GDPR Information
Last updated: January 2024
This page provides information about how Breeze Kestrel Ltd complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We are committed to protecting your personal data and respecting your privacy rights.
Data Controller
Breeze Kestrel Ltd is the data controller for personal data collected through this website. This means we determine the purposes and means of processing your personal data.
Contact Details:
Breeze Kestrel Ltd
47 Rosemary Lane
London, SW11 4QT
United Kingdom
Email: [email protected]
Your Data Protection Rights
Under UK GDPR, you have the following rights regarding your personal data:
Right of Access (Article 15)
You have the right to obtain confirmation as to whether we are processing your personal data and, if so, to access that data along with information about how it is being processed.
Right to Rectification (Article 16)
You have the right to have inaccurate personal data corrected and incomplete data completed.
Right to Erasure (Article 17)
Also known as the "right to be forgotten", you have the right to request deletion of your personal data in certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected.
Right to Restriction of Processing (Article 18)
You have the right to request that we restrict the processing of your personal data in certain situations, such as when you contest the accuracy of your data.
Right to Data Portability (Article 20)
You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.
Right to Object (Article 21)
You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes.
Rights Related to Automated Decision-Making (Article 22)
You have the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects you.
How to Exercise Your Rights
To exercise any of your data protection rights, please contact us using the details provided above. We will respond to your request within one month. In certain circumstances, we may extend this period by a further two months, in which case we will inform you within the first month.
We may need to verify your identity before processing your request. We will not charge a fee for most requests, but we may charge a reasonable fee if your request is clearly unfounded or excessive.
Lawful Bases for Processing
We process personal data on the following lawful bases:
Contract Performance
Processing necessary for the performance of a contract with you, such as providing access to courses you have enrolled in.
Legitimate Interests
Processing necessary for our legitimate business interests, such as improving our services and communicating with you about your account, provided these interests do not override your rights.
Consent
Processing based on your freely given, specific, informed, and unambiguous consent, such as for marketing communications.
Legal Obligation
Processing necessary to comply with our legal obligations, such as maintaining records for tax purposes.
Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected. Our standard retention periods are:
- Course enrolment data: 7 years after last activity
- Marketing consent records: Duration of consent plus 1 year
- Website analytics data: 26 months
- Customer enquiries: 3 years after resolution
International Data Transfers
We primarily process data within the United Kingdom. Where we transfer data outside the UK, we ensure appropriate safeguards are in place, such as:
- Transfers to countries with adequate data protection laws
- Standard contractual clauses approved by the ICO
- Binding corporate rules where applicable
Data Security
We implement appropriate technical and organisational measures to protect personal data, including:
- Encryption of data in transit and at rest
- Access controls and authentication measures
- Regular security assessments and updates
- Staff training on data protection
Data Breach Notification
In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay and inform the Information Commissioner's Office within 72 hours of becoming aware of the breach.
Complaints
If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Website: ico.org.uk
Telephone: 0303 123 1113
Updates to This Information
We may update this GDPR information from time to time to reflect changes in our practices or legal requirements. The date of the most recent revision appears at the top of this page.