GDPR Compliance

Our Commitment to Data Protection

topaz-blossom is committed to ensuring that your privacy is protected and that we comply fully with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page explains how we handle your personal data in accordance with these regulations.

Data Controller

topaz-blossom acts as the data controller for the personal information we collect. This means we determine the purposes and means of processing your personal data.

Contact details:
topaz-blossom
47 Wellington Street
Leeds, LS1 4DT
United Kingdom
Email: [email protected]

Lawful Basis for Processing

We only process your personal data when we have a lawful basis to do so. The lawful bases we rely on include:

• Consent: When you have given us explicit permission to process your data for a specific purpose, such as receiving marketing communications
• Contractual Necessity: When processing is necessary to perform a contract with you, such as providing our educational services
• Legal Obligation: When we must process data to comply with the law
• Legitimate Interests: When we have a genuine business reason to process your data, provided it does not override your fundamental rights

Your Rights Under GDPR

The UK GDPR provides you with several rights regarding your personal data:

Right to Be Informed

You have the right to know how we collect and use your personal data. Our Privacy Policy provides this information.

Right of Access

You can request a copy of the personal data we hold about you. This is known as a Subject Access Request (SAR). We will respond to such requests within one month.

Right to Rectification

If you believe any personal data we hold about you is inaccurate or incomplete, you can request that we correct it.

Right to Erasure

Also known as the "right to be forgotten," you can request deletion of your personal data in certain circumstances, such as when the data is no longer necessary for its original purpose.

Right to Restrict Processing

You can request that we limit how we use your data while we verify its accuracy or assess a complaint you have made.

Right to Data Portability

You can request your personal data in a structured, commonly used, machine-readable format so you can transfer it to another organisation.

Right to Object

You can object to processing of your personal data for direct marketing purposes or where we process data based on legitimate interests.

Rights Related to Automated Decision Making

You have rights concerning any automated decision-making processes that significantly affect you. We do not currently use automated decision-making in our services.

How to Exercise Your Rights

To exercise any of your GDPR rights, please contact us at [email protected]. We will respond to your request within one month. If your request is complex, we may extend this period by a further two months, but we will inform you if this is necessary.

We do not charge a fee for most requests. However, we may charge a reasonable fee if your request is clearly unfounded or excessive, or if you request multiple copies of your data.

Data Security

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

• Encryption of personal data where appropriate
• Regular testing and evaluation of security measures
• Staff training on data protection responsibilities
• Access controls to limit who can access personal data

Data Breach Procedures

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours. If the breach is likely to result in a high risk to you, we will also notify you directly.

International Transfers

We do not routinely transfer personal data outside the United Kingdom. If such transfers become necessary, we will ensure appropriate safeguards are in place in accordance with UK GDPR requirements.

Complaints

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Website: ico.org.uk

We would, however, appreciate the opportunity to address your concerns before you approach the ICO, so please contact us first.