Privacy Policy

For young rockers

Your Passport is your personal record of achievements, milestones and landmark moments as you learn. It's also a reference book you can return to for help with your music. It isn't social media: it's here to support your progress and help you see how far you've come.

It helps you keep your parents or carers in the loop, too. You can proudly show them your latest stamps, the skills you've learned and the milestones you've reached, so they can celebrate your progress and support your next steps.

Use your first name; your stage name and musical hero are up to you. Please leave out your address, school, phone number and anything private about your health.

People using your family's account can see the Passports linked to it. Your instructors and authorised staff can see information they use to help you learn. Your Passport is not a public profile.

You can ask us what we know about you, ask us to put something right, or ask us to delete it. That includes a goal you have locked as a time capsule. Ask a trusted adult to help, or contact us yourself using the email above. We will explain if there is a reason we need to keep something.

Enquiries and joining the band

Our enquiry links open your email app. We receive your email address, your name if you provide it, your message and any attachments. Parents and carers can tell us a child's age and instruments of interest so we can discuss a suitable group. You do not need to send a child's full name, date of birth, photograph or health information for an initial enquiry.

We use this information to reply, discuss suitable sessions and send the updates about dates and places that you requested. Our lawful basis is legitimate interests: responding to people who contact us and organising our music activities. We limit what we ask for and take particular care with children's information.

Providing enquiry details is your choice, but we need a way to contact you to reply. Registering interest does not subscribe you to a general newsletter. You can ask us to stop sending availability updates at any time. We do not sell your information or share it with third parties for their marketing.

Your Tour Passport and band pass

Passport accounts hold a registered email address, account and learner identifiers, sign-in information and the learners linked to that account. Each learner's record can include their first name, optional stage name, instrument, musical hero, goals, chosen illustrated avatar, practice entries, completed challenges, stamps and dated progress history.

Authorised staff can record lesson arrangements, attendance, teaching notes and evidence for achievements. We also keep records of staff actions and security checks. These support teaching, account administration and protection against unauthorised access. Our lawful basis is legitimate interests: providing a learning record for enrolled musicians, supporting their lessons and keeping accounts secure.

Account details and a learner's first name are needed to provide their online Passport. Creative profile details are optional. A family account can access all learners linked to it; those learner profiles are not separate private accounts within the family. Staff access is limited by their assigned role. Practice stamps can be awarded automatically when activities are completed; verified achievement stamps are issued by staff. These features do not make legal or similarly significant decisions about a child.

The Access All Areas pass carries the band member's name. It does not require a child's photograph. We use the name to personalise their pass as part of our legitimate interests in running the band activities.

Who helps us run the service

We use Google Gmail for enquiries, Cloudflare for website hosting and delivery, and Supabase for Passport accounts, authentication and database storage. Account email delivery also involves the email service configured for Passport sign-in messages. These services handle the information needed to provide their part of the service.

When you visit, hosting and security services receive technical information such as your IP address, request time, requested page and browser information. This supports delivery, troubleshooting and protection of the service, on the basis of our legitimate interests in operating a reliable and secure website.

Service providers may process information outside the UK. Where a restricted transfer takes place, it needs to be covered by UK adequacy regulations or appropriate safeguards, such as approved contractual safeguards. Contact us for details of the arrangements applicable to your information and how to obtain copies of relevant safeguards.

Cookies and information on your device

The main website does not add advertising or analytics trackers. Its fonts, illustrations and audio are served with the site.

The Tour Passport uses a sign-in cookie called __Host-kcor-session to recognise an authenticated session. It lasts up to 12 hours and is cleared when you sign out. Because its path covers the domain, your browser can also send it when you return to the main website.

Passport also uses browser storage for local practice, recovery copies of unsaved changes, account-state coordination and remembering which stamp celebrations have been shown. Its offline cache holds application files and sounds. Browser-stored records and preferences can remain until the app removes them or you clear this site's data in your browser; the session cookie's expiry does not clear them.

Sign out on shared devices. Before clearing site data, save or export any practice you want to keep: clearing it can remove unsaved work and will sign you out. Clearing browser data does not delete the online account; contact us for that. Blocking sign-in cookies or required storage may prevent Passport features from working.

How long we keep information

General enquiries: up to six months after the enquiry is resolved, to handle follow-up questions. If you ask for updates about dates and places, we keep your details for up to twelve months from that request, unless you join or expressly ask to continue receiving updates. You can ask us to stop sooner. If you join, only the details needed for enrolment move into your activity record.

Passport and teaching records: while the learner is enrolled, then up to twelve months after they leave, to allow a return to lessons or an export of their progress. We then delete or anonymise their profile, practice history, lesson notes and achievement records. An account shared by siblings stays open for the remaining learners; the departing learner's records follow their own retention period. You can request earlier deletion.

Security: the sign-in cookie expires after twelve hours. Our target for routine application security logs is thirty days; an incident may require relevant records for longer. Hosting, authentication, email delivery and backup services have their own configured retention periods. Contact us for the provider-specific periods applicable to your information.

These periods are limits for routine use, not a reason to keep information we no longer need. A legal obligation or unresolved complaint may require a limited record for longer; we record the reason and review it when the matter ends. Browser copies follow the device-storage arrangements above. Deleting live records does not immediately remove copies from provider backups; those expire under the provider's backup schedule.

Your information, your rights

You can request access to your information, correction of inaccurate information, deletion, or restriction of its use. These rights have conditions and exceptions. Data portability applies where its legal conditions are met, including certain automated processing based on consent or contract; it does not apply to every record.

Your right to object: you can object to processing based on legitimate interests for reasons relating to your situation. You can object to direct marketing at any time. If we rely on consent for a separate activity, you can withdraw that consent without affecting processing that was lawful before withdrawal.

Email [email protected] with your request. We normally respond within one month. If we need information to identify you or a permitted extension applies, we will explain. Children's rights belong to them; a parent or carer can help, and we consider the child's understanding and the adult's authority when responding.

Privacy concerns and complaints

If you are unhappy with how we handle information, email [email protected] or write to our registered office above. We will acknowledge a privacy complaint within 30 days, investigate it and explain the outcome without undue delay.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator. Visit the ICO complaints service or call 0303 123 1113.