Privacy policy

Last updated: November 5, 2026

This policy explains what personal data we process when you sign your child up for the NewAct Musicals workshops or individual singing lessons, when you book singing lessons for yourself as an adult student, or when you visit the website newactmusicals.com, why we process it, how long we keep it and what your rights are. The workshops and singing lessons are run by PIQ SOLUTIONS INNOLABS SRL ("we", "us"). We decide how and why the data is processed, so we are its controller.

In short

• We collect only what we need for sign-up, for the course and for payment: the data in the sign-up form, your phone number for the parents' WhatsApp group, and payment records.
• We never see or store your card details. Payment happens on Stripe's page.
• We publish photos and videos of a child only with the written consent of their parent or guardian. You can withdraw consent at any time by email, and we then remove the images.
• The website sets no cookies and saves nothing in your browser. We count visits with Cloudflare Web Analytics, without cookies and without tracking individual visitors. Only if its bot protection is triggered may Cloudflare set a strictly necessary cookie (see section 7).
• You can ask at any time to see, correct or delete your data by writing to newact.musicals@gmail.com.

Contents

• 1. Who we are
• 2. What we collect and why
• 3. Legal bases
• 4. Who processes your data
• 5. Where your data is stored
• 6. How long we keep it
• 7. Cookies and browser storage
• 8. Security
• 9. Children
• 10. Your rights
• 11. Supervisory authority
• 12. Changes to this policy
• 13. Contact

1. Who we are

The controller is PIQ SOLUTIONS INNOLABS SRL, a company registered in Romania:

• Tax ID (CUI): RO44637960
• Trade Register (ONRC) number: J2022001737222
• EUID: ROONRC.J2022001737222
• Registered office: Județ Iași, Municipiul Pașcani, Strada Moldovei, Nr. 8, Bloc Z1, Scara B, Etaj 6, Ap. 21, Romania

The workshops take place at Calea Moșilor, Sector 2, Bucharest. That is the address of the venue, not the registered office.

For any question about personal data, write to us at newact.musicals@gmail.com.

2. What we collect and why

We receive personal data directly from you, as a parent or guardian or as an adult singing student, and, for payments, from Stripe. For each activity below we collect only what we need.

Signing up (Tally form)

Sign-up happens through a form hosted by Tally. The form asks for:

• the parent's or guardian's name;
• the child's name;
• the child's age;
• a phone number;
• an email address;
• the group you want.

An adult student who books individual singing lessons for themselves fills in the form with their own details.

With the form, the website automatically sends three hidden fields: the button or QR code you started from (source), the website's language (lang), and the group chosen from the schedule, if you started from a specific group (interval).

We use this data to confirm the child's place in the group, to contact you about the course, to add you to the group's WhatsApp group and to see where sign-ups come from. The course conditions are in the Terms and conditions.

The website's pages load Tally's script from tally.so only when you interact with a sign-up button: when you hover over it, focus it with the keyboard or click it. Until then, your browser does not contact Tally. The form opens over the website, in a window served by Tally. If it cannot open that way, the button opens it in a new tab on tally.so. When the script and the form load, your browser sends Tally the usual technical data, such as your IP address and browser type.

The parents' WhatsApp group

After sign-up, you receive an invitation to a WhatsApp group for your child's group. We post course announcements and payment links there. The other members of the group, that is the parents in the same group and us, can see your phone number.

Health data

We do not ask for data about your child's health, such as allergies or medical conditions. Please do not send it through the form or on WhatsApp. If there is something we need to know for your child's safety, tell us in person.

Payment

Payment is made only through Stripe payment links. You enter your card details directly on Stripe's page: we never see or store them. From Stripe we receive confirmation of the payment and its details:

• your email address, name and country;
• the amount and date of the payment;
• the card brand (for example Visa or Mastercard), the last 4 digits of the card, its expiry date and the country where it was issued;
• your phone number or address, only if requested on the payment page.

We never see the full card number. We keep payment records for accounting.

Photos and videos

We take photos and videos at the workshops. We publish them on the website and on our social media: Facebook, Instagram, Threads, TikTok and YouTube. For every child who appears in them, we have the written consent of their parent or guardian.

You can withdraw consent at any time by emailing newact.musicals@gmail.com. Within 30 days of your withdrawal, we then remove the child's images from the website and take down posts already published on NewAct's social media accounts. Withdrawing consent does not affect what was published before. We cannot control copies that other people saved or shared before the removal.

Visiting the website

• Hosting and logs. The website is hosted by Cloudflare. As with any website, each request reaches Cloudflare with your IP address, browser type, the page requested and the time. Cloudflare uses these logs to deliver the website and protect it from attacks.
• Visit statistics. We use Cloudflare Web Analytics to know how many visits our pages get. It uses no cookies and does not track visitors individually: we see only aggregate figures.
• Fonts and videos. We serve them from our own website, not from other providers, so your browser does not contact other sites for them.
• Links to other websites. The website links to YouTube, Spotify, SoundCloud, Facebook, Instagram, Threads, TikTok, Google Maps and other websites, but embeds no content from them. Those websites learn of your visit only if you follow the link. From there, their own privacy policies apply.

