Last updated: 15 October 2026. This notice covers our website, app, courses and community, and includes our Privacy and data protection policy.
In short
- We collect only what we need to run the site, your account, your courses and your certificate.
- We never sell your data.
- Analytics cookies run only if you agree.
- Marketing emails go to you only if you agree, or, if you’re a customer, about similar courses, and you can unsubscribe at any time.
- Learner films are held privately by Bunny Stream (BunnyWay d.o.o., Slovenia), stored in Frankfurt, Germany, with a copy in London, and seen only by your assessor and quality assurers.
- You can ask to see, correct or delete your data. We reply within one month.
- Questions: [email protected] (our Data Protection Officer is Chris Porter).
1. Who we are
Teach.Dance is a trading name of Teach Dance Ltd, registered in England and Wales (company number 15135896). Registered office: 10 Churchill Way, Nelson, England, BB9 6RT. We are the data controller for the personal data described here.
- Data Protection Officer: Chris Porter, [email protected].
- Safeguarding: Jess Porter, Designated Safeguarding Lead, [email protected]. Deputy: Jackie Sanderson, via [email protected].
This notice covers our website, mobile app, community spaces, courses (including partner courses) and memberships.
2. What we collect
- Identity and contact: name, title, date of birth (to check you’re 16 or over, and to apply our protections for 16- and 17-year-olds), a parent or guardian’s details if they buy for you, email, postal address and phone.
- Account: username, password (stored encrypted), and your preferences.
- Payment: billing address and order history. Card details are handled by our payment provider; we don’t see full card numbers.
- Course data: enrolments, progress, quiz and assessment results, feedback, certificates, and any adjustment or special consideration you ask for.
- Assessment films and uploads, which may show the people you teach, including children.
- Community content: posts, comments, messages, photos, videos, documents, profile details and points or leaderboard activity in groups and forums.
- Communications: support messages, feedback and survey answers.
- Technical data: IP address, browser and device type, operating system, and how you use the site and app. Some of this is collected through cookies (see section 9).
- Health or disability information, only if you choose to share it for an adjustment.
- Optional equality monitoring answers.
3. Why we use it, and our lawful basis
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Creating your account and providing courses, memberships and the community | Contract (Art 6(1)(b)) |
| Assessing your work and issuing certificates | Contract |
| Taking payments and managing subscriptions | Contract |
| Tax and accounting records | Legal obligation (Art 6(1)(c)) |
| Quality assurance, checking certificates are genuine, preventing malpractice and fraud, keeping records for appeals, keeping the site secure, moderating the community | Legitimate interests (Art 6(1)(f)) |
| Processing films that show the people you teach, so we can assess you | Your own data in the films: contract. People you teach who appear in your films, including under-18s: legitimate interests (Art 6(1)(f)) of Teach.Dance and you in fair, valid assessment. This is supported by written consent from a parent or carer and from the young person, which you collect before filming (see the Filming safely policy). We do no facial recognition |
| Analytics (Google Analytics) | Consent, given through our cookie banner (PECR reg 6) |
| Marketing emails | Your consent, or, for existing customers, the “soft opt-in” for our similar courses (PECR reg 22). Every email has an unsubscribe link |
| Health or disability information you choose to share | Explicit consent (Art 9(2)(a)). You can withdraw it at any time, though we may then be unable to make an adjustment |
| Optional equality monitoring | Consent, and the equality of opportunity condition (DPA 2018 Sch 1 para 8). Used in anonymised totals only |
| Safeguarding concerns | DPA 2018 Sch 1 para 18 (safeguarding of children and individuals at risk) |
| Logging private messages between tutors or assessors and learners aged 16 or 17, and making them visible to moderators and our Designated Safeguarding Lead | Legitimate interests (keeping young learners safe, and our duties under the Online Safety Act 2023) |
| Sharing your name and course results with the British DanceSport Association (BDSA) so it can issue your certificate, and sharing details with other course partners where you take a partner-recognised course (section 5) | Contract |
4. Marketing, photos and testimonials
We’ll only use your name, photo, video or testimonial in our marketing if you agree separately, and you can withdraw at any time by emailing [email protected]. Buying a course or a Mini Movers Dance subscription does not give us that permission. We never use images of children from your classes, or assessment films, in marketing.
