GDPR Compliance

Our Commitment to Data Protection

We are committed to protecting your personal data and complying with the UK General Data Protection Regulation and the Data Protection Act 2018. This page explains how we meet our obligations and how you can exercise your rights.

Data Controller

For the purposes of UK data protection law, the data controller is:

mesa-stag
47 Wellington Street
Leeds, West Yorkshire
LS1 4JW
United Kingdom
Email: [email protected]

Your GDPR Rights

Under UK GDPR, you have the following rights regarding your personal data:

Right of Access

You have the right to request a copy of the personal data we hold about you. This is known as a subject access request. We will provide this information within one month of your request, free of charge, unless the request is manifestly unfounded or excessive.

Right to Rectification

If you believe the personal data we hold about you is inaccurate or incomplete, you have the right to request correction or completion of this information.

Right to Erasure

In certain circumstances, you have the right to request deletion of your personal data. This right applies when:

• The data is no longer necessary for the purposes for which it was collected
• You withdraw consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed
• Erasure is required to comply with a legal obligation

Note that this right does not apply where we are required to retain data for legal or regulatory purposes.

Right to Restriction of Processing

You have the right to request that we restrict processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or object to processing.

Right to Data Portability

Where we process your data based on consent or contract performance, and the processing is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format.

Right to Object

You have the right to object to processing of your personal data where we rely on legitimate interests as the legal basis. You also have an absolute right to object to processing for direct marketing purposes.

Rights Related to Automated Decision Making

You have the right not to be subject to decisions based solely on automated processing, including profiling, which produce legal effects or similarly significantly affect you. We do not currently engage in automated decision-making.

How to Exercise Your Rights

To exercise any of your GDPR rights, please submit a written request to:

Email: [email protected]
Post: 47 Wellington Street, Leeds, West Yorkshire, LS1 4JW, United Kingdom

To help us process your request efficiently, please:

• Clearly state which right you wish to exercise
• Provide sufficient information to identify you
• Include any relevant reference numbers if applicable

We may need to verify your identity before fulfilling your request. We will respond within one month, though this may be extended by two months for complex requests.

Lawful Basis for Processing

We process your personal data under the following lawful bases:

• Contract: Processing is necessary to fulfill our educational services agreement with you
• Legitimate interests: We have legitimate business interests in improving our services and communicating relevant information, balanced against your rights
• Consent: Where you have given clear consent for specific processing activities
• Legal obligation: Where we must process data to comply with UK law

Data Protection Officer

While we are not legally required to appoint a Data Protection Officer, we have designated a responsible person for data protection matters. For questions specifically about data protection, please contact [email protected] with "Data Protection Inquiry" in the subject line.

International Data Transfers

We primarily store and process data within the United Kingdom. If we transfer data outside the UK, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions.

Data Breach Notification

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay, and in any event within 72 hours of becoming aware of the breach. We will also notify the Information Commissioner's Office as required.

Complaints

If you believe we have not complied with data protection law, you have the right to lodge a complaint with the supervisory authority:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
United Kingdom
Tel: 0303 123 1113
Website: www.ico.org.uk

Updates to This Information

We may update this GDPR information page to reflect changes in law or our practices. Material changes will be communicated to active clients via email.