Email

When you write to us, we use your email address and message to reply. Our address, newact.musicals@gmail.com, is a Gmail account, so messages are hosted by Google.

3. Legal bases

We process data under the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679):

• Contract (Art. 6(1)(b)): sign-up, running the course, announcements in the WhatsApp group, and payment.
• Legal obligation (Art. 6(1)(c)): the payment and accounting records the law requires us to keep.
• Consent (Art. 6(1)(a)): published photos and videos. You can withdraw consent at any time (see section 2).
• Legitimate interests (Art. 6(1)(f)): the website's security logs, aggregate visit statistics, and replies to emails.

We process the child's data at the request of the parent or guardian who signs them up, or on the basis of their consent (see section 9).

4. Who processes your data

Tally and Cloudflare process data on our behalf and on our instructions (they are our processors). Stripe Payments Europe Ltd is our processor for payment services. For its own purposes, namely fraud prevention, anti-money-laundering checks and meeting its legal obligations, Stripe is an independent controller. The data processing agreements with Stripe, Tally and Cloudflare are part of these providers' standard terms.

Google Ireland Ltd (Gmail), WhatsApp Ireland Ltd, Meta Platforms Ireland Ltd (Facebook, Instagram, Threads) and TikTok Technology Ltd process data as independent controllers, under their own privacy policies. So does YouTube, which is a Google service. For the statistics of NewAct's Facebook page (Page Insights), we and Meta are joint controllers under Meta's Page Controller Addendum.

We may also disclose data where the law requires it, for example to a court or a public authority.

5. Where your data is stored

Some providers process data outside the European Economic Area (EEA). For each of them, this is where the data goes and which safeguard applies:

• Tally (Tally BV, Gent, Belgium): form data is stored in Europe, on Google Cloud in Belgium.
• Cloudflare: the website is served over Cloudflare's global network, from the data centre nearest to you, which may be outside the EEA. Request metadata is processed in the United States and the EU. Safeguard: the EU-US Data Privacy Framework and the standard contractual clauses.
• Stripe, Google, Meta and WhatsApp: may transfer data to the United States. Safeguard: the EU-US Data Privacy Framework, with the standard contractual clauses as a fallback.
• TikTok: stores data on servers in the United States, Malaysia and Singapore. Safeguard: the standard contractual clauses or, where one exists, a European Commission adequacy decision.

The EU-US Data Privacy Framework covers US companies certified under it. The standard contractual clauses are approved by the European Commission.

6. How long we keep it

At the end of the period, we delete the data or anonymise it.

7. Cookies and browser storage

The website sets no cookies and saves nothing in your browser's storage (localStorage or sessionStorage). The Tally script loaded on the website writes nothing on newactmusicals.com either, because we do not use its show-the-form-only-once options. The only cookies that can appear on our domain are Cloudflare's strictly necessary ones, and only if its bot protection is triggered. Strictly necessary cookies do not need your consent, which is why the website shows no cookie banner.

Other services may save data in your browser, only on their own domains, when you use them:

8. Security

The website is static: it has no accounts, no forms of its own and no databases, so it keeps no personal data on its servers. It is served over HTTPS only. Sign-up, WhatsApp and payment data stay with the providers above, and our access to it is limited to the people who run the workshops.

No system is completely secure. If a security breach affects your data, we will tell you and the supervisory authority where the law requires it.

9. Children

Children can take part in the workshop and the individual singing lessons from the age of 8. A parent or legal guardian signs a child up, not the child. We process the child's data (name, age and, with consent, images) at the request of the parent or guardian, or on the basis of their consent.

We do not ask children for personal data directly. The parent or guardian exercises the child's rights over their data (see section 10). If you find out that a child has sent us data without your knowledge, write to newact.musicals@gmail.com and we will delete it.

10. Your rights

Under the GDPR, for your own data and your child's, you have the right:

• to know what data we hold and to receive a copy (right of access);
• to have wrong or incomplete data corrected (right to rectification);
• to have data deleted (right to erasure);
• to have processing limited (right to restriction);
• to receive the data in a structured format that is easy to pass on (right to data portability);
• to object to processing based on our legitimate interests (right to object);
• to withdraw your consent at any time, without affecting processing carried out before.

To exercise your rights, write to newact.musicals@gmail.com. We reply within one month. If the request is complex, this can be extended by two more months, and we will tell you if so. We may ask for information to confirm that you are the child's parent or guardian.

Some data we cannot delete straight away: we keep payment and accounting records as long as the law requires (see section 6). If you ask us to delete the sign-up data during the course, we can no longer arrange the child's participation.

11. Supervisory authority

If you think we have processed your data unlawfully, you can complain to the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), dataprotection.ro, or to the authority in the EU country where you live or work. If you like, you can write to us first so we can try to solve the problem together.

12. Changes to this policy

When we change this policy, we publish the new version on this page and update the version and the effective date shown under the title. If a change affects how we use data you have already given us, we announce it here before it applies. If a change needs your consent, we will ask for it again.

13. Contact

Write to us at newact.musicals@gmail.com or by post to:

PIQ SOLUTIONS INNOLABS SRL
Județ Iași, Municipiul Pașcani, Strada Moldovei, Nr. 8, Bloc Z1, Scara B, Etaj 6, Ap. 21
Romania