legitimate business interests in carrying out our business and managing our relationship with you.
Relevant Categories of personal data - Individual Data; Economic and Financial Data; Account and Profile Data.
Processing Operation - Considering feedback and complaints that you may make to us including dealing with refunds.
Lawful basis relied on under data protection laws (as relevant and applicable) - Processing is necessary:
• for the performance of a contract with you;
• in connection with our legitimate business interests in carrying out our business and managing our relationship with you;
• vital interests.
Relevant Categories of personal data - Individual Data; Economic and Financial Data;
Account and Profile Data.
Processing Operation - Making or receiving payments, fees and charges.
Lawful basis relied on under data protection laws (as relevant and applicable) - Processing is necessary:
• for the performance of a contract with you;
• in connection with our legitimate business interests in carrying out our business and managing our relationship with you.
Relevant Categories of personal data - Individual Data; Economic and Financial Data; Account and Profile Data.
Processing Operation - Collecting and recovering money owed.
Lawful basis relied on under data protection laws (as relevant and applicable) - Processing is necessary:
• for the performance of a contract with you;
• in connection with our legitimate business interests in carry out our business and managing our relationship with you.
Relevant Categories of personal data - Individual Data; Economic and Financial Data;
Account and Profile Data.
Processing Operation - To register you as a new customer or supplier or member of the Monkey Music Club.
Lawful basis relied on under data protection laws (as relevant and applicable) - Processing is necessary:
• for the performance of a contract with you;
• in connection with our legitimate business interests in carry out our business and managing our relationship with you.
Relevant Categories of personal data - Individual Data; Economic and Financial Data;
Account and Profile Data.
Purpose - Managing our relationship with you:
Processing Operation - Sending you important notices such as communications about changes to our terms and conditions and policies (including this Privacy Notice).
Lawful basis relied on under data protection laws (as relevant and applicable) - Processing is necessary:
• for the performance of a contract with you;
• for compliance with a legal obligation to which we are subject;
• in connection with our legitimate business interests in carrying out our business and managing our relationship with you.
Relevant Categories of personal data - Individual Data; Account and Profile Data.
Processing Operation - Providing you with important real-time information about products or services you have ordered from us (e.g. a change of time or location for your service due to unforeseen circumstances).
Lawful basis relied on under data protection laws (as relevant and applicable) - Processing is necessary:
• for the performance of a contract with you;
• in connection with our legitimate business interests in carrying out our business and managing our relationship with you;
• for compliance with a legal obligation to which we are subject.
Relevant Categories of personal data - Individual Data; Account and Profile Data.
Processing Operation - Providing advice regarding our products and services to you (or arrange for others to do so at our request).
Lawful basis relied on under data protection laws (as relevant and applicable) - Processing is necessary:
• for the performance of a contract with you;
• in connection with our legitimate business interests in carrying out our business and managing our relationship with you.
Relevant Categories of personal data - Individual Data; Advertising Data; Market Research Data.
Processing Operation - Sending you information you have requested and/or providing you with important real time information about classes or services you have booked (e.g. a change of time or location of the class due to unforeseen circumstances) or providing you with access to the Monkey Music Club.
Lawful basis relied on under data protection laws (as relevant and applicable) - Processing is necessary:
• for the performance of a contract with you;
• for compliance with a legal obligation to which we are subject;
• in connection with our legitimate business interests in carrying out our business and managing our relationship with you;
in each case as relevant and/or required by applicable law.
Relevant Categories of personal data - Individual Data; Advertising Data; Information Technology Data; Account and Profile Data.
Processing Operation - Dealing with your enquiries.
Lawful basis relied on under data protection laws (as relevant and applicable) - Processing is necessary:
• for the performance of a contract with you;
• for compliance with a legal obligation to which we are subject;
• in connection with our legitimate business interests in carrying out our business and managing our relationship with you.
Relevant Categories of personal data - Individual Data; Account and Profile Data; Sales Data; Economic and Financial Data.
Processing Operation - Making suggestions and recommendations to you about goods, brands or services that may be of interest to you, delivering relevant website content and advertisements to you and to measure or understand the effectiveness of our advertising. We may also undertake profiling in order to protect your interests and personalise recommendations.
Lawful basis relied on under data protection laws (as relevant and applicable) - Processing is necessary:
• in connection with our legitimate business interests in carrying out our business and managing our relationship with you;
• or where you have provided us with your consent.
Relevant Categories of personal data - Individual Data; Advertising Data; Information Technology Data; Account and Profile Data; Sales Data.
Processing Operation - Communicating with you about, and administering your participation in, special events, programmes, promotions, any prize draws or competitions.
Lawful basis relied on under data protection laws (as relevant and applicable) - Processing is necessary:
• for the performance of a contract with you;
• in connection with our legitimate business interests in carrying out our business and managing our relationship with you;
• or where you have provided us with your consent.
