Contact us
Privacy Policy

Commitment to Transparency, Security, and Respect for Your Data.

1. Introduction and Scope of Policy

DANDYS PARLOUR ARTS AND MUSIC (DPAM) is a non-profit organization located at 2519 MISSION STREET, SAN FRANCISCO, CA 94110-0000, dedicated to inspiring creativity and fostering collaboration through diverse artistic expressions. We recognize that our community—comprising students, parents, volunteers, donors, and partners—entrusts us with their personal information, and we are profoundly committed to protecting the privacy and security of that data. This Privacy Policy outlines the types of information we collect, how we use and share it, and the robust measures we take to safeguard your data in all aspects of our operations, both online and within our physical facility. This document applies to all interactions with DPAM, including but not limited to, the use of our website, digital communications, program enrollment forms, fundraising activities, and participation in our events and workshops. By engaging with DPAM and utilizing our services, you acknowledge and consent to the practices described in this policy. We maintain a professional, yet compassionate, approach to data governance, believing that transparency is the bedrock of trust within our collaborative arts community. This policy is effective as of November 3, 2025, and supersedes all prior privacy statements related to DPAM. We encourage all users to review this policy periodically as our operations and services evolve.

2. The Information We Collect

DANDYS PARLOUR ARTS AND MUSIC collects various categories of information, which can be broadly classified into information you voluntarily provide to us and information collected automatically through digital interactions. The specific type of information gathered depends entirely on the nature of your interaction with the organization. We adhere to the principle of data minimization, collecting only the information strictly necessary to fulfill our mission, provide educational services, process transactions, and maintain the safety and security of our community at 2519 MISSION STREET.

A. Information Voluntarily Provided By You

When you choose to engage with DPAM through enrollment, donation, or communication, you directly provide us with the following data points, which are essential for service delivery and regulatory compliance:

  1. Personal Identifiers and Contact Information (Mandatory for Enrollment): This category includes your full legal name, the names of enrolled students (if applicable), physical mailing address, primary telephone number, and email address (e.g., info@dpam.lat). For students, we also collect date of birth (crucial for age-appropriate program placement and compliance with child safety regulations), and in the context of our multi-user engagement platforms, a user-generated username or unique internal identification number is assigned. This information is used fundamentally for account management, direct communications regarding class cancellations or performance updates, and administrative record-keeping.
  2. Sensitive Personal Information (Required for Safety and Accessibility): To ensure a safe, inclusive, and effective learning environment, we collect specific details related to health and special needs, particularly for minor students. This may include known allergies (e.g., food, materials used in visual arts studios), medical conditions relevant to physical activity (e.g., asthma, hearing impairments), and information pertaining to any special educational or accessibility accommodations required within the classroom or performance hall. This information is treated with the highest level of confidentiality, access to which is strictly limited to authorized faculty and safety personnel on a need-to-know basis, solely for the purpose of protecting the individual’s welfare and facilitating equitable access to our arts and music programs.
  3. Financial and Transactional Data (Required for Payment and Donations): When you pay for tuition, register for a workshop, purchase event tickets, or make a tax-deductible donation, we collect necessary payment information. This includes credit card numbers, expiration dates, and billing addresses. However, for security purposes, DPAM does not store or process full credit card numbers directly on our servers. All financial transactions are processed through secure, PCI-compliant third-party payment gateways (e.g., Stripe, PayPal), and we only retain transaction history, confirmation codes, the last four digits of the card number, and the billing name/address for accounting and reconciliation purposes, ensuring your financial security is maintained by industry-leading encryption protocols.
  4. Demographic and Optional Survey Data (Used for Grant Reporting): On an optional basis, and often in compliance with grant reporting requirements, we may collect non-mandatory demographic data, such as racial or ethnic background, gender identity, and household income bracket (primarily for needs-based scholarship applications). This data is typically aggregated and anonymized for use in reporting to funding bodies and internal strategic planning aimed at ensuring our programs remain representative of and accessible to the diverse San Francisco community we serve, reinforcing our mission of inclusivity.
  5. Content and Communications Data (Submitted via Email and Forms): Any information you include in an email to info@dpam.lat, in response to a faculty member’s query, or through feedback forms, survey responses, or online chat features is collected. This includes the content of the message, any attached files (e.g., portfolios, sheet music, application documents), and metadata such as the time and date of the communication, which helps us track and manage our operational responsiveness and service quality.

