Privacy policy

Thirst Music School (“we”, “us”) takes your privacy seriously. This policy explains what personal information we collect through this website and when you take lessons with us, why we collect it, who sees it, how long we keep it and what your rights are.

Who we are

Thirst Music School is a music tuition business based in Guernsey, Channel Islands, and is the “controller” of the personal information described here. You can contact us at any time using the details on our Contact page or at the foot of every page.

What we collect

• Account holders (parents, carers and adult learners): your name, email address, telephone number and password (stored only in scrambled, one-way form, so nobody at the school can read it).
• Students: the name of each student, whether they are a child, and the instrument and lessons they take. We may record notes that help a teacher teach the student, and attendance and short teacher comments on lessons.
• Bookings and payments: which lessons were booked, when, with whom, what is owed and what has been paid, and the method of payment. We do not see or store full card numbers (see “Payments” below).
• Messages: anything you send us through the contact form or by emailing a teacher through the website.
• Technical information: a small cookie that keeps you signed in (see our Cookies policy). Our web hosting may keep ordinary server logs, such as your IP address and the pages requested, for security and fault-finding.

If a child takes lessons, the account must be created and managed by a parent or guardian. We collect only the information needed to teach the child.

Why we use your information

• To provide lessons: taking and managing bookings, arranging teachers, rooms and times, telling you about changes and cancellations. (Performance of our contract with you.)
• To invoice you, take payment and keep financial records. (Contract, and our legal obligation to keep accounts.)
• To answer your messages and keep you informed about your lessons. (Contract and our legitimate interest in running the school well.)
• To keep the website and our systems secure. (Legitimate interest.)

We do not use your information for marketing by third parties, we do not sell it, and we do not use it for automated decision-making or profiling.

Who we share it with

• Our teachers see the details of the students they teach and the contact details of the account holder, so they can run lessons and contact you.
• SumUp processes card payments. When you pay by card you are taken to SumUp’s secure payment page and they handle your card details under their own privacy policy. We only receive confirmation that a payment was made.
• Cloudflare provides the Turnstile security check on our forms. It receives your IP address and basic browser information to decide whether you are a person or a bot.
• Our website hosting and email providers store the website and its database and send the emails the website produces, acting on our instructions.
• Authorities or professional advisers (for example our accountant) where we are required to by law or need it to run the business.

We do not share your information with anyone else unless the law requires it. Where a provider is based outside Guernsey, the UK or the European Economic Area, we make sure appropriate safeguards are in place.

How long we keep it

• Account and student details: for as long as you have an account with us, and then for a reasonable period afterwards in case of questions about lessons or fees. You can ask us to close your account and delete it.
• Invoices and payment records: for as long as we are legally required to keep accounting records (normally around six years).
• Messages: for as long as needed to deal with your enquiry, and no longer than a few years afterwards.

Keeping it safe

Access to the back office and teacher area is by password, and teachers only see the lessons and students they are responsible for. Passwords are stored in scrambled form. The website uses an encrypted (HTTPS) connection. No system is completely risk-free, but we take sensible steps to protect your information and will tell you and the regulator if a breach affecting you ever occurs, as the law requires.

Your rights

Under data protection law you have the right to ask us to: see the personal information we hold about you; correct anything that is wrong; delete it (in some circumstances); restrict or object to how we use it; and receive a copy of it in a portable form. You can correct your own details at any time under My account. For anything else, contact us. We will reply within one month.

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the data protection regulator: in Guernsey, the Office of the Data Protection Authority (odpa.gg); in the UK, the Information Commissioner’s Office (ico.org.uk).

Changes to this policy

We may update this policy from time to time. The current version is always on this page.

Last updated: October 2026.