Privacy Policy
What Cool Gool Music collects when you enquire, register or send in a student profile — why we hold it, who ever sees it, and how to get it changed or deleted.
Who we are
Cool Gool Music is the guitar, bass, ukulele and music-theory tuition practice of Malcolm Callus, based in London SE16 and teaching worldwide online.
For the purposes of UK data protection law, the data controller is Malcolm Callus, trading as Cool Gool Music, 3 Tillett Square, London SE16 6HR, United Kingdom.
- Email: guitar@malcolmcallus.com
- Phone: Call +44 7983 868507 (please don’t Whatsapp)
- Post: 3 Tillett Square, London SE16 6HR
This policy covers malcolmcallus.com and the tuition services booked through it. It is written to the UK GDPR and the Data Protection Act 2018.
The short version
We are a one-person music school, not a data business. We collect what we need to teach you and nothing else. We do not run any analytics, advertising or tracking scripts on this site. We do not sell, rent or trade anybody’s details, ever. If you want your data out of our hands, email us and we’ll do it.
What we collect, and why
1. One-to-one lesson registration — the registration page
The registration form asks for:
- Your name and surname — and, for Parent & Child courses, the names of both the parent/guardian and the child
- Your email address and telephone number
- Your age
- Your address (house name or number and street) and postcode
- Which instrument or subject you want to learn, and whether you want individual or group lessons
- The days and times you are available, and the month and year you would like to start
- Some musical background — genres you like, players or bands you love, why you want to play, and whether you already own an instrument
- Where you heard about Cool Gool Music, including the name and contact of anyone who referred you (this is how the referral reward is paid)
Why: to reply to you, to work out whether we can teach you at a time that suits, to plan lessons around your level and taste, to travel to the right address if you have chosen lessons at yours, and to credit whoever referred you.
2. Group course registration — the group lessons page
The group form asks for your name, email address, telephone number, the course modules you want, and your confirmation that you have read the group lesson information and agreed to its terms.
Why: to place you on the right course, to reach you when a group fills or a date changes, and to keep a record that the course terms were accepted.
3. Student profiles — the Students page
Existing students can send in a short profile for the Students page: a name, an age, a line about what they listen to and play, the gear they own, the bands they’re in, a quote, and optionally a photo or video. There is a separate section on this below — see photos, names and under-18s.
4. Enquiries by email or phone
If you email guitar@malcolmcallus.com or call, we hold whatever you choose to tell us for as long as it takes to deal with your enquiry and to keep a sensible record of our dealings with you.
5. Payment information
We do not collect or store card numbers. Payment is by bank transfer or PayPal (see Fees). If you pay by bank transfer we will see your name and the reference you use, on our bank statement. If you pay by PayPal, PayPal handles the transaction and we see only what PayPal shows us — typically your name, the amount and a transaction ID.
6. Lesson recordings
Lessons are sometimes filmed, as set out in the consent terms on the group lessons page — to improve the teaching, and, where consent has been given, so that short excerpts and lesson photos can be used to promote Cool Gool Music. Tell us if you would rather not be filmed and we will not film you.
7. Server logs
Like every website, this one sits on a web server that keeps standard access logs — IP address, date and time, the page requested, and your browser’s user-agent string. These are generated automatically, are used only for security and for diagnosing faults, and are not used to build any profile of you.
Our lawful bases for using your data
Under the UK GDPR we must have a lawful basis for every use of your personal data. Ours are:
- Contract — arranging, delivering and invoicing lessons you have booked, and dealing with your registration enquiry as a step towards that contract.
- Legitimate interests — replying to enquiries, keeping simple records of who we teach and when, running the referral reward, and keeping the site secure. We have considered your interests and rights, and none of this is anything you would not reasonably expect from a music tutor you have contacted.
- Consent — publishing a student’s name, age band, photo or video on the Students page, publishing a testimonial on the Testimonials page, and using lesson footage or photos for promotion. Consent can be withdrawn at any time, and withdrawing it does not affect the lessons themselves.
- Legal obligation — keeping financial records for the period HMRC requires.
Who your data is shared with
We do not sell, rent, trade or otherwise pass your personal data to anybody for marketing. There is no third party buying, receiving or profiling data from this site.
The only organisations that ever touch it are the ones needed to actually run the business:
- Google (Gmail) — when you send a form on this site, the contents are emailed to our mailbox, which is a Google-hosted account. Google therefore processes your form submission as our email provider.
- Our mail server — outgoing mail is relayed through mail.malcolmcallus.com.
- PayPal — if you choose to pay by PayPal, you are taken to PayPal’s own site to complete the payment. PayPal is a separate data controller for that transaction and has its own privacy policy.
- Our bank — if you pay by bank transfer.
- Our web hosting provider — the server this site runs on, which holds the site database and the standard access logs described above. The server is located in Germany, inside the EEA.
- Professional advisers and HMRC — accountants and the tax authority, in respect of financial records, where we are required to.
We will also disclose personal data if we are required to by law, or where there is a safeguarding concern about a child and disclosure to the police or a local authority is necessary to protect them.
Transfers outside the UK
Our web server is in Germany. Google and PayPal are international companies whose infrastructure may process data outside the UK, including in the United States. Where that happens, those providers rely on the UK’s international data transfer safeguards — such as the UK Addendum to the EU Standard Contractual Clauses and, for participating US organisations, the UK Extension to the EU–US Data Privacy Framework.
