> Privacy Retention Policy

BAMT Privacy Retention Policy

British Association for Music Therapy (BAMT or we) is committed to protecting and respecting your privacy.

This policy explains how we collect, use, store and share personal data, including information you provide to us directly and information collected through your use of our website. It should be read alongside our Terms of Use and Cookie Policy.

BAMT is the data controller for personal data relating to members, event attendees, donors, grant applicants, volunteers, employees, job applicants, website users, people who contact us, and other stakeholders. Our nominated employee for data protection is the Director of Operations. Our ICO registration number is Z1794347.

This policy reflects the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and, where relevant, the Privacy and Electronic Communications Regulations (PECR).

We will keep our privacy policy under regular review and will place any updates on this web page and, where appropriate, notify you by email. This privacy policy was last updated in October 2026.

We do not sell or trade personal data under any circumstances.

Key definitions
For the purposes of this policy, the following terms apply:

Personal data means any information relating to an identified or identifiable living individual. This may include a name, contact details, membership information, payment information, online identifiers, photographs, recordings, or other information that could identify someone directly or indirectly.
Special category data means more sensitive personal data that requires additional protection. This includes information about racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data used for identification, health, sex life or sexual orientation. Information about criminal convictions and offences is also subject to additional protections under UK data protection law.
Data controller means the organisation or person that decides why and how personal data is collected, used, stored, shared or otherwise processed. In most cases, BAMT is the data controller for the personal data described in this policy.
Data processor means an organisation or person that processes personal data on behalf of a data controller and only in line with the controller’s documented instructions. This may include third-party systems or service providers that support BAMT’s work.

How we use personal data
We only use personal data where we have a lawful basis for doing so under UK data protection law. Depending on the activity, this may include:

contract: where processing is necessary to provide membership services, event bookings, publications, grants, purchases or other services requested from BAMT;
legal obligation: where processing is necessary to comply with legal, regulatory, accounting, employment, safeguarding or reporting obligations;
legitimate interests: where processing is necessary for BAMT’s charitable and organisational purposes, provided these interests are not overridden by your rights and freedoms;
consent: where we ask for your permission, for example for certain communications, optional profile visibility choices, survey participation, or non-essential cookies;
vital interests: where processing is necessary to protect someone’s life or safety; and
public task or substantial public interest conditions where relevant to specific safeguarding, regulatory, equality, professional standards, or legal obligations.

Where we process special category data, we will also identify an additional condition under Article 9 of the UK GDPR and, where required, a condition under the Data Protection Act 2018. We will only collect and use special category data where it is necessary and proportionate for the relevant purpose.

Will we disclose the information we collect to outside parties?
In order to fulfil our membership agreement with you, deliver services, manage events, communicate with members and stakeholders, and carry out BAMT’s charitable and organisational work, we may share relevant information with trusted service providers. This may include, for example, website hosts and managers, membership database providers, email and bulletin platforms such as Mailchimp, payment processors, journal publishers, IT support providers, cloud storage providers, professional advisers, auditors, HR support, and event or survey platforms.

We require service providers who process personal data for BAMT to handle it securely, only for the agreed purposes, and in line with data protection law and our documented instructions. Where we use service providers, we will make sure appropriate contracts and controls are in place

We may also need to disclose information if required by law, for example to government bodies, law enforcement agencies, regulators, professional bodies, safeguarding authorities, or the courts. We may also share information where this is necessary to protect someone from harm, to investigate concerns, or where you have given us permission to do so.
Please note, by donating or making payments via our website, your financial and/or personal information may be passed to third-party organisations necessary to process your transaction with BAMT, such as card providers, banks and payment platforms. BAMT does not store full card details.

International transfers
Some of the systems and service providers we use may process personal data outside the UK. Where this happens, we will take steps to ensure that appropriate safeguards are in place, such as an adequacy decision, International Data Transfer Agreement, UK Addendum to the EU Standard Contractual Clauses, or other safeguards recognised under UK data protection law.