5. Who we share it with
- Your assessor and our quality assurers, including our external quality assurer.
- The British DanceSport Association (BDSA): we share your name and course results with the BDSA so it can issue your certificate. The BDSA is a separate controller and uses your data under its own privacy policy (bdsassociation.com).
- Other course partners: UKAdance and All Nations Dance. Where you take a partner-recognised course, we share the details needed to issue certificates or awards. Each partner is a separate controller under its own privacy policy.
- NCFE: only if a course becomes an NCFE Customised Qualification. We’ll update this notice first.
- Professional advisers (lawyers, accountants, insurers) and authorities, where the law requires or to protect someone’s safety.
- Service providers. “Processor” means the provider acts on our instructions under a written contract. “Controller” means the provider decides how it uses the data, under its own privacy policy.
| Service | What it does | Role | Where data may be held | Protection outside the UK |
|---|---|---|---|---|
| Levamo (formerly Rapyd Cloud) | Hosting, database and site files, on Amazon Web Services. Not assessment films | Processor | Dublin, Ireland (AWS eu-west-1) | Ireland has UK adequacy |
| Cloudflare | DNS, security and content delivery for the site | Processor (site traffic) | Global network; US company | UK Extension to the EU-US Data Privacy Framework (dataprivacyframework.gov) |
| Bunny Stream (BunnyWay d.o.o., Ljubljana, Slovenia) | Stores and plays assessment films privately. Browser-direct uploads; private links that expire after 10 minutes; titles hold reference numbers only | Processor (DPA signed 15 October 2026) | Frankfurt, Germany, with a copy in London | EEA, which has UK adequacy. Delivery restricted to EU locations |
| Google Analytics 4 (via MonsterInsights), only with consent | Site usage statistics | Processor for analytics data | US and elsewhere | UK Extension to the EU-US Data Privacy Framework (Google LLC), and standard contractual clauses with the UK Addendum |
| Google reCAPTCHA v3 | Blocks bots on login and registration | Google, under Google’s own terms and privacy policy | US | As for Google above |
| YouTube (embedded videos) | Plays embedded videos | Controller | US | As for Google above |
| Vimeo (player) | Plays our own course and marketing videos. Not assessment films | Controller (Vimeo says it’s a controller) | US | UK Extension (Vimeo.com, Inc., participant 5711) |
| SureCart (SureCart Inc.) | Checkout, orders, subscriptions, invoices | Processor | US | UK Extension to the EU-US Data Privacy Framework (SureCart Inc.) |
| Stripe | Card payments | Controller for its own legal and fraud-prevention duties, and processor for some payment data, as set out in Stripe’s privacy policy | US and elsewhere | UK Extension to the EU-US Data Privacy Framework, and Stripe’s own contract terms |
| MemberPress (with its LearnDash integration) | Legacy memberships and course access. New sales go through SureCart | Processor (runs on our own site) | Our hosting (Levamo, above) | As for Levamo |
| SureContact (Brainstorm Force US LLC, Delaware, US) | Contact list, newsletters and order tracking | Processor | United States | We are putting a UK International Data Transfer Agreement (IDTA) in place with SureContact |
| Brevo (Sendinblue SAS, France) | Sends site and course emails | Processor | EU: OVH in France and Germany, Google Cloud in Belgium (help.brevo.com, “Data storage location”) | EU, which has UK adequacy. Some sub-processors are in the US; Brevo, Inc. is on the UK Extension (brevo.com/legal/privacypolicy) |
| Microsoft 365 (contract through GoDaddy) | Staff email and files | Processor | United Kingdom | Data is held in the UK |
| GoDaddy | Domain registrar and reseller of our Microsoft 365 contract | Controller for our account details, under its own privacy policy | US | Under GoDaddy’s own privacy policy and transfer terms |
| Akismet (Automattic) | Spam filtering of comments and forms (content, IP address, browser data) | Processor | For UK users, Aut O’Mattic A8C Ireland Ltd (Dublin); Automattic Inc. (US) also processes some data | Ireland has UK adequacy. Automattic uses UK government-approved standard contractual arrangements for transfers outside the UK |
| Patchstack (Patchstack OÜ, Estonia) | Security firewall and vulnerability protection (IP address, browser data, usernames and blocked form content) | Processor, under Patchstack’s Data Processing Addendum | Estonia; its hosting sub-processors are in the US | Estonia (EEA) has UK adequacy. For transfers outside the EEA, Patchstack uses standard contractual clauses or the EU-US Data Privacy Framework |