B. Information Collected Automatically

When you interact with the DANDYS PARLOUR ARTS AND MUSIC website or digital infrastructure, certain technical and usage data is automatically collected to optimize user experience, secure our systems, and analyze website performance:

  1. Technical Data: This includes the Internet Protocol (IP) address used to connect your computer to the internet, browser type and version (e.g., Chrome, Safari), time zone setting, operating system (e.g., Windows, iOS), and device type (e.g., desktop, mobile). This information is utilized for debugging, system administration, and securing our network against potential cyber threats, which is a critical aspect of protecting the integrity of all collected personal data.
  2. Usage Data (Analytics): We use tools (such as Google Analytics) to track and analyze your activity on our site. This data includes Uniform Resource Locators (URLs) leading to and from our site, pages viewed, time spent on each page, interaction patterns (e.g., clicks, scrolling behavior), performance downloads, and the length of visits to certain pages. This information is used strictly in an aggregated, non-personally identifiable form to understand audience preferences, measure the success of marketing campaigns, and continuously improve the navigational flow and content relevance of our website, thereby enhancing the user experience and supporting our outreach mission.
  3. Cookies and Tracking Technologies: Our website, like most modern sites, uses “cookies,” which are small text files stored on your device by your web browser. These cookies serve functional purposes (e.g., maintaining your login status, remembering your preferred language settings) and analytical purposes (e.g., tracking repeat visitors). You have the ability to accept or decline cookies through your browser settings, though declining functional cookies may negatively impact the performance and full feature accessibility of the DPAM website, potentially affecting your ability to enroll or donate effectively. We prioritize session-based and strictly necessary cookies that minimize long-term tracking.

3. How We Use Your Information

DANDYS PARLOUR ARTS AND MUSIC uses the collected personal information for multiple operational, educational, and mission-related purposes, all of which are aligned with the trust placed in us by our community. Our usage falls into the following five essential categories:

A. Provision of Educational and Artistic Services

The primary use of your information is to deliver the high-quality arts and music programs that form the core of our mission. This involves using student names and demographic data for class rostering and attendance tracking, ensuring compliance with instructor-to-student ratios, and facilitating effective lesson planning. Contact information is used by faculty to coordinate private lessons, notify parents of student progress or concerns, and manage rehearsals and performance schedules. Health and safety information is critically used to implement emergency procedures and provide necessary accommodations, ensuring a safe and inclusive learning environment for every individual at 2519 MISSION STREET. We also use student data to organize and promote performances, exhibitions, and recitals, which are vital components of the learning process and our commitment to collaboration.

B. Communication and Customer Service

We use your contact information to maintain robust and timely communication necessary for our operations. This includes sending administrative emails about class closures, scheduling changes, tuition invoices, and annual program updates. We also use communication data to respond directly to your inquiries submitted via info@dpam.lat or our web forms, providing effective customer service and technical support. We strive to maintain a warm and professional tone in all communications, reflecting the collaborative spirit of DPAM. This is distinct from marketing communications, as these operational messages are considered essential for participation in our programs and are not subject to standard marketing opt-out requests.

C. Fundraising, Marketing, and Outreach

As a non-profit organization, DPAM relies on community support to offer scholarships and maintain our facilities. We use demographic and transactional data to inform our targeted fundraising campaigns and appeals, inviting past donors and engaged community members to contribute to our mission. If you have opted in, we use your email address to send marketing communications, including newsletters, announcements about upcoming public performances, exhibition opening invitations, and special masterclass registration alerts. We utilize aggregated usage data to assess the effectiveness of our marketing and outreach efforts, helping us allocate resources efficiently to reach prospective students and donors who share our passion for the arts.

