Privacy Policy

I am Greg Kaighin, a self-employed piano teacher trading as Online Piano Lessons with Greg Kaighin. I am the data controller for the personal information described here, which means I decide what is collected and why.

You can reach me at gkpianolessons@gmail.com about anything on this page, including a request to see or delete your data. My full contact details are in Contact details below.

Only what the site actually needs:

• When you create an account: your name, email address and a password. Passwords are stored hashed by my authentication provider — I never see them and cannot recover them.
• Optionally on your profile: a phone number, if you choose to add one.
• When you book a lesson: which slots you booked, when, whether it was a single lesson or a package, its payment and cancellation status, and any note you add to the booking.
• When you pay: a payment reference and the amount. Your card details never reach this website. They are entered directly into a secure form hosted by Stripe, and I never see or store your full card number.
• When you use the contact form: your name, email address and message.

There are no analytics, advertising or tracking scripts on this site. I do not build a profile of you, and I do not sell or share your data for marketing.

• To provide the lessons you book — managing your account, holding your slot, taking payment, sending confirmations and reminders, and adding lessons to my teaching calendar. Lawful basis: performance of a contract with you.
• To reply to your enquiry when you use the contact form. Lawful basis: legitimate interests — answering someone who has asked me a question.
• To keep records of payments for tax and accounting. Lawful basis: legal obligation.
• To keep the site working and secure — diagnosing errors, and preventing abuse of the booking and contact forms. Lawful basis: legitimate interests in running a functioning service.

I do not send marketing emails. You will only hear from me about lessons you have booked or a message you have sent.

This site sets no tracking or advertising cookies, which is why you are not asked to accept any. If you log in, a small number of strictly necessary cookies keep you signed in and protect the forms from abuse. These are exempt from the consent requirement because the site cannot work without them.

I use a small number of established service providers to run the site. They process data on my instructions only, and none of them are permitted to use it for their own purposes:

• Supabase — the database and login system that stores your account, bookings and messages.
• Stripe — payment processing. Stripe receives the payment amount and a reference to your booking, and handles your card details directly. Stripe is also a data controller in its own right for payment and fraud-prevention purposes.
• Resend — sends booking confirmations, cancellation notices and receipts to your email address.
• Vercel — hosts the website.
• Google Calendar — my own teaching calendar. A booked lesson creates an entry containing your name and the lesson time, so I know who I am teaching and when.
• Sentry — error monitoring, so faults get noticed and fixed. Session recording is deliberately switched off.

Some of these providers operate outside the UK. Where that happens, the transfer is covered by the safeguards UK data protection law requires, such as the International Data Transfer Agreement or an adequacy decision.

I teach children as well as adults, and I am DBS-checked — my certificate is available on request.

Accounts on this site must be held by someone aged 18 or over. If the lessons are for a child, the parent or guardian creates the account, makes the booking and pays. The account and its data belong to that adult. A child should not create an account or book lessons themselves.

If you tell me a pupil's first name so I know who I am teaching, I keep it only as part of the booking, and only for as long as the lessons continue.

• Account and booking records: while your account is open, and then deleted on request.
• Payment and invoice records: six years, which is how long UK tax rules require business records to be kept. This applies even if you close your account.
• Contact form messages: kept while the enquiry is active, and deleted once it is clearly finished.
• Backups: the database is backed up daily and each backup is deleted after 14 days, so deleted data disappears from backups within that window.

Under UK data protection law you can ask me to:

• give you a copy of the personal data I hold about you;
• correct anything that is wrong;
• delete your data — though I have to keep payment records for the six years described above;
• restrict or object to how I use it;
• provide it in a portable format you can take elsewhere.

Email me at gkpianolessons@gmail.com and I will respond within one month. There is no charge.

If you are unhappy with how I have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk, or by calling 0303 123 1113. I would appreciate the chance to put things right first.

The site is served over HTTPS. Access to your bookings and account is restricted at the database level so that one customer cannot read another's data, and administrative access is limited to me. Card details are handled entirely by Stripe and never pass through this site.

Greg Kaighin, trading as Online Piano Lessons with Greg Kaighin, a sole trader based at 10 Putnoe Heights, Bedford, Bedfordshire, MK41 8EB, United Kingdom.

Email gkpianolessons@gmail.com or telephone 07704 849036.

If this policy changes, the “last updated” date above will change with it.