GDPR Information

Last updated: September 2024

Prismlark Financial School is committed to protecting your personal data and respecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page provides information about how we handle your personal data and your rights under data protection law.

Data Controller

Prismlark Financial School is the data controller for personal data collected through this website and in connection with our educational services. This means we are responsible for deciding how we hold and use your personal information.

Contact details:
Prismlark Financial School
47 Whitworth Street
Manchester M1 5WW
United Kingdom
Email: [email protected]

Personal Data We Process

We collect and process the following categories of personal data:

Identity Data: Name, title, date of birth (for young learners)
Contact Data: Email address, postal address
Transaction Data: Details about payments and courses purchased
Technical Data: IP address, browser type, device information
Usage Data: Information about how you use our website
Communication Data: Your preferences for receiving communications from us

Lawful Bases for Processing

We only process your personal data when we have a lawful basis to do so. The lawful bases we rely on include:

Contract

We process your data where it is necessary for the performance of a contract with you. This includes processing data to:

Enrol you in courses and deliver our educational services
Process payments for course fees
Communicate with you about your courses

Legitimate Interests

We may process your data where it is necessary for our legitimate interests, provided these interests do not override your fundamental rights. This includes:

Improving our website and services
Analysing how our services are used
Ensuring the security of our systems

Consent

We rely on your consent for certain processing activities, such as:

Sending you marketing communications
Using non-essential cookies on our website

Legal Obligation

We may process your data where it is necessary to comply with a legal obligation, such as tax and accounting requirements.

Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

Right to Access

You have the right to request a copy of the personal data we hold about you. This is commonly known as a "subject access request".

Right to Rectification

You have the right to request that we correct any inaccurate personal data we hold about you, or complete any incomplete data.

Right to Erasure

You have the right to request that we delete your personal data in certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected.

Right to Restrict Processing

You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.

Right to Object

You have the right to object to the processing of your personal data in certain circumstances, including processing for direct marketing purposes.

Rights Related to Automated Decision-Making

You have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not currently use automated decision-making in our services.

Exercising Your Rights

To exercise any of your rights, please contact us using the details provided above. We will respond to your request within one month. In certain circumstances, we may extend this period by up to two months, in which case we will inform you of the extension and the reasons for it.

We may need to verify your identity before processing your request. If your request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse to act on the request.

Data Security

We have implemented appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage. These measures include:

Secure storage of personal data
Access controls limiting who can view personal data
Staff training on data protection
Regular review of our security practices

Data Transfers

We primarily store and process your personal data within the United Kingdom. If we transfer your data outside the UK, we will ensure appropriate safeguards are in place to protect your data in accordance with UK GDPR requirements.

Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected. Retention periods vary depending on the type of data and the purposes for which it was collected. We will securely delete or anonymise your data when it is no longer needed.

Complaints

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Website: ico.org.uk

We would appreciate the opportunity to address your concerns before you approach the ICO, so please contact us first.

Updates to This Information

We may update this GDPR information from time to time. We will notify you of any significant changes by posting a notice on our website.