D. Safety, Legal Compliance, and Incident Reporting

A portion of our data usage is dedicated to ensuring the safety of our students, staff, and visitors, and maintaining full compliance with all local, state, and federal laws. We use student health data to create emergency contact cards and medical alerts for field trips or off-site performances. Technical data (IP addresses) is used to detect and prevent fraudulent activity, unauthorized access to our network, and compliance with data security laws. Should an incident occur, relevant data may be used for internal incident reporting, investigation, and, if required, disclosure to law enforcement or regulatory bodies, fulfilling our legal and ethical obligations to protect our community and the integrity of our organization.

E. Research, Analysis, and Program Improvement

We use anonymized and aggregated data, particularly survey responses and usage statistics, for internal research and analytical purposes. This data helps our Executive Team and Program Directors evaluate the success and reach of our current programs, identify areas of unmet community need, and plan future educational offerings. For instance, analyzing registration patterns might lead us to add a new class in digital music production or an advanced sculpture workshop. This continuous evaluation cycle is crucial for ensuring that DPAM remains at the forefront of arts education and continues to provide maximum value and alignment with our mission.

4. How We Share Your Information

DANDYS PARLOUR ARTS AND MUSIC is committed to keeping your personal information confidential, and we do not sell or rent user data to third parties for commercial gain. We only share information under specific, limited circumstances to operate our organization, fulfill our legal obligations, or provide the services you have requested.

A. Sharing with Service Providers

We engage trusted third-party service providers to perform essential functions on our behalf. These include:

  • Payment Processors: As noted, financial transactions are handled by PCI-compliant partners (e.g., Stripe, PayPal) to securely process tuition payments and donations. We share only the necessary transaction data with them to complete the payment.
  • Customer Relationship Management (CRM) Tools: We use CRM systems to manage donor records, student enrollment data, and communication tracking. These providers are contractually obligated to protect data using security measures no less stringent than our own and are prohibited from using the personal data for any purpose other than providing services to DPAM.
  • Cloud Hosting and IT Support: Our website, email services, and data storage infrastructure are often hosted by third-party cloud providers (e.g., Google Cloud, AWS). These providers adhere to strict data security standards and are essential for maintaining the continuous availability of our services.
  • Analytics and Marketing Platforms: We share non-personally identifiable usage data (e.g., through Google Analytics) with these partners to understand web traffic and campaign effectiveness.

B. Legal and Regulatory Requirements

We may disclose your personal information if required to do so by law or in the good faith belief that such action is necessary to:

  1. Comply with a legal obligation, subpoena, or court order.
  2. Protect and defend the rights or property of DPAM, including our intellectual property and physical assets at 2519 MISSION STREET.
  3. Act in urgent circumstances to protect the personal safety of users, the public, or our staff and students.
  4. Prevent or investigate possible wrongdoing in connection with our services.

C. Partnerships and Collaborative Activities

Consistent with our mission to foster collaboration, we may occasionally share information with trusted community partners, but only under highly controlled conditions. For instance, if a student participates in an off-site masterclass co-hosted with a local university, we may share the student’s name, age, and emergency contact details with the co-host for logistical and safety purposes. Similarly, aggregated, anonymized demographic data may be shared with grant-making foundations to demonstrate our impact and reach across the San Francisco community, without ever identifying individuals. Any sharing beyond the strict scope of service delivery is executed only under a formal agreement that requires the receiving party to maintain data confidentiality and security.

D. Business Transfers

In the event that DPAM were to merge with or be acquired by another non-profit organization, or if our assets were sold, your personal information may be transferred as part of the transaction. In such an event, we would notify you via email and/or a prominent notice on our website, and ensure that the recipient organization honors the terms of this Privacy Policy and maintains similar data protection standards.

5. Data Specific to Minors and COPPA Compliance

DANDYS PARLOUR ARTS AND MUSIC offers numerous programs for children under the age of 13, making compliance with the U.S. Children’s Online Privacy Protection Act (COPPA) a critical part of our data policy. We are absolutely committed to protecting the privacy of minors, and our procedures are designed to meet or exceed COPPA requirements.

