Who’s responsible for your data
I’m Sarah Kolb, a singing teacher working as a UK sole trader, and I’m the data controller for this site and for your booking details. If you have any questions about how your data is used, email hey@imsarahkolb.com.
What I collect, and why
When you browse the site. This site doesn’t use analytics, advertising trackers or social media pixels. Like any website, the server that delivers it automatically logs basic technical details of each request — your IP address, browser type and the page you asked for — so the site can be delivered securely and problems can be fixed.
When you book a lesson. The booking button takes you to my Calendly page, where you enter the details the booking form asks for (such as your name and email address). I use them to arrange and teach your lessons and to keep in touch about them. I need your name and email address to book a lesson; without them I can’t arrange one.
When you email me. I’ll receive your email address and whatever you include in your message, and use it to reply and to arrange lessons.
When you pay for lessons. Lessons are paid for directly to me, not through this website or the booking tool. After each lesson I send you an invoice (with your name, email address, the lesson date and the amount), and you pay by bank transfer, which shows me the payer’s name and bank reference. I keep invoices and payment records for my tax records.
Younger students and health information. If a student is under 18, a parent or guardian makes the booking and is my contact. If you choose to share health information, I’ll use it only with your explicit consent and only to plan your lessons. You can withdraw that consent at any time, and I’ll delete it if you do.
Testimonials. The testimonials on the homepage are from students, shown with their first name and initial and published with their permission. If you’ve given me a testimonial, you can withdraw your permission at any time and I’ll remove it from the website promptly.
The Instagram feed. The Instagram section of the homepage is loaded from Behold, and its images are served by Instagram (Meta). When it loads, your browser connects to their servers, so they receive your IP address and basic browser details. Instagram serves the images directly to your browser under its own privacy policy. I don’t receive any of this information.
Legal basis
I use your booking details, emails and invoices because they’re needed to arrange and provide the lessons you’ve asked for (contract, or steps you’ve asked me to take before one). Server logs and the Instagram feed rely on my legitimate interest in running a secure, working website that shows my teaching. I keep invoices and payment records for tax purposes because the law requires it (legal obligation). Testimonials are published with your consent, and any health information you share is used only with your explicit consent; you can withdraw either at any time.
Who I share data with
I share data with these services and people:
- Vercel — hosts the website and keeps the server logs described above. Vercel privacy notice.
- Calendly — handles lesson bookings on my behalf. It receives the details you enter on the booking form. Calendly privacy notice.
- My email provider — stores and delivers the emails you send me and my replies.
- My bank — receives your bank transfer when you pay for a lesson.
- Accounting — any software or adviser I use to prepare invoices and keep my accounts, and HMRC if it asks.
- GitHub — stores the website’s content, including testimonials, in a private repository. GitHub privacy statement.
- My web developer — maintains the site and has access to its content and hosting.
- Behold — provides the Instagram feed on the homepage. Behold privacy policy.
- Instagram (Meta) — serves the feed’s images directly to your browser under its own policy. Instagram privacy policy.
Calendly’s own privacy notice covers its cookies and how it runs its website. If you follow a link to Instagram or another site, that site’s own privacy policy applies. I don’t sell your data to anyone or use it for advertising.
Data stored outside the UK
Vercel and Calendly are based in the USA and are certified under the UK Extension to the EU–US Data Privacy Framework, which UK law recognises as protecting your data. Some other providers, such as my email provider, GitHub and Behold, may store data outside the UK. Where they do, the transfer is protected by a safeguard recognised under UK law, such as the UK Extension to the Data Privacy Framework or UK-approved contract terms. To ask for details or a copy, email hey@imsarahkolb.com.
How long I keep it
Booking details and emails are kept for up to 12 months after our last lesson or contact, then deleted, unless they’re needed as part of my tax records.
Invoices and payment records are kept for at least 5 years after the 31 January tax return deadline for the tax year they relate to, as HMRC requires of sole traders, and then deleted.
Testimonials stay on the site until you ask me to remove them, and then they’re removed from the website promptly. A copy may remain in the site’s private version history, which only I and my web developer can access. Server logs are kept for the periods Vercel sets (see Vercel’s log retention limits).
Your rights
Under UK data protection law you have the right to ask me to:
- See what data I hold about you
- Correct anything that’s wrong
- Delete your data (subject to legal retention rules)
- Limit how I use your data
- Receive your data in a portable format
- Object to how I use your data
Where I rely on your consent, you can withdraw it at any time. To make any of these requests, email hey@imsarahkolb.com. I’ll respond within one month.
Complaints
If you’re not happy with how I’ve handled your data, please talk to me first and I’ll do my best to put it right. You can also complain to the UK’s data protection regulator, the Information Commission (formerly the Information Commissioner’s Office), at ico.org.uk.
Cookies
This site doesn’t use cookies or store anything on your device, and neither does the Instagram feed. The only exception is a strictly necessary sign-in cookie and local storage, used only by the people who edit the site (set when they sign in to the site’s editing page). The editing page also loads its software from unpkg.com. Calendly and Instagram set their own cookies when you visit their sites.
Changes to this policy
I’ll update this page if I change how I handle your data, and the “last updated” date at the top will change too.