How long we keep it
Nothing you submit through this website is stored in the website’s own database. The forms email their contents to us and then discard them — a submission is held on the web server only for a few minutes, and only if the form needs to show you a validation error. Any photo you attach to a student profile is deleted from the server as soon as the email carrying it has been sent.
What we keep, we keep in our mailbox and our records:
- Enquiries that don’t turn into lessons — kept for up to 12 months, then deleted.
- Current students — kept for as long as you are having lessons.
- Former students — basic contact and lesson history kept for up to 3 years after your last lesson, so we can pick up where we left off if you come back. Ask us and we will delete it sooner.
- Financial records — kept for 6 years after the end of the tax year they relate to, as HMRC requires.
- Published profiles and testimonials — kept on the site until you ask us to take them down.
- Server access logs — kept for a short period on a rolling basis for security and fault-finding.
Children, photos and names on this site
We teach children, so we take this part seriously. This section explains exactly what appears publicly about a young student, what consent we need, and how to have it removed — no questions asked.
Registering a child for lessons
If the student is under 18, the registration form should be completed by a parent or guardian, and it asks for the names of both the parent/guardian and the child. We rely on the parent or guardian’s consent and instruction, not the child’s. Nobody under 13 should send us personal information through this site without a parent or guardian doing it with them.
The Students page
The Students page celebrates the people who learn here. For anyone under 18, we publish only a first name and a last initial, and an age band — for example “Charlie W., age 8–12”. We do not publish a minor’s full surname, their exact age, their address, their school, or any other detail that would help identify them, and we do not publish photographs or video of under-18s on that page.
Adult students who send in their own profile are treated differently: submitting the form is taken as their consent to publish their name, age and any photo they chose to send. Adults can withdraw that at any time, the same as anyone else.
The student profile form carries its own consent checkbox for under-18s, confirming that the person submitting is the parent or guardian and consents to what is published. If we are not satisfied that a parent or guardian has consented, we don’t publish.
The Testimonials page
Reviews on the Testimonials page are attributed by first name — and sometimes a surname — plus a role, such as “Paul, parent of an electric guitar student”. Where a parent has written about their child, the child is never named: no first name, surname, age, address or photograph. Testimonials are published because the person who wrote it asked us to or agreed to it, and any of them can be pulled down on request.
Lesson video and promotional media
The consent terms on the group lessons page cover filming lessons and using short excerpts and lesson photos to promote Cool Gool Music. That consent is given by the student or their guardian and can be withdrawn at any time, in writing, without affecting the lessons. If you withdraw it, we stop using the material going forward and remove it from anywhere we control.
Taking something down
You do not need a reason and you do not need to justify it. Email guitar@malcolmcallus.com with the page and the name, and we will remove it. We aim to have it off the site within 3 working days, and in any event within one month.
Bear in mind that search engines and web archives keep their own copies of pages. Once we have taken something down we can ask Google and the others to refresh their index, but we cannot control third-party caches directly.
Malcolm Callus holds an Enhanced DBS check.
Your rights over your data
Under the UK GDPR you have the right to:
- Be informed about how your data is used — that is what this page is for.
- Access a copy of the personal data we hold about you.
- Rectification — have anything inaccurate corrected, and anything incomplete completed.
- Erasure — have your data deleted, where we have no overriding reason to keep it (financial records being the usual exception).
- Restrict processing — ask us to hold your data but stop using it, while something is being sorted out.
- Data portability — receive the data you gave us in a common, machine-readable format.
- Object to processing we carry out on the basis of legitimate interests.
- Withdraw consent at any time, where we relied on consent — for example, to publish a photo, a profile or a testimonial.
There is no automated decision-making or profiling on this site.
How to exercise them
Email guitar@malcolmcallus.com and say what you want. Put “Privacy request” in the subject line if you like, though we’ll spot it either way. We may ask a question or two to make sure we’re talking to the right person, particularly where a request concerns a child.
It’s free, and we will respond within one month. If a request is unusually complex we may extend that by a further two months, and we will tell you if so.
If you’re not happy
Tell us first and we will try to put it right. You also have the right to complain to the UK’s data protection regulator, the Information Commissioner’s Office, at any time:
- ico.org.uk/make-a-complaint
- Helpline 0303 123 1113
- Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Keeping it safe
The site is served over HTTPS, so anything you type into a form is encrypted in transit. Form submissions are protected against automated abuse by a hidden honeypot field and a timing check rather than by a CAPTCHA — which means no third-party CAPTCHA provider gets to see you either.
The website software and server are kept up to date, access to the mailbox and the site’s admin area is limited to Malcolm and password-protected, and student information is not shared with other students or with anyone else.
No system is perfect. If you ever believe your data has been compromised through us, tell us immediately at guitar@malcolmcallus.com and we will investigate, and report it to the ICO within 72 hours where the law requires it.
Links to other sites
This site links out to social media profiles, review directories and other musicians’ pages. Once you follow a link away from malcolmcallus.com you are on somebody else’s site, under their privacy policy, and this one no longer applies.
Changes to this policy
If we change how we handle personal data, we will update this page and change the “last updated” date at the top. This version is dated 5 August 2026.
Any question about your data?
Ask directly — including “please take that photo down”. No form, no ticket, no reason needed.