GDPR Compliance Statement

Last updated: 17 June 2026

Our Commitment to Data Protection

We are committed to protecting your personal data and respecting your privacy rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page explains how we comply with these regulations and what rights you have regarding your personal information.

Data Controller Information

For the purposes of data protection legislation, the data controller is:

glossy-wave
23 Clifton Gardens
Bristol BS8 4EH
United Kingdom
Email: [email protected]

Lawful Basis for Processing

We process your personal data only when we have a lawful basis to do so. The legal grounds we rely on include:

1. Contract Performance

When you enroll in a course, we process your data to deliver the service you have purchased. This includes providing access to learning materials, tracking your progress, issuing certificates, and communicating about your enrollment.

2. Legitimate Interests

We may process data based on our legitimate business interests, such as improving our educational offerings, conducting analysis to enhance user experience, preventing fraud, and maintaining the security of our platform. We always balance these interests against your rights and freedoms.

3. Consent

For activities such as marketing communications and certain types of cookies, we obtain your explicit consent. You have the right to withdraw this consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

4. Legal Obligation

In some cases, we are required by law to process and retain certain data, such as for tax purposes, accounting requirements, or to respond to legal requests from authorities.

Your GDPR Rights

Under UK GDPR, you have the following rights regarding your personal data:

Right to Access

You can request confirmation of whether we process your personal data and obtain a copy of that data. We will provide this information free of charge within one month of your request.

Right to Rectification

If your personal data is inaccurate or incomplete, you have the right to have it corrected. You can update most information through your account settings or by contacting us directly.

Right to Erasure (Right to be Forgotten)

You can request deletion of your personal data in certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected, or when you withdraw consent. This right is not absolute and may be limited by legal obligations to retain certain records.

Right to Restriction of Processing

You can request that we limit how we use your data in specific situations, such as when you contest the accuracy of the data or object to processing based on legitimate interests.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller where processing is based on consent or contract performance.

Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes. If you object to marketing, we will stop processing your data for that purpose immediately.

Rights Related to Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing that produce legal effects or similarly significant effects. We do not currently engage in automated decision-making of this nature.

How to Exercise Your Rights

To exercise any of your GDPR rights, please contact us at [email protected] with the following information:

We will respond to your request within one month. In complex cases, we may extend this period by up to two months and will inform you of the extension and reasons for the delay.

Data Security Measures

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay. We will also report the breach to the Information Commissioner's Office (ICO) within 72 hours of becoming aware of it, where required by law.

Third-Party Data Processors

We work with carefully selected third-party service providers who process data on our behalf. These processors are bound by data processing agreements that ensure they handle your data in compliance with UK GDPR requirements. We conduct due diligence on all processors and monitor their compliance regularly.

International Data Transfers

If we transfer your personal data outside the United Kingdom, we ensure that appropriate safeguards are in place, such as standard contractual clauses approved by regulatory authorities or adequacy decisions recognising equivalent data protection standards.

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected or to comply with legal requirements. Our typical retention periods are:

Right to Lodge a Complaint

If you believe we have not handled your data in accordance with UK GDPR, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Website: ico.org.uk
Helpline: 0303 123 1113

Updates to This Statement

We may update this GDPR compliance statement to reflect changes in our practices or legal requirements. We will notify you of material changes through email or a prominent notice on our website.

Contact Our Data Protection Officer

For questions specifically related to data protection and GDPR compliance, please contact us at [email protected]