GDPR Information

Your data protection rights under UK GDPR

Our commitment to data protection

We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page explains your rights and how we protect your personal information.

Data controller

umber-ravine is the data controller responsible for your personal information. Contact details:

umber-ravine
87 Mitchell Street
Glasgow, G1 3LN
United Kingdom
Email: [email protected]

Your rights under UK GDPR

Right to be informed

You have the right to clear information about how we collect and use your personal data. Our Privacy Policy provides full details.

Right of access

You can request a copy of the personal data we hold about you, free of charge. We'll respond within one month. To request your data, email [email protected] with "Subject Access Request" in the subject line.

Right to rectification

If your personal information is inaccurate or incomplete, you can request correction. We'll update our records and notify any third parties we've shared your data with.

Right to erasure

You can request deletion of your personal data where:

  • It's no longer necessary for the purpose we collected it
  • You withdraw consent and we have no other legal basis to process it
  • You object to processing and we have no overriding legitimate interest
  • The data was unlawfully processed

Note: We may retain certain data where legally required (e.g., financial records for tax purposes).

Right to restrict processing

You can request that we limit how we use your data in certain circumstances, such as while we verify data accuracy or assess whether we have legitimate grounds to process it.

Right to data portability

For data you've provided based on consent or contract, you can request a copy in a structured, commonly used, machine-readable format, or ask us to transfer it to another controller.

Right to object

You can object to processing based on legitimate interests or for direct marketing purposes. We'll stop processing unless we can demonstrate compelling legitimate grounds that override your interests.

Rights related to automated decision-making

We do not use automated decision-making or profiling that produces legal or similarly significant effects.

How to exercise your rights

To exercise any of these rights, contact us at [email protected]. Please include:

  • Your full name and contact details
  • Details of your request
  • Proof of identity (to protect your data from unauthorised access)

We'll respond within one month. If your request is complex, we may extend this by two months and will inform you of the delay.

Lawful basis for processing

We process your data under these legal bases:

  • Contract: To provide educational services you've enrolled in
  • Legal obligation: To comply with tax and regulatory requirements
  • Legitimate interests: To improve our services and communicate about programmes
  • Consent: For optional communications (you can withdraw anytime)

Data security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, alteration, disclosure, or destruction. These include:

  • Encrypted data transmission (SSL/TLS)
  • Secure server infrastructure
  • Access controls and authentication
  • Regular security assessments
  • Staff training on data protection

Data breaches

In the unlikely event of a data breach that poses a risk to your rights and freedoms, we'll notify you and the Information Commissioner's Office within 72 hours of becoming aware.

International transfers

Your data is processed and stored within the United Kingdom. We do not transfer personal data outside the UK or EEA.

Complaints

If you're not satisfied with how we've handled your data, you have the right to lodge a complaint with the supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane
Wilmslow, Cheshire
SK9 5AF
Tel: 0303 123 1113
Website: ico.org.uk