Privacy Policy

1. Who We Are

The Goode School of Dance (“we”, “our”, “us”) operates the class booking and management platform at thegoodeschoolofdance.ie. We are the data controller for the personal data collected through this platform. If you have any questions about this policy or your personal data, please contact us at info@thegoodeschoolofdance.ie.

2. What Data We Collect

We collect the following personal data when you register and use our platform:

• Parent/Guardian details: name, email address, phone number, address, and Eircode
• Secondary guardian details (if provided): name, phone, email, and relationship
• Child details: name, date of birth, medical information (if provided), and additional notes
• Photo/video consent: whether you consent to photos/videos of your child being used for school purposes
• Enrolment and attendance records: class bookings, payment status, and attendance history
• Payment references: Stripe transaction identifiers (we do not store card numbers or bank details)
• Account data: email, hashed password, and account creation date

3. Why We Collect It (Legal Basis)

• Contract performance: We need your data to manage class enrolments, process payments, and deliver our dance education services (GDPR Article 6(1)(b)).
• Legitimate interest: We use contact details to send essential communications about your child’s classes, such as schedule changes, payment reminders, and attendance updates (GDPR Article 6(1)(f)).
• Consent: Photo/video consent is collected separately and can be withdrawn at any time. Announcement and marketing emails require your opt-in, and you can unsubscribe at any time (GDPR Article 6(1)(a)).
• Legal obligation: We may retain certain records (e.g. payment records) as required by Irish tax and accounting law (GDPR Article 6(1)(c)).

4. How Long We Keep Your Data

• Active accounts: Data is retained for as long as your account is active and your child is enrolled.
• After leaving: We retain enrolment and payment records for up to 6 years after your last enrolment to comply with Irish Revenue requirements. Other personal data is deleted within 12 months of your last activity.
• On request: You may request deletion of your account and data at any time (see “Your Rights” below).

5. Who We Share Your Data With

We use the following third-party services to operate the platform. Your data is only shared with them as necessary to provide the service:

• Stripe (payments) — processes payments securely. We send your email and enrolment references to Stripe. Stripe is certified under the EU-US Data Privacy Framework. Stripe Privacy Policy
• Resend (email delivery) — delivers booking confirmations, payment reminders, and announcements. We share parent names and email addresses with Resend. Resend Privacy Policy
• MongoDB Atlas (database hosting) — stores your data securely in the cloud. Data is encrypted at rest and in transit.
• Vercel (web hosting) — hosts the platform. Vercel processes requests but does not store personal data long-term.

We do not sell your personal data to any third party.

6. Cookies

We use a single session cookie that is strictly necessary for authentication. This cookie keeps you signed in while using the platform. We do not use any analytics, advertising, or tracking cookies. Because this cookie is essential for the service to function, no separate consent is required under the ePrivacy Directive.

7. Your Rights

Under the General Data Protection Regulation (GDPR), you have the following rights:

• Right of access: Request a copy of all personal data we hold about you and your children.
• Right to data portability: Download your data in a machine-readable format from your account settings.
• Right to rectification: Update your details at any time through your dashboard.
• Right to erasure: Delete your account and all associated data from your account settings.
• Right to withdraw consent: Withdraw photo/video consent at any time by editing your child’s profile. Unsubscribe from announcement emails via the link in any email.
• Right to object: Object to processing based on legitimate interest by contacting us.
• Right to lodge a complaint: You may contact the Irish Data Protection Commission at www.dataprotection.ie if you believe your rights have been infringed.

8. Data Security

We take appropriate technical and organisational measures to protect your personal data, including:

• Passwords are hashed using industry-standard algorithms
• All data is transmitted over HTTPS (encrypted in transit)
• Database access is restricted and encrypted at rest
• Authentication sessions expire automatically
• Rate limiting protects against brute-force attacks

9. Children’s Data

We collect children’s data (name, date of birth, medical information) solely for the purpose of managing their dance class enrolment and ensuring their safety during classes. This data is provided by and managed by the parent/guardian. Children do not have direct access to the platform.

10. Changes to This Policy

We may update this privacy policy from time to time. If we make significant changes, we will notify you by email. The date at the top of this page indicates when the policy was last updated.