PRIVACY NOTICE

INTRODUCTION

Rocksteady Music School (“Rocksteady”, “us”, “we”, “our”) are committed to protecting your privacy
and meeting our legal obligations when you apply for a job or you (or an agent acting on your behalf)
share your employment details with us, this includes meeting our legal obligations when processing
your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data
Protection Act 2018 (DPA 2018).

This privacy notice explains what personal data we collect and use relating to employment and
associate candidates (“you”, “your”) during the recruitment process.

As an information-led business, we place great importance on ensuring the quality, confidentiality,
integrity, and availability of the data we hold, and in meeting our data protection obligations where
we process personal data. We are committed to protecting the security of your personal data. We use
a variety of technical and organisational measures to help protect your personal data from
unauthorised access, use or disclosure.

We update this privacy notice from time to time in response to changes in applicable laws and
regulations, to our processing practices and to products and services we offer. When changes are
made, we will update the effective date at the top of this document.

Personal data means any information about an individual from which that person can be identified,
therefore does not include data where the identity of the person has been removed (anonymous
data). There are “special categories” of more sensitive personal data which require a higher level of
protection. Rocksteady is the data controller of the personal data we hold about you, registered as
such with the Information Commissioner’s Office (“ICO”).

When you apply for a position (whether as an employee or consultant) or submit your CV (or similar
employment information) to us, whether directly or through an agency, or attend an interview in
person or by remote means, we will collect your personal data. This includes (but is not limited to):

• Name and contact details (address, mobile phone number and email address)
• Your CV and/or application form
• Company details (where applicable)
• Date of birth and gender
• Work history and employment positions held
• Salary, other compensation, and benefits information
• Nationality / visa / work permit information (where applicable)
• Academic and professional experience, qualifications, education, and skills
• Photographs you may submit with your application
• Demographic information
• Records we create during interviews or correspondence with you
• Results of pre-employment screening checks such as references or DBS checks (where
applicable)
• Details of your visits to the Rocksteady careers website (hosted by Pinpoint) including, but not
limited to, traffic data, location data and other communication data, the site that referred you
to the careers website and the resources that you access
• Any other information you choose to give us

We may also collect special category data in accordance with the Equality Act 2010. We will only do
this, for example, to make reasonable adjustments to enable all candidates to apply for vacancies,
attend interviews and to commence employment. This is also necessary to ensure we meet our legal
obligations when recruiting.

We will process your personal information for the following purposes and under the following lawful
bases:

We will only process sensitive ‘special category’ personal data where we meet one of the conditions
required by law for doing so. This includes complying with legal obligations or exercising specific rights
in the field of employment law. We may also ask for your explicit consent to process some special
categories of personal data.

We process special categories of personal data when we collect or process information about your
physical or mental health, or disability status, to ensure your health and safety in the workplace and
to assess your fitness to work and to provide appropriate workplace adjustments.

We may share your data with service providers and suppliers to our business who process data on our
behalf. In such cases, our service providers and suppliers are data processors and may only use the
data in line with our instructions and not for any other purpose. This and other obligations are agreed
in the contract between Rocksteady and the service providers and suppliers.

We use Pinpoint, an online software product provided by The Infuse Group Ltd (t/a Pinpoint Software),
to assist with our recruitment process. As such ,Pinpoint processes personal information as a data
processor on our behalf. Pinpoint is only entitled to process your personal data in accordance with our
instructions. Pinpoint provides us with the facility to link the data you provide to us with other publicly available information about you that you have published on the Internet – this may include sources
such as LinkedIn and other social media profiles. Pinpoint’s technology enables us to search various
databases, which may include your personal data, to find possible candidates to fill our job openings.
Where we find you in this way we will obtain your personal data from these sources.

There may be scenarios where we are subject to a legal obligation to disclose or share your personal
data, such as with law enforcement agencies, regulatory bodies, or public authorities in order to
prevent or detect crime. We will only ever disclose your personal data to these third parties to the
extent we are required to do so by law.

Your Personal Data may be processed outside of the UK. Where this is the case, we have taken
appropriate steps to ensure that the Personal Data processed outside the UK has an essentially
equivalent level of protection to that guaranteed in the UK. We do this by ensuring that:

• Your Personal Data is only processed in a country which the Secretary of State has confirmed
  has an adequate level of protection (an adequacy regulation), or
• We enter into an International Data Transfer Agreement (“IDTA”) with the receiving
  organisation and adopt supplementary measures, where necessary. Within Rocksteady, your
  personal data will only be shared with those who need to have access to it, which will primarily
  be our HR personnel and hiring managers.

We will retain your personal data for only as long as is necessary for the recruitment process. If your
candidacy is successful and you are employed or hired by us, your data will be processed and retained
as set out in our employee privacy notice, provided to you with your employment paperwork.

If your application is not successful, with your consent we will retain your CV, application details and
interview notes to inform you about any future vacancies we have thatmay be of interest to you. This
consent can be withdrawn at any time and your application deleted, just contact us using the details
in section 8.

We will also retain personal data where it is necessary to comply with our legal obligations or as
necessary in relation to legal claims. This is rare but may mean we need to retain your data for longer
than 2 years.

Individuals whose personal data we process have the following rights:

• You have the right of access to your personal data and can request copies of it and information
  about our processing of it
• If the personal data we hold about you in incorrect or incomplete, you can ask us to rectify or
  add to it
• Where we are using your personal data with your consent, you can withdraw your consent at
  any time
• Where we are using your personal because it is in our legitimate interests to do so, you can
  object to us using it this way
• In some circumstances, you can restrict our processing of your data, request a machine –
  readable copy of your personal data to transfer to another service provider and compel us to
  erase your personal data

If you wish to exercise any of your rights, please contact us at data@rocksteadymusicschool.com or
write to us at the following address: Rocksteady Music School, Bohunt Manor, Portsmouth Road,
Liphook, Hampshire, GU30 7DL.

You will not have to pay a fee to access your personal data (or to exercise any of the other rights).
However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive.
Alternatively, we may refuse to comply with the request in such circumstances.

In addition to the above, please note that you have the right to make a complaint at any time to the
ICO if you are concerned about the way in which we are handling your personal data.

You can contact Rocksteady in relation to data protection and this privacy notice by emailing
data@rocksteadymusicschool.com.

We may update this notice (and any supplemental privacy notice), from time to time as shown below.
We will notify of the changes where required by applicable law to do so.

Last modified 23/04/2025

You can contact us for previous versions of this Privacy Notice.