How we look after your family’s data.

Who we are

Fregaard Music Avenue, Fregaard Music Avenue Studios, Petaling Jaya, Selangor. Our data protection officer is Nadia Ismail (Director & DPO). Contact: hello@fregaard.example.

What we collect

• Parents and guardians (account holders): name, mobile number, email, billing details. Card and bank details are handled by Stripe; we never see or store your card number.
• Children (learners): first name and last initial, age band (not date of birth), instrument and level, and one optional medical note you choose to share. Children never have their own login.
• Lessons: attendance, what was covered, practice set, and progress ratings recorded by the teacher.

We deliberately do not collect a child’s full legal name, IC number, home address, school, photograph, ethnicity or religion.

Why we use it

• To arrange trial lessons and respond to enquiries.
• To schedule lessons, send reminders, and report progress to you.
• To invoice and take payment.
• To keep children safe, including handling safeguarding concerns.
• Marketing only if you opt in. You can opt out at any time.

Each consent you give is recorded against this notice’s version. We do not use data for any purpose you have not agreed to.

Who can see it

Teachers see only what they need to teach: your child’s first name, age band, level, medical note and lesson history. They do not see your phone number, email, address or payment details. Safeguarding records are visible only to the director and the data protection officer.

How long we keep it

• Account contact details and invoices: 7 years after the last transaction (statutory accounting).
• Learner records, lesson notes and assessments: 24 months after enrolment ends, then automatically deleted.
• Practice or assessment recordings: 30 days.
• Safeguarding and incident records: as required by law and legal advice.

Your rights

You can access, correct or export your data from the parent app at any time, withdraw consent, or ask us to delete data we no longer need. Email the data protection officer and we will respond within 21 days.

Security and breaches

Data is encrypted in transit and at rest, with stricter protection for children’s records and incident reports. If a personal data breach occurs that is likely to cause significant harm, we will notify the Personal Data Protection Commissioner within 72 hours and inform affected families without undue delay.

Last updated: version 1.0. Draft for review by the DPO before launch.