How do we store and protect your personal information?
We take appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage. These measures may include secure systems, access controls, password protection, encryption where appropriate, secure payment processing, staff guidance, limited access on a need-to-know basis, and regular review of the systems we use.

Staff and volunteers must use BAMT-approved systems for BAMT business wherever possible and should not use personal email accounts or personal storage to process BAMT personal data. Where we use online forms, event booking, membership or payment systems, we use secure services and appropriate controls.

Where we have given you, or where you have chosen, a password that enables you to access the Members’ Area of our site, you are responsible for keeping this password confidential. We ask that you do not share this with anyone.

Data retention
We will only keep personal data for as long as necessary for the purposes for which it was collected, including to meet legal, accounting, regulatory, safeguarding, professional standards, audit and reporting requirements. Retention periods vary depending on the type of information and the reason it is held.
Examples of our retention approach include:

financial records are normally kept for 6 years after the financial year end for accounting and auditing purposes;
membership records are kept for the duration of membership and for a reasonable period afterwards to manage queries, renewals, professional records, complaints, safeguarding concerns, or legal obligations;
event attendance data is reviewed regularly and deleted or anonymised when it is no longer needed, unless we need to retain it for CPD, financial, safeguarding, evaluation or legal purposes;
job application information for unsuccessful applicants is normally held for 12 months after recruitment has ended;
contact enquiries, including enquiries about finding a therapist, are normally retained for six months after the enquiry has been dealt with, unless a longer period is needed for safeguarding, complaints, legal or organisational reasons; and
survey data may be anonymised or aggregated where possible and retained for research, reporting, service improvement or organisational learning.

Where a specific retention period is not set out in this policy, we will determine the appropriate period by considering the amount, nature and sensitivity of the data, the potential risk from unauthorised use or disclosure, the purposes for which we process it, and any legal or regulatory requirements.

Data breaches
If a personal data breach occurs, BAMT will assess the nature and severity of the breach and take appropriate action to contain it, reduce risk, and investigate what happened. Where a breach is likely to result in a risk to individuals’ rights and freedoms, we will report it to the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of it, where feasible. Where a breach is likely to result in a high risk to individuals, we will also inform affected individuals without undue delay.

Membership

How do we collect information?

We obtain personal information from you when you register as a member of BAMT, renew your membership, update your profile or preferences, contact us, attend activities, participate in surveys, or otherwise engage with BAMT services.

What information do we collect?

We would collect the following information from you;

name;
contact details, including address, telephone number, email address and relevant social media details where provided;
bank, card and payment details, where needed to process payments;
membership category, membership status and subscription information;
union membership, where relevant to the services or arrangements you request;
HCPC registration number and/or details of registration with other professional bodies;
employment, role, practice, service or professional information;
profile visibility preferences;
how you heard about us;
your feedback on our services; and
any other information you choose to provide to us in connection with your membership or BAMT activity.

How do we use this information?

We will use your personal information:

to create and administer your membership account;
to administer your contact details and give you the opportunity to change your preferences, amend errors, update your data and manage your membership fee;
to send you bulletins, events information, AGM notices, publications information, area group and network information, CPD and event information, research project information, surveys and other communications relevant to BAMT’s charitable and membership purposes;
to provide you with services, products or information you have requested, including private practice requests, area and network information, publications and membership services;
to further our charitable aims, including research, fundraising, advocacy, professional representation and generating statistics about the profession, using aggregated or anonymised information where possible;
to share updates from area and network coordinators, where relevant to your membership and preferences. You can opt out of receiving these updates at any time by contacting info@bamt.org;
to share relevant information with our publishers and editorial teams for the British Journal of Music Therapy (BJMT), where required for publication and distribution;
to manage complaints, professional concerns, safeguarding concerns, conduct issues or other matters raised with BAMT; and
to meet legal, regulatory, accounting and governance obligations.

How do we store your personal information?

Membership data is stored and managed through BAMT’s membership and website systems, supported by our service providers. Access is limited to those who need it for BAMT purposes and is protected by appropriate security controls.

