Last updated: October 2024
Our Commitment to GDPR
Periwinkle-birch is committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page explains how we meet our obligations under these regulations and outlines your rights as a data subject.
Data Controller Information
Periwinkle-birch acts as the data controller for personal information collected through our website and course registration processes.
Contact details:
Periwinkle-birch
42 Castle Street
Liverpool L2 7LA
Email: [email protected]
Lawful Basis for Processing
We process personal data under the following lawful bases:
Consent
Where you have given clear consent for us to process your personal data for specific purposes, such as receiving marketing communications.
Contract
Where processing is necessary for the performance of a contract with you, such as course enrolment and delivery.
Legitimate Interests
Where processing is necessary for our legitimate interests or those of a third party, provided your interests and fundamental rights do not override those interests.
Legal Obligation
Where processing is necessary to comply with legal requirements.
Your Rights Under GDPR
Right to Access
You have the right to request a copy of the personal information we hold about you. We will respond to such requests within one month.
Right to Rectification
You have the right to request that we correct any inaccurate personal information we hold about you.
Right to Erasure
You have the right to request that we delete your personal information in certain circumstances, such as when the data is no longer necessary for the purpose it was collected.
Right to Restrict Processing
You have the right to request that we limit the processing of your personal information in certain circumstances.
Right to Data Portability
You have the right to receive your personal information in a structured, commonly used format and to transmit it to another controller.
Right to Object
You have the right to object to processing based on legitimate interests or direct marketing.
Rights Related to Automated Decision Making
You have the right not to be subject to decisions based solely on automated processing that produce legal effects concerning you. We do not currently engage in automated decision-making.
Data Protection Measures
We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:
- Encryption of personal data where appropriate
- Regular testing and evaluation of security measures
- Staff training on data protection obligations
- Access controls limiting who can view personal data
- Secure disposal of data when no longer required
Data Breach Procedures
In the event of a personal data breach, we have procedures in place to:
- Detect, investigate, and report any breach
- Notify the Information Commissioner's Office within 72 hours where required
- Notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms
International Transfers
We do not routinely transfer personal data outside the United Kingdom. If international transfers become necessary, we will ensure appropriate safeguards are in place in accordance with UK GDPR requirements.
Exercising Your Rights
To exercise any of your rights, please contact us using the details provided above. We will respond to your request within one month. In complex cases, we may extend this period by two additional months, but we will inform you of any extension within the first month.
Complaints
If you are dissatisfied with how we have handled your personal data or responded to a request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).
Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Website: ico.org.uk