Xpandr | Privacy Policy

Introduction
This Privacy Policy describes how your personal information is collected, used, shared, and stored when you visit our website, make a booking, or participate in courses provided by SMB: The School of Music Business Ltd, trading as Xpandr (“Xpandr”, “we”, “us”, “our”).

Personal Information We Collect

When you use our services, we collect the following categories of information:

Device Information
When you visit the Site (www.xpandr.co), we automatically collect certain information about your device, including your web browser, IP address, time zone, and some of the cookies that are installed on your device. As you browse the Site, we collect information about the individual web pages or products that you view, what websites or search terms referred you to the Site, and how you interact with the Site.

We collect this using:
• “Cookies” – data files placed on your device or computer that often include an anonymous unique identifier. For more information about cookies, and how to disable them, visit http://www.allaboutcookies.org.
• “Log files” – tracking actions on the Site, including IP address, browser type, Internet service provider, referring/exit pages, and date/time stamps.
• “Web beacons,” “tags,” and “pixels” – electronic files used to record browsing activity.

Order / Booking Information
When you make a purchase or attempt to make a purchase through the Site, we collect your name, billing address, shipping address, payment information, email address, and phone number.

Course Participation Information
When you enrol in live courses, we collect recordings of those sessions, including audio, video, chat contributions, screen sharing, and any participation by students. This may also include names, images, or voices of participants.

How We Use Your Personal Information

We use your personal information to:
• Process and fulfil bookings, including taking payment and issuing invoices.
• Deliver courses and related educational services.
• Provide access to recordings of live sessions for enrolled students.
• Communicate with you regarding course logistics, updates, or issues.
• Screen for fraud and potential risks.
• Improve teaching quality and course delivery.
• Provide marketing communications where you have opted in.

Legal Basis for Processing

We process your personal information under the following lawful bases:
• Contractual necessity: processing is required to deliver our courses and services.
• Legitimate interests: for quality assurance, record keeping, and service improvement.
• Consent: for optional uses such as marketing communications, or where you choose to use your camera or provide additional personal data during sessions.

Sharing Your Personal Information

We share your information only where necessary:
• With trusted third-party service providers such as Ecwid (for online store and bookings), Kaltura (for secure recording and streaming), and Google Analytics (for site analytics). These providers are GDPR-compliant and bound by data processing agreements.
• Recordings are shared only with students enrolled in the same course cohort.
• We may disclose information to comply with applicable laws, regulations, or legal processes, or to protect our rights.
• We never sell or trade your personal information.

Storage, Security, and Retention of Recordings
• We use Kaltura Virtual Classroom to securely store and stream course recordings. Kaltura is GDPR-compliant, ISO-certified, and uses encryption and strict access controls.
• Recordings are retained until 30 days after the final live session of the course, after which they are securely deleted.
• Only students enrolled in that course have access to the recordings during this period.

Behavioural Advertising

We may use your personal information to provide targeted advertisements or marketing communications we believe may interest you.

You can opt out of targeted advertising here:
• Facebook: https://www.facebook.com/settings/?tab=ads
• Google: https://www.google.com/settings/ads/anonymous
• Or through the Digital Advertising Alliance’s opt-out portal: http://optout.aboutads.info

Do Not Track

Please note that we do not alter our Site’s data collection and use practices when we see a “Do Not Track” signal from your browser.

Your Rights

If you are a resident of the UK or EEA, you have the right to:
• Access the personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion of your personal data, subject to legal and contractual obligations.
• Restrict or object to certain processing.
• Withdraw consent where processing is based on consent.

To exercise these rights, contact us using the details below.

Data Retention

We retain:
• Booking and order information for as long as required for accounting and legal purposes.
• Course recordings until 30 days after the final live session of the course, after which they are securely deleted.

Changes to this Privacy Policy

We may update this policy from time to time to reflect changes in our practices or for legal or operational reasons. Where changes are material, we will notify you.

For more information about our privacy practices, or to exercise your rights, contact us at:

Email: hello@xpandr.co
Phone: +44 (0) 207 078 4022
Website: https://www.xpandr.co