GDPR Compliance

Our Commitment to Data Protection

glossy-pathway is committed to ensuring compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We respect your privacy and are transparent about how we collect, use, and protect your personal data.

Data Controller

glossy-pathway is the data controller responsible for your personal data. Our contact details are:

Your Rights Under GDPR

The UK GDPR provides you with specific rights regarding your personal data:

Right to Access

You have the right to request a copy of the personal data we hold about you. This is known as a Subject Access Request (SAR). We will respond within one month of receiving your request.

Right to Rectification

If you believe the personal data we hold about you is inaccurate or incomplete, you have the right to request correction.

Right to Erasure

Also known as the "right to be forgotten", you can request deletion of your personal data in certain circumstances, such as when the data is no longer necessary for the purpose it was collected.

Right to Restrict Processing

You can request that we limit how we use your personal data while we investigate any concerns you have raised.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.

Right to Object

You can object to certain types of processing, including processing based on legitimate interests and processing for direct marketing.

Rights Related to Automated Decision Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects.

How to Exercise Your Rights

To exercise any of your data protection rights, please contact us at:

• Email: [email protected]
• Post: glossy-pathway, 47 Lark Lane, Aigburth, Liverpool L17 8UW

We may need to verify your identity before processing your request. We will respond to your request within one month, though this may be extended by up to two months for complex requests.

Lawful Basis for Processing

We only process personal data when we have a lawful basis to do so. The lawful bases we rely on are:

Consent

When you submit an enquiry form, you consent to us processing your data to respond to your enquiry. You can withdraw consent at any time.

Contract

When you enrol a child in our programmes, we process data as necessary to fulfil our contractual obligations to provide educational services.

Legitimate Interests

We may process data based on our legitimate interests, such as improving our website and services, where this does not override your rights and freedoms.

Legal Obligation

We may process data where necessary to comply with legal requirements, such as tax and accounting obligations.

Children's Data

Our services involve working with children aged 6-17. We only collect children's personal data with the consent of their parent or guardian. We implement additional safeguards for children's data:

• Parental consent is required for all data collection
• Children's data is only used for educational service provision
• We do not share children's data with third parties for marketing
• Data is retained only as long as necessary

Data Security Measures

We implement appropriate technical and organisational measures to ensure security of personal data, including:

• Secure data storage with access controls
• Encryption of sensitive data in transit
• Regular security assessments
• Staff training on data protection
• Incident response procedures

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours. Where the breach is likely to result in high risk, we will also notify affected individuals without undue delay.

International Transfers

We do not transfer personal data outside the United Kingdom or European Economic Area. All data processing occurs within the UK.

Complaints

If you have concerns about how we handle your personal data, please contact us first at [email protected]. We will work to resolve your concern.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office:

Updates to This Notice

We may update this GDPR compliance notice from time to time. Any changes will be posted on this page with an updated revision date.