Relevant Categories of personal data - Individual Data; Advertising Data; Information Technology Data; Account and Profile Data.
Processing Operation - For internal purposes to use data analytics, to identify usage trends, determine and measure the effectiveness of promotional campaigns and advertising and to improve our website, products/services, marketing, customer relationships and experiences.
Lawful basis relied on under data protection laws (as relevant and applicable) - Processing is necessary:
• for the performance of a contract with you;
• in connection with our legitimate business interests in carry out our business and managing our relationship with you.
Relevant Categories of personal data – Individual Data; Advertising Data; Information Technology Data; Account and Profile Data; Sales Data.
Purpose - Administering our business and carrying out business activities
Processing Operation - This may involve a variety of processing operations relating to the running of our business (which includes providing your personal data to our franchisees and their authorised personnel (such as all authorised teachers and administrative personnel) for the same purposes) including those set out below.
Relevant Categories of personal data - Individual Data; Advertising Data; Information Technology Data; Account and Profile Data; Sales Data.
Processing Operation - Protecting our business including to deal with any misuse of our website and to comply with our security policies at our locations.
Lawful basis relied on under data protection laws (as relevant and applicable) - Processing is necessary:
• in connection with our legitimate business interests in carrying out our business and managing our relationship with you;
• for compliance with a legal obligation to which we are subject.
Relevant Categories of personal data - Individual Data; Information Technology Data; Account and Profile Data.
Processing Operation - Using your personal data to comply with our own legal obligations and maintaining our records.
Lawful basis relied on under data protection laws (as relevant and applicable) - Processing is necessary:
• in connection with our legitimate business interests in carrying out our business and managing our relationship with you;
• for compliance with a legal obligation to which we are subject in the case of a health and safety incident recorded at any of our venues;
• vital interests.
Relevant Categories of personal data - Individual Data; Economic and Financial Data; Account and Profile Data; Sales Data; Audio and Visual Data; Health Data.
Processing Operation - By collecting personal data directly from you or your personal data may be collected indirectly from third party sources or enforcing or applying our terms of use, terms and conditions of supply and other agreements with third parties (e.g. service providers that provide operational assistance, email, marketing, and analytics services, as well as financial and credit related services, payment services and social media platforms); For the purposes of debt recovery.
Lawful basis relied on under data protection laws (as relevant and applicable) - Processing is necessary:
• for the performance of a contract with you;
• in connection with our legitimate business interests in carrying out our business and managing our relationship with you;
• for compliance with a legal obligation to which we are subject.
Relevant Categories of personal data - Individual Data; Advertising Data; Information Technology Data; Account and Profile Data; Sales Data.
Processing Operation - Detecting and preventing fraud and other illegal activities (and to assist regulators, trade bodies and law enforcement agencies in relation to the same).
Lawful basis relied on under data protection laws (as relevant and applicable) - Processing is necessary:
• for the performance of a contract with you;
• in connection with our legitimate business interests in carrying out our business and managing our relationship with you;
• for compliance with a legal obligation to which we are subject;
• vital interest of a person;
• for the performance of a contract with you.
Relevant Categories of personal data - Individual Data; Information Technology Data; Economic and Financial Data; Account and Profile Data; Sales Data.
Processing Operation - Reorganisation, restructuring, refinancing, selling, making ready for sale or disposal of our business in whole or in part including to any potential buyer or their advisers.
Lawful basis relied on under data protection laws (as relevant and applicable) - Processing is necessary in connection with our legitimate business interests in carry out our business and managing our relationship with you.
Relevant Categories of personal data - Individual Data; Advertising Data; Information Technology Data; Account and Profile Data; Sales Data.
Processing Operation - Investigating and defending any third party claims or allegations.
Lawful basis relied on under data protection laws (as relevant and applicable) - Processing is necessary:
• for the performance of a contract with you;
• in connection with our legitimate business interests in carrying out our business and managing our relationship with you;
• for compliance with a legal obligation to which we are subject;
• vital interests.
Relevant Categories of personal data - Individual Data; Sales Data; Economic and Financial Data.
Processing Operation - Providing administration and / or IT services; Seeking to ensure the security of our IT network.
Lawful basis relied on under data protection laws (as relevant and applicable) - Processing is necessary:
• in connection with our legitimate business interests in carrying out our business and managing our relationship with you.
Relevant Categories of personal data - Individual Data; Advertising Data; Information Technology Data; Account and Profile Data; Sales Data.
Processing Operation - The development of our business strategy; Studying how to develop and the updating of our products and services.
Lawful basis relied on under data protection laws (as relevant and applicable) - Processing is necessary:
• in connection with our legitimate business interests in carrying out our business and managing our relationship with you.
