Privacy Policy (MCMA)

MCMA is the data controller for the processing described in this Policy. Contact: info@mcma.mt.

We may collect the following categories of personal data:

• Identity and contact data: name, email, phone, address, date of birth; and for Minors, Guardian contact details.
• Application/enrolment data: instrument, experience, placement information, attendance, progress records, assignments, communications.
• Online lesson data, where offered: session links/invitations, attendance logs, chat messages, shared files, and technical diagnostics necessary to deliver the session.
• Payment and invoicing data: transaction identifiers, billing details and records required for accounting/tax purposes. Card details are processed by our payment provider.
• Technical data: IP address, device/browser information, login/session data, and cookies necessary for authentication and security.
• Analytics data: aggregated usage metrics and performance/security logs for internal operations analytics. Where analytics use cookies or similar technologies that are not strictly necessary, consent will be requested.
• Images/audio/video: where you participate in performances, classes or events and recordings are made, and where content is published on our Website and/or official social media channels, subject to consent where required.
• Media consent preferences: your choices regarding photography/video/audio consent for educational and/or promotional use and, for Minors, Guardian consent records.
• Special categories, optional: health or accessibility information, such as allergies, injuries, or learning support needs, where provided and necessary for safety or reasonable accommodations.

We collect personal data directly from you or your Guardian, from forms on our Website, via email/phone, through the Portal, and from service providers such as payment confirmation and delivery metadata from hosting or communications services.

We process personal data under the GDPR for:

• Performing a contract, GDPR Art. 6(1)(b): enrolment administration, delivery of programmes including online sessions where offered, managing Portal access, scheduling, communications, and learner support.
• Legal obligations, GDPR Art. 6(1)(c): accounting/tax compliance, and responding to lawful requests.
• Legitimate interests, GDPR Art. 6(1)(f): operating, maintaining and improving our services and internal operations analytics, such as aggregated usage statistics, security monitoring and troubleshooting; protecting the Website/Portal and online sessions against misuse, fraud and unauthorised access, subject to safeguards and data minimisation.
• Consent, GDPR Art. 6(1)(a): marketing communications, promotional media use, photos/video, and any non-essential cookies or similar technologies.
• Special categories, GDPR Art. 9: where health/accessibility data is processed, we rely on explicit consent and/or vital interests where necessary for safety, and implement appropriate safeguards.

MCMA offers programmes for all ages. Where the Student is a Minor, we usually collect data via the Guardian and require Guardian involvement for enrolment and key decisions.

We do not knowingly conduct direct marketing to Minors. Where consent is required for Minors, such as promotional use of images or participation in optional recordings, we obtain it from the Guardian.

We may share data with:

• Payment processors, such as Stripe, to process payments.
• Hosting, database, authentication and communications providers, such as Vercel, Supabase and Google Workspace, to operate the Website/Portal and deliver communications.
• Online lesson platform providers, where used, to deliver remote sessions. These providers may process certain technical/usage data under their own terms and privacy policies.
• Tutors and staff as necessary to deliver programmes.
• Social media platforms where you or the Guardian have provided consent for promotional publication. These platforms may act as independent controllers.
• Professional advisers, including accountants, auditors and legal advisers, and authorities where required by law.

Some service providers, online lesson platforms and social media platforms may process data outside the EEA. Where this occurs, we use appropriate safeguards such as adequacy decisions, Standard Contractual Clauses and supplementary measures as required.

We keep personal data only as long as needed for the purposes described, including:

• Enrolment and learning records: for the duration of the programme and a reasonable period thereafter for administration and transcript/verification requests.
• Online lesson operational data: for a limited period necessary to provide the service, address technical issues, and maintain safeguarding/security, unless longer retention is required by law or agreed in programme terms.
• Promotional media: until consent is withdrawn or the media is no longer needed for the stated purpose, subject to practical limitations where media has been widely shared.
• Marketing: until you unsubscribe or withdraw consent.
• Accounting and tax records: for the period required by applicable Maltese law.
• Security and analytics logs: retained for a limited period appropriate to the risks addressed.

We implement appropriate technical and organisational measures to protect personal data, including access controls, encryption in transit where available, least-privilege access, and security monitoring. For online lessons, MCMA may use waiting rooms, meeting passwords, restricted links and participant controls where supported by the platform.

You have rights under the GDPR, including access, rectification, erasure, restriction, portability, objection, and the right to withdraw consent at any time. Requests can be sent to info@mcma.mt. We aim to respond within one month, subject to lawful extensions where applicable.

We use cookies and similar technologies. Strictly necessary cookies are used for authentication, security, and basic functionality. We also use internal operations analytics to understand how the Website/Portal is used and to improve performance. Our analytics may be implemented either without cookies, for example via server-side logs, or using cookies or similar technologies. Where analytics rely on cookies or similar technologies that are not strictly necessary, they will be used only with your consent. Where feasible, MCMA prefers privacy-preserving, aggregated analytics that do not identify individual users.

We send marketing emails/newsletters only where you have opted in or where permitted by applicable law. You can unsubscribe at any time using the link in our messages or by contacting us.

When we create photos/video/audio recordings, we may process personal data such as your image, voice and performance. For promotional use on our Website and official social media channels, we generally rely on consent, especially for Minors through Guardian consent. For educational use, such as learning review, we may rely on contractual necessity and/or legitimate interests depending on the context.

You may withdraw promotional consent at any time by contacting info@mcma.mt; we will take reasonable steps to stop future use and to remove content from our controlled channels where feasible. Please note that content shared on third-party social media platforms may be further shared by others and may be subject to the platform's own processing as an independent controller.

If you have concerns about our data handling, contact us first at info@mcma.mt. You also have the right to lodge a complaint with the Office of the Information and Data Protection Commissioner (IDPC): 2, Airways House, Second Floor, High Street, Sliema SLM 1549, Malta; website: https://idpc.org.mt/.

We may update this Privacy Policy from time to time. The "Last updated" date will be revised accordingly. Material changes will be communicated via the Website/Portal and/or email where appropriate.