GDPR Compliance Statement

Last updated: September 1, 2026

Our Commitment to Data Protection

We are committed to protecting your personal data and respecting your privacy rights under the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018. This page explains how we comply with these regulations and what rights you have regarding your personal information.

Data Controller Information

For the purposes of data protection legislation, we are the data controller responsible for your personal information.

Contact details:
142 Buchanan Street
Glasgow, G1 2LW
United Kingdom
Email: [email protected]

Lawful Basis for Processing

We only process your personal data when we have a lawful basis to do so. The specific lawful bases we rely on are:

• Consent: When you provide explicit consent for us to process your data for specific purposes, such as submitting an enquiry form
• Contract: When processing is necessary to perform a contract with you, such as delivering a course you have enrolled in
• Legal obligation: When we must process data to comply with legal requirements
• Legitimate interests: When processing serves our legitimate business interests and does not override your fundamental rights

Your Data Protection Rights

Under GDPR, you have comprehensive rights regarding your personal data:

Right to Access

You can request a copy of all personal data we hold about you. We will provide this information free of charge within one month of your request.

Right to Rectification

If you believe any information we hold about you is inaccurate or incomplete, you can request that we correct or complete it.

Right to Erasure

Also known as the "right to be forgotten," you can request deletion of your personal data in certain circumstances, such as when it is no longer necessary for the purpose it was collected.

Right to Restrict Processing

You can ask us to limit how we use your data in specific situations, such as when you contest the accuracy of the data or object to our processing.

Right to Data Portability

You can request that we transfer your data to another organisation or provide it to you in a structured, commonly used, machine-readable format.

Right to Object

You can object to processing of your data when we rely on legitimate interests as our lawful basis. We must stop processing unless we can demonstrate compelling legitimate grounds that override your interests.

Right to Withdraw Consent

Where we process data based on your consent, you have the right to withdraw that consent at any time. This will not affect the lawfulness of processing before withdrawal.

How to Exercise Your Rights

To exercise any of these rights, please contact us at [email protected]. Include your full name and details of your request. We may need to verify your identity before processing your request to ensure we protect your personal data.

We aim to respond to all legitimate requests within one month. Occasionally, complex requests may take longer, in which case we will notify you and keep you updated.

Data Processing Activities

We process personal data for the following activities:

• Managing course enquiries and communications
• Administering student enrolments and attendance
• Delivering educational content and materials
• Processing payments and maintaining financial records
• Improving our services through feedback and analysis
• Complying with legal and regulatory obligations

Data Sharing and Transfers

We do not transfer personal data outside the United Kingdom except where necessary for service provision (such as cloud hosting). When we do transfer data internationally, we ensure appropriate safeguards are in place, such as:

• Adequacy decisions by the UK government
• Standard contractual clauses approved by authorities
• Binding corporate rules for multinational organisations

Data Retention Periods

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected or to comply with legal requirements:

• Enquiry data: 2 years
• Student records: 7 years after course completion
• Financial records: 6 years as required by HMRC
• Marketing consent: Until withdrawn

Data Security Measures

We implement appropriate technical and organisational measures to ensure data security, including:

• Encryption of data in transit and at rest
• Regular security assessments and updates
• Access controls limiting who can view personal data
• Staff training on data protection responsibilities
• Incident response procedures for data breaches

Data Breach Notification

In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours and inform affected individuals without undue delay.

Automated Decision Making

We do not use automated decision making or profiling that produces legal effects or similarly significantly affects individuals.

Children's Data

While we provide courses for children, we obtain consent from parents or guardians before processing data of individuals under 16. We implement additional safeguards when processing children's personal data.

Complaints and Concerns

If you have concerns about how we handle your personal data, please contact us first so we can address the issue. If you remain dissatisfied, you have the right to lodge a complaint with the supervisory authority:

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113
Website: www.ico.org.uk

Updates to This Statement

We may update this GDPR compliance statement to reflect changes in our data processing activities or legal obligations. Material changes will be communicated through our website and, where appropriate, directly to affected individuals.