How we disclose the information we collect to outside parties?

As indicated above, we may pass your information to service providers, agents and associated organisations for the purpose of completing tasks and providing services to you. Where we use service providers, we will make sure there are appropriate contracts and controls in place.

We may disclose your information if required by law, where necessary to protect someone from harm, to manage a complaint or safeguarding concern, to work with regulators or professional bodies, or where we have your permission to do so.
Members have control over their membership profile visibility settings. We will only make membership profile information visible to other members or to the public according to the visibility options you choose, where such functionality is available. You can change your visibility preferences during your membership by updating your profile or contacting BAMT.

Volunteers

How do we collect information?

We obtain personal information from you when you enquire about volunteering, offer support, take part in BAMT activities, send or receive an email, ask a question or otherwise provide us with personal information. We may also receive information from third parties, for example where you have asked someone to provide a reference.

What information do we collect?

We may collect your name, contact details, relevant experience or role information, information about the activities you support, how you heard about us, feedback from our services and any other information relevant to volunteering with BAMT.

How do we use this information?

We will use your personal information to provide information you have requested, administer your contact details and preferences, manage volunteering activity, contact you about future volunteering opportunities where you have agreed to this, and meet our legal, safeguarding, insurance and governance obligations. You can opt out of volunteering updates at any point by contacting info@bamt.org.

Survey responders

How do we collect information?

We obtain personal information from you when you respond to our surveys, consultations or feedback exercises.What information do we collect?

What information do we collect?

Depending on the survey, we may collect your name, contact details, membership or professional information, demographic information, how you heard about us, your feedback, and any other information that relates to the survey. We will make clear where questions are optional and where we are collecting special category data.

How do we use this information?

We will use this information to provide services or information you have requested, understand and improve our services, inform policy and professional activity, invite future participation where appropriate, and understand communication preferences. We will anonymise or aggregate survey data where possible before using it for wider reporting.

Donors

How do we use this information?

We will use donor personal information to provide services, products or information requested; administer contact details and preferences; process donations and Gift Aid; further our charitable aims, including fundraising activities; send information about future opportunities to support BAMT where permitted; conduct surveys; understand how we can improve our services and information; and ensure we know how you prefer to be contacted.

Website Visitors

Our website uses cookies to distinguish you from other users of our website, provide core functionality, understand how people use our website and improve the experience we provide. Some cookies are necessary for the website to function. Others, such as analytics or marketing cookies, are non-essential and will only be used where we have the appropriate consent.

Cookies may include:

strictly necessary cookies, which are needed for the website to work;
preference or functionality cookies, which remember choices you make;
analytics cookies, which help us understand how visitors use the website; and
third-party cookies, which may be set by services embedded in or linked from our website, such as social media, video, payment, mapping, ticketing or analytics tools.

We use analytics tools, such as Google Analytics, to help us understand site user interaction, including how many people use the website, how they find our pages and which pages are used most often. Analytics information is used to improve our website, services and communications. We will configure analytics tools in line with available privacy settings and cookie consent requirements.

You can manage cookie preferences through our cookie banner or cookie settings where available. You can also control cookies through your browser settings, clear cookies after browsing, use a tracking blocker, or use available opt-out tools such as the Google Analytics opt-out extension. For detailed information on the cookies we use and the purposes for which we use them, please see our Cookie Policy.

Our site may contain links to and from the websites of partner networks, advertisers, affiliates, funders or other third parties. If you follow a link to any of these websites, please note that they have their own privacy policies and that we do not accept responsibility or liability for those policies. Please check these policies before you submit any personal data to those websites.

Event attendees & Speakers

How do we collect information?

We obtain personal information from you when you register for a BAMT event, including conferences, CPD, webinars, meetings and other activities.

How do we use this information?

We will use this information to administer the event, manage bookings, send joining instructions and event updates, support access requirements, process payments, keep appropriate attendance and CPD records, evaluate events, and contact you about similar events in future where permitted.