Relevant Categories of personal data - Individual Data; Advertising Data; Information Technology Data; Account and Profile Data; Sales Data.
Processing Operation - Protecting our business and property.
Lawful basis relied on under data protection laws (as relevant and applicable) - Processing is necessary:
• in connection with our legitimate business interests in carrying out our business.
Relevant Categories of personal data - Individual Data; Information Technology Data.
Processing Operation - in order to share your personal data with Monkey Music Limited or other Monkey Music franchisees and their authorised personnel (including, but not limited to, all authorised teachers and administrative personnel)
Lawful basis relied on under data protection laws (as relevant and applicable) - Processing is necessary:
• for the performance of a contract with you;
• in connection with our legitimate interest and that of our franchisees in the provision of the supply of goods and services to you.
Relevant Categories of personal data - Individual Data; Sales Data; Economic and Financial Data
Processing Operation - In order to use the health-related personal data you provide to us about your child in order to protect the vital interests of you and your child in situations where you are physically or legally incapable of giving consent for us to do so. For example, this would enable us to make this type of personal data available to each of the Monkey Music franchisees and their authorised personnel (such as all authorised teachers and administrative personnel) in situations where we and/or the Monkey Music franchisees are required to comply with a specific legal requirement and there is not time to gain your consent. This would especially be relevant in an emergency situation or simply to enable you to take classes at different venues with different franchisees.
Lawful basis relied on under data protection laws (as relevant and applicable) - Processing is necessary:
• to protect your vital interests or those of another natural person where you are physically or legally incapable of giving consent; and
• to comply with the law, including social protection law.
Relevant Categories of personal data - Individual Data; Health Data.
Processing Operation - Where you have submitted an application for a job we may for a reasonable period keep your details on file for future reference should a suitable position subsequently become available and we may send you information about job opportunities.
Lawful basis relied on under data protection laws (as relevant and applicable) - Processing is necessary:
• for the performance of a contract with you;
• in connection with our legitimate business interests in carrying out our business and managing our relationship with you.
Relevant Categories of personal data - Individual Data; Account and Profile Data; Franchise Data.
Purpose - For the purposes of crime prevention, public safety, protecting property, or staff and visitor security.
Processing Operation - Including processing operation e.g. use of CCTV; Protecting our staff and visitors.
Lawful basis relied on under data protection laws (as relevant and applicable) - Processing is necessary:
• in connection with our legitimate business interests in carrying out our business;
• vital interest of a person.
Relevant Categories of personal data - Audio and Visual Data.
7. WHO RECEIVES THE PERSONAL DATA YOU PROVIDE TO US
Except where stated otherwise in this Privacy Notice, we do not share your personal data with any third party that is not connected to us. However, as the Monkey Music business is operated through a franchise network and we are a franchisee of Monkey Music Limited, we will share personal data collected from you with Monkey Music Limited. For how Monkey Music Limited will use your personal data please see its separate privacy notice available here: https://www.monkeymusic.co.uk/privacy-notice.
We may also share your personal data with other Monkey Music franchisees (who may also share it with their authorised teachers and administrative personnel) in some circumstances e.g. to enable you to take a class in a different area.
Specifically , we may disclose the personal data you provide to us to:
- our group companies, affiliates and members of our franchise networks;
- third party data processers who may process data on our behalf to enable us to carry out our usual business practices. Any such disclosure will only be so that we can process your personal data for the purposes set out in this Privacy Notice;
- Monkey Music’s PR agency and provider of the Monkey Music App and customer feedback;
- third parties operating plugins or serving up content (such as Facebook (Meta), TikTok, X, Instagram, LinkedIn, YouTube and Vimeo) which you choose to interact with;
- Monkey Music’s payment service providers such as Stripe (where you purchase products via Monkey Music’s online shop) or Opayo where you make an online booking;
- webhosting providers (such as Google Cloud, Amazon AWS, DigitalOcean, Cloudflare and Kovalent);
- website integration and email marketing providers (such as Mailchimp, Campaign Monitor and Brevo);
- HMRC, legal and other regulators or authorities, including those who request your personal data or to report any potential or actual breach of applicable law or regulation;
- external professional advisers such as accountants, bankers, insurers, auditors and lawyers;
- law enforcement agencies, courts or other relevant party, to the extent necessary for the establishment, exercise or defence of legal rights;
- third parties where necessary for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties;
- third parties which are considering or have decided to acquire some or all of our assets or shares, merge with us or to whom we may transfer our business (including in the event of a reorganisation, dissolution or liquidation);
- third parties operating plugins or content (such as Facebook, (Meta), TikTok, X, Instagram, LinkedIn, YouTube and Vimeo) on the Monkey Music website which you choose to interact with.