A. Parental Consent and Collection Limits

DPAM does not knowingly collect any personal information online from children under the age of 13 without first obtaining verifiable parental consent. When a child under 13 enrolls in a program, the collection of their Personal Identifiers, date of birth, and sensitive health information is performed exclusively through the parent or legal guardian on the secure enrollment form. The parent must affirmatively acknowledge and consent to the collection and use of this information, which is necessary for participation, safety, and logistical management of the class. We limit the information collected from a child online to what is reasonably necessary to participate in the educational activity. For instance, a child might be asked to provide a first name only (or an anonymous username) in an online learning portal, but never a full name, address, or external contact information without parental consent.

B. Use of Information for Minors

The personal information of minors collected with parental consent is used solely for the following purposes:

  1. Safety and Emergency Contact: Utilizing health and allergy information for emergency preparedness at 2519 MISSION STREET.
  2. Educational Provision: Roster management, skill-level placement, and direct communication with the parent/guardian regarding the child’s progress.
  3. Internal Administrative Use: Record-keeping and auditing purposes.

We do not use the personal information of children under 13 for any direct marketing or advertising purposes, nor is this information sold, rented, or shared with third parties for their independent commercial use.

C. Parental Rights and Review

COPPA grants parents the right to control how their child’s personal information is collected, used, and disclosed. Parents or legal guardians have the right to:

  1. Review the personal information DPAM has collected about their child.
  2. Request deletion of their child’s personal information from our records, subject to our ability to fulfill the necessary safety and administrative obligations of enrollment (e.g., if deletion would compromise the child’s safety, the child may need to be withdrawn from the program).
  3. Refuse to permit the further collection or use of their child’s information, while allowing us to retain information collected up to that point.

To exercise these rights, the parent or guardian must submit a verifiable request in writing to the Privacy Officer at the contact information provided in Section 8. We will take reasonable steps to verify your identity as the child’s parent or guardian before fulfilling the request, which may require providing a copy of a government-issued ID or other verifiable documentation.

6. Data Security and Retention

The security of your personal data is a primary operational priority for DANDYS PARLOUR ARTS AND MUSIC. We implement a multi-layered approach to protect data from unauthorized access, loss, destruction, or alteration, across both our digital systems and physical records.

A. Security Measures

  1. Technical Safeguards: Our website and digital systems utilize SSL/TLS encryption for all data transmission. Data stored electronically is protected by firewalls, access control lists, and network monitoring tools. Sensitive data, particularly financial and health information, is pseudonymized or encrypted both in transit and at rest, rendering it unusable without the proper decryption key, which is maintained in a secure, isolated environment.
  2. Physical Safeguards: Access to the servers, administrative offices, and paper records at 2519 MISSION STREET is strictly limited to authorized personnel using key-card access and physical locks. Paper records containing sensitive data are maintained in locked filing cabinets and are destroyed using cross-shredding or incineration when no longer required.
  3. Administrative Safeguards: All DPAM employees, faculty, and authorized volunteers undergo mandatory annual privacy and data security training. Access to student and donor records is granted only on a need-to-know basis, enforced through unique user IDs and strong password protocols. We regularly audit our security procedures and update our systems to address evolving threats.

B. Data Retention Policy

DPAM retains personal information only for as long as necessary to fulfill the purposes for which it was collected, including satisfying any legal, accounting, or reporting requirements, and to meet our organizational mission.

  • Student Enrollment Records (including health/safety data): Retained for the duration of the student’s active enrollment plus a period of seven (7) years following the last date of enrollment, which aligns with standard non-profit educational and legal liability periods.
  • Financial and Transactional Data (Donor Records): Retained for a period of seven (7) years to comply with IRS and tax auditing requirements.
  • Website Usage Data (Anonymized): May be retained indefinitely for trend analysis and historical comparison.
  • Marketing Opt-Outs: Retained indefinitely to ensure we honor your preference not to receive future marketing communications.

Once the retention period expires, the personal information is securely destroyed, deleted, or anonymized so that it can no longer be associated with an identifiable individual.

7. Your Rights and Choices

Depending on your location and jurisdiction, you may have specific rights regarding the personal information DPAM holds about you. We commit to honoring these rights wherever possible, ensuring alignment with principles outlined in major global privacy frameworks like the GDPR and CCPA.