| BuddyBoss App (BuddyBoss) | Builds and runs our iOS and Android app. Your app account and content are held on our own site. BuddyBoss’s servers relay push notifications and check our app licence | Processor | Your account and content: our hosting (Levamo, above). Push relay: BuddyBoss’s servers, outside the UK | Your account and content: as for Levamo. Push relay: under BuddyBoss’s terms for its service |
| Push notifications: Firebase Cloud Messaging (Google) for Android and Apple Push Notification service for iOS, relayed by BuddyBoss | Sends app notifications to your device. They’re on in our app; you can turn them off at any time in your phone’s settings | Google: processor. Apple: under Apple’s own terms | US | Google: as above. Apple: under Apple’s own privacy policy and transfer terms |
| Apple App Store / Google Play | App download and distribution | Controllers (their own terms) | US | Their own terms |
| Complianz | Cookie banner on our site. The banner runs only from teach.dance, and Complianz receives no visitor data. We don’t keep consent records or use location lookups | Runs on our own site | Our hosting (Levamo, above) | As for Levamo |
| AI assistants | Help us with admin tasks (see section 5A) | Processor | May include the US | UK-approved transfer terms or the UK Extension, as for other US providers |
We never sell your data. Social media links (Facebook and Instagram) don’t send data unless you click them.
5A. AI tools
We use AI assistants for admin tasks only, such as help with our website and day-to-day running of the business. They are never given learner films, and never given data about anyone under 18. They work on our instructions under business terms, and we choose terms that don’t allow our data to be used to train their models. We don’t use AI to make decisions about you or to mark your work.
6. International transfers
Some providers are outside the UK. When data leaves the UK, it’s protected in one of three ways:
- the destination has UK adequacy (for example the EEA, including Levamo in Ireland, Brevo in France, Bunny Stream in Slovenia and Germany, Akismet in Ireland and Patchstack in Estonia);
- the US company is certified to the UK Extension to the EU-US Data Privacy Framework (for example Cloudflare, Google, Vimeo, SureCart, Stripe and Brevo, Inc.);
- UK-approved contract terms are in place (the International Data Transfer Agreement, or the UK Addendum to the standard contractual clauses).
Learner films are stored in Frankfurt (EEA), with a copy in London. Our website is hosted in Dublin, Ireland, which has UK adequacy. Where a provider is a controller (for example YouTube, or the app stores), its own privacy policy and transfer terms apply.
7. How long we keep it
| Data | How long |
|---|---|
| Assessment films and uploads | Until the certificate is issued plus 12 months, or until any appeal, malpractice case or quality check closes if later. Earlier on request |
| Achievement records | 3 years from award |
| Assessment decisions, feedback and quality assurance records | 7 years from award |
| Basic certificate record (name, course, date, number) | 40 years |
| Orders and payments | 6 years from the end of the financial year they relate to |
| Account and community content | While your account is open; deleted or anonymised within 90 days of closure, except where kept above |
| Marketing preferences | Until you unsubscribe, then a suppression record so we don’t email you again |
| Analytics | As set in our Google Analytics data retention settings, then deleted by Google |
| Safeguarding records | 6 years after the last contact, or until the young person turns 25 if that is later. Reviewed every year, and kept longer only if the law or a statutory agency requires it |
| Support messages | 2 years |
| Logged tutor or assessor messages with learners aged 16 or 17 | Until the learner’s course ends plus 12 months, or longer if part of a safeguarding record |
| Moderation reports and actions | 2 years (safeguarding records: see the safeguarding row) |
8. Your rights
You can ask for a copy of your data, a correction, a deletion, a restriction, or a copy to move elsewhere. You can object to how we use it (including to marketing, at any time), and withdraw consent at any time. Some records must be kept (section 7). Email [email protected] and we’ll reply within one month. We don’t make decisions about you by automated means that have legal or similarly significant effects. Quizzes are marked automatically, but certificates are only issued after a person has assessed and quality-assured your work.