If you are a speaker, contributor or facilitator at a BAMT event, we may publicly promote your involvement through our website, email communications and social media channels such as Facebook, LinkedIn, Bluesky, X or other platforms used by BAMT. Information published on third-party platforms will also be processed by those platform providers according to their own terms and privacy policies.

Trainees/Researchers applying for Small Grants

How do we collect information?

We obtain personal information from you when you apply for the BAMT Small Grants scheme or related funding opportunities.

How do we use this information?

We will use your personal information to assess your grant application, communicate with you, request further information, make payments where relevant, administer reporting requirements, and meet accounting, audit, governance or funder obligations.

Social media users

You may come across BAMT on social media through your own networks or by engaging with our pages, posts or messages. Social media is a valuable tool for BAMT and for the community we serve, but it is provided by commercial third-party platforms. Information shared on timelines, comments, pages, groups, direct messages or other social media functions may be processed by the platform provider for its own purposes.

Please avoid sending sensitive personal information, safeguarding disclosures, complaints, allegations or confidential information through social media. Where you contact BAMT through social media, we may direct you to an appropriate BAMT email address, reporting route or support service so that your enquiry can be managed securely and appropriately.

If you get in touch with us by email, web form, telephone, social media or another route, we will use the information you provide to respond to your enquiry and manage any follow-up. If you contact us for support to find a therapist, we will retain your details until you have been linked with a therapist or the enquiry has otherwise been dealt with. This data will normally be stored for six months in case you get in touch with us during that period and we need to refer to our previous conversations. We will not contact you or share your details without a relevant lawful basis or your consent where required.

If your enquiry includes safeguarding concerns, risk of harm, a complaint, allegation or professional conduct concern, we may need to retain and share relevant information in line with our safeguarding, complaints, professional standards, legal and data protection procedures.

Safeguarding, complaints and professional concerns

BAMT may receive or process personal data in connection with safeguarding concerns, complaints, allegations, professional conduct matters, whistleblowing, or concerns about a Music Therapist or service. This may include sensitive information and special category data. We will only use and share this information where necessary and proportionate, including to assess the concern, protect individuals from harm, seek advice, liaise with relevant authorities or regulators, comply with legal obligations, and maintain appropriate records.

Where immediate risk of harm is indicated, information may be shared with emergency services, safeguarding authorities, regulators or other relevant bodies without consent where this is necessary and lawful.

Automated decision-making

We do not use automated decision-making processes to make significant decisions about our members, donors, volunteers, job applicants or other individuals. Any significant decisions regarding individuals are made by a human.

Your choices & rights

You have a choice about whether you want to receive certain information from BAMT. We will not use your personal information for marketing purposes if you have indicated that you do not wish to be contacted. You can change your communication preferences at any time by contacting info@bamt.org.

As an individual whose personal data is processed by BAMT, you have the following rights, subject to the conditions and exemptions set out in data protection law:

the right to be informed about how your personal data is used;
the right of access to your personal data;
the right to rectification of inaccurate or incomplete personal data;
the right to erasure in certain circumstances;
the right to restrict processing in certain circumstances;
the right to data portability in certain circumstances;
the right to object to processing in certain circumstances, including an absolute right to object to direct marketing; and
rights in relation to automated decision-making and profiling.

If you would like to exercise any of the above rights, please contact the BAMT office at info@bamt.org. You may also write to us at BAMT’s registered office address. We will respond to data subject requests within one calendar month, unless an extension is permitted under data protection law. We may need to ask for information to confirm your identity before responding to a request.

Where we rely on consent, you can withdraw your consent at any time. This will not affect the lawfulness of any processing carried out before consent was withdrawn.

Contact

Questions, comments and requests regarding this privacy policy are welcomed and should be addressed to info@bamt.org.
If you are not happy with the way we manage your data, we encourage you to contact us first so that we can try to resolve your concern. You also have the right to complain to the Information Commissioner’s Office (ICO):

Information Commissioner's Office
Tel: 0303 123 1113
Website: www.ico.org.uk