Your information,
handled with care.

Who is responsible for your information

Galway Music Academy is the data controller for information collected through this website, enrolment enquiries and academy administration. Privacy questions and requests can be sent to galwaymusiclessons@gmail.com.

Information GMA collects

The static marketing website does not ask for personal information unless you choose to email GMA or open the enrolment service. An enrolment enquiry may include programme and location preferences, the student’s name and age, instrument, experience, preferred days, parent or guardian details where relevant, email address, phone number and an optional message.

The enrolment service also processes limited technical information required for security, including an IP address for short-lived rate limiting and a Cloudflare Turnstile verification token. The verification token and honeypot field are not retained with the enrolment record.

Why GMA uses this information

• To respond to an enquiry and recommend a suitable programme, tutor, location or time.
• To take steps requested before entering a teaching agreement and to administer that agreement after a place is accepted.
• To create and maintain student and family records in My Music Staff.
• To administer schedules, accounts, communications and payments.
• To protect forms and systems from spam, abuse and security threats.
• To meet accounting, safeguarding and other legal obligations.

Depending on the activity, GMA relies on consent, steps taken at your request before a contract, performance of a contract, legitimate interests in operating and securing the academy, or a legal obligation.

How enrolment information moves

The marketing website is hosted by SiteGround. The enrolment service is hosted on Railway and writes each valid submission to its SQLite database before attempting delivery. Zapier sends the enquiry to GMA’s workflow, My Music Staff lead records and notification email. Cloudflare Turnstile helps prevent automated abuse. If delivery fails after safe storage, authorised GMA staff can follow up from the stored record.

Service providers and international processing

GMA uses service providers including SiteGround, Railway, Cloudflare, Zapier, My Music Staff and its email provider. They process information only as needed to provide hosting, security, workflow, student administration or communications. Where a provider processes data outside the European Economic Area, GMA relies on the safeguards made available under the provider’s terms and data-processing arrangements.

GMA does not sell or trade personal information.

Cookies and tracking

The current marketing website does not deploy advertising or analytics cookies. The enrolment service uses Cloudflare Turnstile, which may use strictly necessary security technologies to distinguish people from automated traffic. There is no third-party behavioural advertising on the site.

If GMA adds analytics or advertising technology later, this policy and any required consent controls must be reviewed before that technology is enabled.

Retention and security

Enquiry information is kept only as long as needed to respond, manage follow-up and document the outcome. Information for enrolled students and families is retained for the teaching relationship and for any additional period needed for accounting, safeguarding or legal obligations. GMA periodically reviews records that are no longer required.

GMA uses encrypted HTTPS connections, access controls, limited staff access and privacy-safe operational logs. Operational logs do not deliberately include names, email addresses, phone numbers or free-text messages.

Children’s information

A parent or guardian should submit an enquiry for a child. The form asks for the parent or guardian’s name, email address and phone number and uses that information to consider and administer the requested music education.

Your GDPR rights

You may ask to be informed about the use of your information, obtain a copy, correct incomplete or inaccurate information, request deletion where applicable, restrict or object to certain processing, or request data portability where applicable. Where processing relies on consent, you may withdraw that consent without affecting processing that already took place lawfully.

You may also make a complaint to Ireland’s Data Protection Commission. Some information may need to be retained where required by law or necessary for an active teaching relationship.

Policy changes

This page will be updated if GMA changes how personal information is processed. Last updated 12 August 2026.