GDPR Compliance

General Data Protection Regulation Information

Our Commitment to Data Protection

TundraArc Financial Education is committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page outlines how we meet our obligations and protect your rights regarding personal data.

Data Controller

TundraArc Financial Education acts as the data controller for personal information collected through our website and courses. We determine how and why your data is processed.

TundraArc Financial Education
47 Deansgate
Manchester M3 2AY
United Kingdom
Email: [email protected]

Lawful Basis for Processing

We process your personal data only when we have a lawful basis:

  • Performance of a Contract: When processing is necessary to fulfill our educational services agreement with you
  • Legitimate Interests: When processing serves our legitimate business interests while respecting your rights
  • Consent: When you have explicitly agreed to specific processing activities
  • Legal Obligation: When required to comply with laws or regulations

Your GDPR Rights

Under the UK GDPR, you have the following rights regarding your personal data:

Right to be Informed

You have the right to clear, transparent information about how we use your personal data. This is provided through our Privacy Policy and this GDPR page.

Right of Access

You can request a copy of the personal data we hold about you. This is known as a Subject Access Request (SAR). We will respond within one month of receiving your request.

Right to Rectification

If your personal data is inaccurate or incomplete, you have the right to have it corrected or completed.

Right to Erasure

Also known as the "right to be forgotten," you can request deletion of your personal data in certain circumstances, such as when:

  • The data is no longer necessary for the purposes it was collected
  • You withdraw consent and there is no other legal basis for processing
  • You object to processing and there are no overriding legitimate grounds
  • The data has been unlawfully processed

Note: We may be required to retain certain data for legal or accounting purposes.

Right to Restrict Processing

You can request that we limit how we use your data in certain situations, such as when you contest the accuracy of data or object to processing.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and transmit it to another data controller.

Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes. We will stop processing unless we have compelling legitimate grounds that override your interests.

Rights Related to Automated Decision Making

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects on you.

How to Exercise Your Rights

To exercise any of these rights, please contact us at [email protected] with:

  • Your full name and contact details
  • A description of your request
  • Proof of identity (for security purposes)

We will respond to your request within one month. In complex cases, we may extend this by two additional months and will inform you of any delay.

Data Security

We implement appropriate technical and organizational measures to ensure data security:

  • Encryption of data in transit and at rest
  • Regular security assessments and updates
  • Access controls limiting data access to authorized personnel only
  • Staff training on data protection principles
  • Secure backup procedures

Data Breach Notification

In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours and inform affected individuals without undue delay.

Data Protection Officer

While not legally required to appoint a Data Protection Officer, we have designated a data protection point of contact responsible for overseeing GDPR compliance. Contact them at [email protected]

Third-Party Processing

When we engage third-party service providers who process personal data on our behalf, we ensure:

  • They provide sufficient guarantees of data protection
  • Data processing agreements are in place
  • They only process data according to our instructions
  • Appropriate security measures are implemented

International Data Transfers

If we transfer your data outside the UK or European Economic Area, we ensure adequate safeguards are in place through:

  • Standard Contractual Clauses approved by regulatory authorities
  • Adequacy decisions recognizing equivalent data protection standards
  • Binding corporate rules for group companies

Children's Data

We take extra care when processing data relating to children. Course enrollments for individuals under 16 must be completed by a parent or guardian who provides consent on their behalf.

Lodging a Complaint

If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the supervisory authority:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
United Kingdom
Website: www.ico.org.uk
Helpline: 0303 123 1113

Updates to This Information

We may update this GDPR information to reflect changes in our practices or legal requirements. Material changes will be communicated through our website.

Questions and Contact

If you have questions about our GDPR compliance or how we protect your data, please contact us at [email protected]