If you’re unhappy with our answer, you can complain to the Information Commissioner’s Office: ico.org.uk, 0303 123 1113 (Monday to Friday, 9am to 5pm).
9. Cookies
We use essential cookies to run the site, for example to keep you logged in, remember your basket and protect the site (Cloudflare’s __cf_bm). These don’t need consent. We also treat Google reCAPTCHA v3 on the login and registration pages as strictly necessary, because it protects your account from bots; it runs only on those pages. Other cookies run only if you agree in our cookie banner (Complianz):
- Statistics: Google Analytics 4, through MonsterInsights, runs only if you accept statistics cookies.
- Marketing: embedded YouTube and Vimeo videos load only if you accept marketing cookies. Until then you’ll see a placeholder.
Fonts: our website fonts (Fraunces and Inter) are hosted on our own site, so nothing is sent to Google.
Change your choice at any time through “Cookie settings” in the footer. Full details are in our Cookie policy.
10. If you’re 16 or 17
This part is for you if you’re 16 or 17 and using any of our courses or our community. We follow the ICO’s Children’s Code (Age appropriate design code).
- We only use your data to give you your courses, the community and your certificate, and to keep you safe.
- Your account starts with the most private settings: your profile is visible to members only, and we don’t show your location or contact details. You can choose to share more, and we’ll explain what that means first.
- Your account is marked as under 18, so our moderators can look out for you. Other members can’t see this.
- You can share photos inside groups, but not on your profile, in messages, in the main feed or in forums outside groups. Photos of anyone under 18 need written consent from a parent or carer and the young person.
- Adults can’t send you private messages, except your tutor or assessor about your course. Those messages are logged and can be seen by our moderators and our Designated Safeguarding Lead, to keep you safe.
- We don’t send you marketing unless you choose to opt in, and you can change your mind at any time.
- We don’t use your data to build a profile of you, and we don’t show you targeted adverts. Analytics cookies stay off unless you turn them on.
- If a parent or guardian buys for you, we use their details only for that purchase.
- If you take a BDSA course, we share your name and result with the British DanceSport Association so it can issue your certificate.
- You can ask to see or delete your data, or ask any question, by emailing [email protected]. You can also ask a parent, carer or teacher to help you.
- If you’re ever worried about your safety, or someone else’s, contact Jess Porter at [email protected]. In an emergency, call 999.
- If you’re unhappy with how we’ve used your data, you can complain to the ICO (ico.org.uk).
11. Children in your films
Our learners are aged 16 and over. Films you upload may show children you teach. You must have written consent from a parent or carer and from the young person before filming. Only your assessor and our quality assurers see the films; they’re held by Bunny Stream (BunnyWay d.o.o., Slovenia), stored in Frankfurt, Germany, with a copy in London, never used in marketing, and deleted on schedule. A parent or young person can ask us to delete footage by emailing [email protected].
12. Security and breaches
We use encryption, access controls and expiring private links, and we limit who can see your data. If a breach is likely to put your rights at risk, we report it to the ICO within 72 hours of becoming aware of it, and we tell you without undue delay where the risk to you is high.
13. Changes
We’ll post changes here and email you about significant ones. This notice informs you; it isn’t a contract you agree to.
Contact: [email protected] · DPO: Chris Porter · Teach Dance Ltd, 10 Churchill Way, Nelson, BB9 6RT