8. PERSONAL DATA ABOUT OTHER PEOPLE WHICH YOU PROVIDE TO US.
If you provide personal data to us about someone else (such as your child) you must ensure that you are entitled to disclose that personal data to us and that, without us taking any further steps, we may collect, use and disclose that personal data as described in this Privacy Notice.
Where the individual is not a child you must ensure the individual concerned is aware of the various matters detailed in this Privacy Notice, as those matters relate to that individual, including our identity, how to contact us, the way in which we collect and use personal data and our personal data disclosure practices, that individual’s right to obtain access to the personal data and make complaints about the handling of the personal data, and the consequences if the personal data is not provided.
9. ACCURACY OF YOUR PERSONAL INFORMATION
It is important that the personal data we hold about you is accurate and current and we take all reasonable precautions to ensure that this is the case, but we do not undertake to check or verify the accuracy of personal data provided by you. Please keep us informed if your personal data changes during your relationship with us either by logging onto your account on the Monkey Music website or by contacting us, we will not be responsible for any losses arising from any inaccurate, inauthentic, deficient or incomplete personal data that you provide to us.
10. TRANSFERS OF YOUR PERSONAL DATA TO OTHER COUNTRIES
It is possible that personal data we collect from you may be transferred, stored and/or processed outside the UK, specifically by Opayo or our webhosting providers (such as Google Cloud, Amazon AWS, DigitalOcean Cloudflare and Kovalent)..
In connection with such transfers we will ensure that:
a) there are appropriate safeguards in place such as binding corporate rules or approved model contractual clauses. A copy of the appropriate safeguard can be obtained by contacting us using the contact details set out in paragraph 2; or
b) the transfer is to a country that provides an adequate level of protection; or
c) one of the derogations for specific situations applies to the transfer including explicit consent or necessary for the performance of a contract or exercise or defence of legal claims.
11. HOW LONG WE HOLD YOUR PERSONAL DATA FOR
We will store your personal data for the time period which is appropriate in accordance with the following criteria:
(a) the on-going business operation / relationship that we have with you;
(b) the completion of the purpose for which the personal data was given;
(c) our legal obligations in relation to that personal data and other legal requirements;
(d) the type and size of the data held and whether any if it is deemed to be special category personal data; or
(e) our accounting requirements in relation to that personal data.
12. AUTOMATED DECISION MAKING AND PROFILING
We use automated decision-making tools in our processing of your personal data. This includes (but is not limited to) the application of profiling techniques to your personal data. We use these tools for the purpose of providing you with personalised marketing communications by email, SMS, post, social media ads or other digital channels.
13. WHY SHOULD YOU PROVIDE US WITH PERSONAL DATA?
Your personal data belongs to you and your family and we would like you to be comfortable with the level of information you disclose to us. You do not have to provide any personal data if you do not wish to do so.
However, please be aware that we do need to use your personal data in order to fulfil contractual obligations to you and to provide the goods and services you have elected to receive. In creating a profile on the Monkey Music system you are providing us with the basic personal data that we need in order to do this.
14. YOUR RIGHTS IN RELATION TO YOUR PERSONAL DATA
Subject to applicable law including relevant data protection laws, in addition to your ability to withdraw any consent you have given to our processing your personal data (see paragraph 5), you may have a number of rights in connection with the processing of your personal data, including:
• the right to request access to your personal data that we process or control;
• the right to request rectification of any inaccuracies in your personal data or, taking into account the purposes of our processing, to request that incomplete data is completed;
• the right to request, on legitimate grounds as specified in law:
(a) erasure of your personal data that we process or control; or
(b) restriction of processing of your personal data that we process or control;
• the right to object, on legitimate grounds as specified in law, to the processing of your personal data;
• the right to receive your personal data in a structured, commonly used and machine-readable format and to have your personal data transferred to another controller, to the extent applicable in law; and
• the right to lodge complaints regarding the processing of your personal data with the Information Commissioner’s Office or other relevant supervisory body. Please see https://ico.org.uk/concerns/ for how to do this.
If you would like to exercise any of the rights set out above, please contact us using the contact details set out in paragraph 2.
15. TECHNICAL AND SECURITY MEASURES
We take the security of your personal data seriously and have technical and organisational measures to ensure a level of security appropriate to the risk.
We use a mixture of measures including utilising technology to combat cybersecurity, data management techniques, user access and management procedures, physical security and guidelines for personnel.
Our measures are aimed at having the ability to:
• ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services; and
• restore the availability and access to personal data in a timely manner in the event of a physical or technical incident.
16. LINKS TO OTHER WEBSITES
This policy only applies to us. If you link to another website from the Monkey Music website, you should remember to read and understand that website’s privacy policy as well. We are not responsible for any use of your personal data that is made by unconnected third party websites.