GDPR Compliance

Our Commitment to Data Protection

Azure Cedar Financial Management School is committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This page provides information about how we comply with data protection legislation and outlines your rights as a data subject.

Data Controller Information

Azure Cedar Financial Management School is the data controller responsible for your personal data.

Contact Details:

Azure Cedar Financial Management School
47 Park Row
Leeds, LS1 5JL
United Kingdom

Email: [email protected]

Lawful Bases for Processing

We process personal data under the following lawful bases:

Consent

Where you have given clear consent for us to process your personal data for a specific purpose, such as:

• Receiving information about our courses
• Marketing communications (where applicable)

Contract

Where processing is necessary for the performance of a contract, such as:

• Processing course bookings
• Communicating about enrolled courses
• Providing course materials and resources

Legitimate Interests

Where processing is necessary for our legitimate interests or those of a third party, provided your rights do not override these interests, such as:

• Improving our services
• Administrative purposes
• Ensuring network and information security

Legal Obligation

Where processing is necessary to comply with legal requirements, such as:

• Tax and accounting obligations
• Responding to lawful requests from authorities

Your Rights Under UK GDPR

As a data subject, you have the following rights:

Right to be Informed

You have the right to know how your personal data is being collected and used. This is provided through our Privacy Policy and this GDPR page.

Right of Access

You have the right to request a copy of the personal data we hold about you. This is commonly known as a Subject Access Request (SAR). We will respond within one month of receiving your request.

Right to Rectification

You have the right to request that inaccurate personal data be corrected or incomplete data be completed.

Right to Erasure

Also known as the "right to be forgotten," you can request that we delete your personal data in certain circumstances, such as:

• The data is no longer necessary for its original purpose
• You withdraw consent (where consent was the basis for processing)
• You object to processing and there is no overriding legitimate interest

Right to Restrict Processing

You can request that we limit how we use your personal data in certain situations.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.

Right to Object

You have the right to object to processing based on legitimate interests or for direct marketing purposes.

Rights Related to Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing that significantly affect you. We do not currently use automated decision-making processes.

Exercising Your Rights

To exercise any of these rights, please contact us using the details provided above. We may need to verify your identity before processing your request.

We will respond to your request within one month. This period may be extended by two further months if your request is complex or if we receive numerous requests.

There is no fee for exercising your rights, though we may charge a reasonable fee for manifestly unfounded or excessive requests.

Data Security

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

• Encryption of data in transit
• Regular security assessments
• Access controls limiting who can view personal data
• Staff training on data protection

Data Breach Procedures

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the Information Commissioner's Office within 72 hours
• Notify affected individuals without undue delay where the breach is likely to result in a high risk
• Document all breaches and our response

International Transfers

We primarily process and store personal data within the United Kingdom. If we transfer data outside the UK, we ensure appropriate safeguards are in place in accordance with UK GDPR requirements.

Complaints

If you are not satisfied with how we handle your personal data or respond to your rights request, you have the right to lodge a complaint with the supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane
Wilmslow, Cheshire, SK9 5AF
Website: ico.org.uk

However, we would appreciate the opportunity to address your concerns before you approach the ICO, so please contact us first.