Privacy Notice (GDPR & Data Protection)
Last Updated: July 2026
1. General Information
We are committed to protecting the privacy of school staff, administrators, and any users of our website. For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Leonardo Rossetti trading as Soundburst is the Data Controller.
2. What Personal Data We Collect
We may collect and process the following data:
-
Contact Details: Name, school name, school postal address, corporate email address, and phone number.
-
Transaction Data: Invoicing details, bank details, and records of services purchased.
-
Technical Data: IP address, browser type, and operating system when you browse our website.
3. Children's Data Disclaimer
Our services are marketed directly to adult school professionals, procurement officers, and teachers. We do not collect, store, or process personal data from children or primary school pupils through this website or during our services. If our educational services ever require processing pupil data in the future, we will act strictly as a Data Processor under a separate, dedicated Data Processing Agreement signed directly with the school.
4. How and Why We Use Your Data
We process your personal information based on the following legal grounds:
-
Performance of a Contract: To fulfill booking requests, process payments, and deliver our educational services to your school.
-
Legal Obligation: To comply with financial accounting laws and HMRC tax requirements.
-
Legitimate Interests: To send occasional marketing updates regarding new educational resources to school staff, provided they have not opted out.
5. Data Sharing and Retention
-
We do not sell your personal data. We only share data with essential third parties necessary to run our business, such as secure cloud hosting providers, IT support, and accounting services.
-
We retain financial records and transaction data for 6 years following the end of the financial year to comply with HMRC requirements.
6. Your Rights
Under the UK GDPR, you have the right to request access to, rectification of, or erasure of your personal data held by us. You also have the right to object to or restrict certain processing activities. To exercise these rights, contact us at [Your Email Address]. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO).