Privacy Policy
How we collect, use and look after your information
The short version
- We only collect the details you choose to give us, for example when you send an enquiry, book a class, place an order or ask for our franchise prospectus.
- We use them to reply to you, run your bookings and orders, and, if you’ve asked, send you information about our franchise.
- We never sell your information or use it for advertising.
- Google Analytics only runs if you say yes to analytics cookies, and you can change your mind at any time.
- You can ask to see, correct or delete your information by emailing info@musicalstorybox.com.
1. Who we are
This website is run by Musical StoryBox Ltd (“Musical StoryBox”, “we”, “us”), a company registered in England and Wales under company number 13855849. Our registered office is 6 Walsingham Dene, Bournemouth, Dorset, BH7 7RJ.
We are the controller of the personal information described in this notice. That means we decide how and why it is used, and we are responsible for looking after it. If you have any questions, email info@musicalstorybox.com or call 07970 008856.
Some of our class areas are run by Musical StoryBox franchisees, who are independent businesses. When you book or enquire about a class in their area, the franchisee will also use your details to look after your booking, and may give you their own privacy information.
2. The information we collect
Information you give us
| When | What we collect |
|---|---|
| Contact, party and school enquiries | Your name, email address, phone number and your message. |
| Class waiting list and class finder | Your name, email address and postcode or area, plus the answers you give about your child, such as their age, whether they are walking and whether a sibling will come too. |
| Class bookings (through BookThatIn) | The details the booking form asks for, such as your name and contact details, your child’s name and age, and the classes you book. Card payments are handled by the booking system’s payment provider; we never see your full card details. |
| Sensory bag orders | Your name, email address, phone number and address, the name you would like on the bag, what you have ordered and how you would like to receive it. If you pay online, the payment is handled by Stripe and we never see your full card details. |
| Franchise prospectus requests | Your name, email address, phone number and your area or postcode. |
| Emails, phone calls and social media messages | Whatever you choose to tell us, and a short note of our conversations so that we can follow up properly. |
Information collected automatically
Like most websites, our hosting provider records basic technical information when you visit, such as your IP address, browser type and the pages requested. This is used to keep the website secure and working. If you accept analytics cookies, Google Analytics also collects information about how you use the site. See Cookies below.
Information about children
Our classes are for babies and young children, but we only collect information about them from their parent or carer, and only what we need to place them in the right class and run sessions safely. Our website is not designed for children to use themselves.
If you tell us about your child’s health or any additional needs so that we can support them in class, we will only use it for that purpose, with your explicit consent. We will share it only with the class leader and delete it when it is no longer needed.
3. How we use your information, and our lawful basis
Data protection law says we must have a lawful basis for each way we use personal information. These are ours:
| What we use it for | Lawful basis |
|---|---|
| Replying to your enquiry and keeping a record of our conversation | Legitimate interests: answering people who contact us and running our business |
| Managing class bookings, parties, school sessions and orders, including payments and confirmations | Contract: to provide what you have booked or ordered |
| Sending the franchise prospectus you asked for, and following up about the franchise opportunity | Consent, which you can withdraw at any time, and legitimate interests |
| Passing a class enquiry to the franchisee who runs classes in your area | Legitimate interests: making sure the right person helps you |
| Understanding how our website is used (Google Analytics) | Consent, given through our cookie banner |
| Protecting our website and forms from spam and misuse | Legitimate interests: keeping our services secure |
| Keeping accounts and meeting our legal and tax obligations | Legal obligation |
| Information about a child’s health or additional needs | Explicit consent |
Where we rely on legitimate interests, we have balanced our interests against yours and only use your information in ways you would reasonably expect.
4. Emails and marketing
If you request our franchise prospectus, we will email it to you and follow up with a small number of emails about the franchise. Every email includes an unsubscribe link, or you can simply email us. We will only send you class news and offers if you have asked to receive them.
We never sell, rent or trade your information.
5. Who we share your information with
We use trusted service providers to run our website and business. They act on our instructions, under contract, and may only use your information to provide their service to us.
| Provider | What they do for us |
|---|---|
| Netlify | Hosts our website and receives the forms you send through it |
| Airtable | Stores our enquiry and order records so that our team can follow them up |
| Google Workspace | Our email (info@musicalstorybox.com) |
| MailerLite | Sends our franchise prospectus emails |
| BookThatIn | Our class timetable and booking system, including payments for classes |
| Stripe | Takes online card, Apple Pay and Google Pay payments for sensory bags and gift vouchers |
| Google Analytics | Website statistics, only if you accept analytics cookies |
| Google reCAPTCHA | Protects our franchise sign-up form from spam |
| Behold | Shows our latest Instagram posts on our home page. The pictures load from Behold’s servers, which see your IP address in the same way as any website you visit |
| Apple, Google and Mozilla push services | Deliver alerts about new enquiries to our team’s phones. The alerts are encrypted, so these services cannot read them |
We may also share information with:
- our franchisees, for enquiries and bookings in their area;
- our professional advisers, such as our accountants, insurers and legal advisers;
- the police, regulators or other authorities, where the law requires it or to protect someone’s safety.
6. Transfers outside the UK
Some of our providers, including Netlify, Airtable, Google, Stripe and Behold, are based in or store information in the United States or elsewhere outside the UK. Where this happens, the transfer is protected by safeguards recognised under UK data protection law, such as the UK–US data bridge or the International Data Transfer Agreement and Addendum approved by Parliament.
7. How long we keep your information
We keep personal information only for as long as we need it:
| Information | How long we keep it |
|---|---|
| Enquiries that don’t lead to a booking or order | Up to 2 years after we last heard from you |
| Franchise enquiries | Up to 2 years after our last contact, or sooner if you unsubscribe and ask us to delete your details |
| Bookings, orders and payment records | 6 years after the end of the financial year they relate to, as required for tax and accounting |
| A child’s health or additional needs | Until your child stops coming to classes, or sooner if you ask |
| Google Analytics statistics | Up to 14 months |
8. Cookies
We use a small number of essential cookies to make the website work, and Google Analytics cookies only if you agree. Full details are in our Cookie Policy. You can change your choice at any time using “Cookie settings” at the bottom of every page.
9. Keeping your information safe
Our website is encrypted (HTTPS), and our records and team areas are password-protected and limited to the people who need them. Our service providers keep their own security measures in place. No system is completely secure, but we take reasonable steps to protect your information, and if a breach ever happens that we are required to report, we will tell you and the ICO.
10. Your rights
Under UK data protection law you have the right to:
- Access: ask for a copy of the personal information we hold about you.
- Correction: ask us to correct information that is wrong or incomplete.
- Erasure: ask us to delete your information.
- Restriction: ask us to limit how we use your information.
- Objection: object to us using your information on the basis of our legitimate interests, and to direct marketing at any time.
- Portability: ask for information you gave us in a format you can take elsewhere.
- Withdraw consent: where we rely on your consent, you can withdraw it at any time.
Some of these rights depend on the circumstances. To use any of them, email info@musicalstorybox.com. There is normally no charge, and we will respond within one month.
11. Complaints
If you are unhappy with how we have handled your information, please tell us first so that we can put it right. We will acknowledge your complaint within 30 days and let you know the outcome without undue delay.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.
12. Links to other websites, and changes to this notice
Our website links to other services, such as Instagram, Facebook, YouTube, Spotify and BookThatIn. They have their own privacy policies, and we are not responsible for how they use your information.
We will update this notice if the way we use personal information changes. The date at the top shows when it was last updated.
13. Contact us
Musical StoryBox Ltd
6 Walsingham Dene, Bournemouth, Dorset, BH7 7RJ
Email: info@musicalstorybox.com
Phone: 07970 008856 or 07742 359292