GDPR Compliance

Last updated: January 2024

Brook Grove is committed to ensuring compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page outlines how we meet our obligations under these regulations and explains your rights as a data subject.

Our Commitment

We are committed to:

• Processing personal data lawfully, fairly, and transparently
• Collecting data only for specified, explicit, and legitimate purposes
• Ensuring data is adequate, relevant, and limited to what is necessary
• Maintaining accurate and up-to-date records
• Retaining data only as long as necessary
• Processing data securely with appropriate technical measures

Data Controller Information

Brook Grove acts as the data controller for personal information collected through our website and educational programmes.

Contact Details:
Brook Grove
47 Park Lane
Leeds, LS3 1AB
United Kingdom
Email: [email protected]

Lawful Bases for Processing

We only process personal data where we have a lawful basis to do so. The bases we rely on include:

• Consent: You have given clear consent for us to process your personal data for a specific purpose, such as receiving marketing communications.
• Contract: Processing is necessary for performing our contract with you, such as delivering educational services you have enrolled in.
• Legal Obligation: Processing is necessary to comply with the law.
• Legitimate Interests: Processing is necessary for our legitimate interests, such as improving our services, provided this does not override your fundamental rights.

Your Rights Under UK GDPR

You have the following rights regarding your personal data:

Right to be Informed

You have the right to know how we collect and use your personal data. This is provided through our Privacy Policy and this GDPR page.

Right of Access

You can request a copy of the personal data we hold about you. We will respond to such requests within one month.

Right to Rectification

If you believe any data we hold about you is inaccurate or incomplete, you can request that we correct it.

Right to Erasure

In certain circumstances, you can request that we delete your personal data. This right is not absolute and may be subject to legal retention requirements.

Right to Restrict Processing

You can request that we limit the way we use your data in certain circumstances, such as when you contest its accuracy.

Right to Data Portability

You can request to receive your personal data in a structured, commonly used, machine-readable format for transfer to another organisation.

Right to Object

You can object to processing of your data based on legitimate interests, direct marketing, or research purposes.

Rights Related to Automated Decision Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects.

Exercising Your Rights

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month. In complex cases, we may extend this by up to two months, but we will inform you of any extension within the first month.

We do not charge a fee for most requests. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive.

Data Breach Procedures

In the event of a personal data breach that poses a risk to your rights and freedoms, we will:

• Notify the Information Commissioner's Office within 72 hours of becoming aware of the breach
• Notify affected individuals without undue delay if the breach is likely to result in a high risk to their rights
• Document the breach and remedial actions taken

International Transfers

We primarily process data within the United Kingdom. If we transfer data outside the UK, we ensure appropriate safeguards are in place in accordance with UK GDPR requirements.

Complaints

If you are not satisfied with how we handle your personal data or respond to your requests, you have the right to lodge a complaint with the Information Commissioner's Office:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire, SK9 5AF
Website: ico.org.uk

Updates to This Information

We may update this GDPR compliance information from time to time to reflect changes in our practices or legal requirements. Please check this page periodically for updates.