A. Right to Access and Correction (The Right to Know)

You have the right to request access to the personal information we hold about you and to receive a copy in a portable format, where feasible. You also have the right to request that any incomplete or inaccurate information about you be corrected promptly. Requests for access or correction should be submitted in writing to the Privacy Officer (see Section 8) and must include sufficient detail to allow us to verify your identity and locate the requested data.

B. Right to Deletion (The Right to Be Forgotten)

You have the right to request the deletion of your personal data when it is no longer necessary for the purpose for which it was collected, or if you withdraw your consent. Please note that this right is not absolute. We may be required to retain certain information to comply with legal obligations (e.g., tax records), resolve disputes, prevent fraud, or maintain safety records relevant to a minor’s participation in our programs. In such cases, we will inform you of the legal or operational necessity for retention.

C. Right to Opt-Out of Marketing Communications

You have the unqualified right to opt out of receiving marketing, fundraising, or promotional emails from DPAM. Every marketing email we send contains a clear, functional “unsubscribe” link at the bottom. Clicking this link will immediately remove your email address from our promotional mailing list. Please note that opting out of marketing does not opt you out of receiving essential administrative or service-related communications (e.g., payment reminders, class cancellation notices) as these are vital for your participation in our programs.

D. “Do Not Track” Disclosure

DPAM’s website does not currently respond to “Do Not Track” signals initiated by web browsers, as there is no consistent, universally accepted technical standard for what should be done when such a signal is received. We instead rely on the explicit consent mechanisms provided through our cookie banners and the opt-in features for our marketing communications to manage user tracking preferences transparently. We encourage users concerned about tracking to manage their cookie settings directly through their browser controls or by using third-party browser extensions.

8. Third-Party Links and External Websites

Our website and communications may occasionally contain links to external websites, such as partner organizations, grant funders, or educational resources (e.g., sheet music resources, online art galleries). DANDYS PARLOUR ARTS AND MUSIC is not responsible for the content or the privacy practices of any third-party websites or services. Once you leave the DPAM website, the data collection practices are governed by that third party’s own privacy policy. We encourage all users to carefully read the privacy statements of every website they visit, particularly those linked from our site, to understand how their personal information is collected, used, and shared by those external organizations. The inclusion of a link on our site does not imply endorsement or affiliation unless explicitly stated as a formal, documented partnership.

9. Changes to This Privacy Policy

DANDYS PARLOUR ARTS AND MUSIC reserves the right to update this Privacy Policy periodically to reflect changes in our operational procedures, legal obligations, or technological advancements. We will notify our community of any significant changes by posting the new policy on this page with a revised “Effective Date” at the top of the document. For material changes that significantly alter how we use or share previously collected personal information (e.g., changes to our COPPA procedures), we will provide more prominent notice, such as an email notification to affected users or a conspicuous banner on our website homepage, at least thirty (30) days prior to the changes taking effect. Your continued use of the DPAM services and website following the posting of changes constitutes your acceptance of those changes, ensuring that your understanding of our data practices remains current and consistent with our mission.

10. Contact Information for Privacy Concerns

If you have any questions, comments, concerns, or requests related to this Privacy Policy, our data handling practices, or to exercise your rights of access or deletion, please direct your communication to our designated Privacy Officer. We have established this formal channel to ensure all privacy-related inquiries are handled with the necessary diligence, security, and expertise.

Privacy Officer Contact Details:

Primary Email for Privacy Inquiries: privacy@dpam.lat (Monitored directly by the Executive Office)

Mailing Address: Privacy Officer DANDYS PARLOUR ARTS AND MUSIC 2519 MISSION STREET SAN FRANCISCO, CA 94110-0000

We commit to acknowledging all privacy-related correspondence within five (5) business days and to providing a substantive response or resolution plan within thirty (30) days, provided we have sufficient information to verify the requestor’s identity and jurisdiction. Your privacy is paramount, and we are here to address your concerns with transparency and integrity, in keeping with the trusting, collaborative nature of our arts and music community.