Content of advertising nature

GDPR Information

Last updated: 22 September 2024

Our Commitment to Data Protection

Reed Path is committed to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This document outlines how we fulfill our obligations as a data controller and explains your rights as a data subject.

Data Controller Information

Data Controller: Reed Path Education
Address: 42 Broadwick Street, London W1F 7AF, United Kingdom
Contact: [email protected]

Lawful Basis for Processing

We process your personal data under the following lawful bases:

1. Performance of Contract

When you enrol in a course, we process your data to deliver educational services, provide course materials, and communicate regarding your studies.

2. Consent

For marketing communications and certain types of data collection, we seek your explicit consent. You may withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

3. Legitimate Interests

We process data for business operations, fraud prevention, and service improvement, provided such processing does not override your fundamental rights and freedoms.

4. Legal Obligation

We process data to comply with legal requirements including tax law, accounting regulations, and law enforcement requests.

Your Rights Under UK GDPR

Right of Access

You have the right to obtain confirmation that we are processing your data and to receive a copy of your personal data. This is commonly known as a "subject access request."

Right to Rectification

You may request correction of inaccurate or incomplete personal data we hold about you.

Right to Erasure

Also known as the "right to be forgotten," you may request deletion of your personal data under certain circumstances, including:

  • The data is no longer necessary for the purposes for which it was collected
  • You withdraw consent and there is no other legal ground for processing
  • You object to processing and there are no overriding legitimate grounds
  • The data has been unlawfully processed

This right is not absolute and may be limited by legal retention obligations.

Right to Restriction of Processing

You may request that we limit how we use your data in certain situations:

  • You contest the accuracy of the data (restriction applies during verification)
  • Processing is unlawful but you prefer restriction to erasure
  • We no longer need the data but you require it for legal claims
  • You have objected to processing (restriction applies pending verification)

Right to Data Portability

Where processing is based on consent or contract performance and carried out by automated means, you may request your data in a structured, commonly used, machine-readable format and have it transmitted to another controller where technically feasible.

Right to Object

You have the right to object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

Rights Related to Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you.

How to Exercise Your Rights

To exercise any of the rights described above, please submit a request to [email protected]. Include:

  • Your full name and contact information
  • Description of the right you wish to exercise
  • Any relevant details or documentation supporting your request

We will respond within one month of receipt. In complex cases, we may extend this period by two additional months and will inform you of any such extension with reasons for the delay.

We do not charge a fee for processing requests unless they are manifestly unfounded, excessive, or repetitive. In such cases, we may charge a reasonable fee or refuse to act on the request.

Data Protection Principles

We adhere to the following data protection principles:

  • Lawfulness, fairness, and transparency: We process data legally, fairly, and transparently
  • Purpose limitation: We collect data for specified, explicit, and legitimate purposes
  • Data minimisation: We collect only data that is adequate, relevant, and necessary
  • Accuracy: We keep data accurate and up to date
  • Storage limitation: We retain data no longer than necessary
  • Integrity and confidentiality: We process data securely with appropriate safeguards
  • Accountability: We demonstrate compliance with these principles

International Transfers

Your personal data is primarily stored and processed within the United Kingdom. Where we transfer data outside the UK, we ensure appropriate safeguards are in place:

  • Transfer to countries with adequacy decisions from the UK government
  • Standard contractual clauses approved by the Information Commissioner's Office
  • Binding corporate rules for intra-group transfers

You may request further information about specific safeguards by contacting us.

Data Security Measures

We implement technical and organisational measures appropriate to the risk, including:

  • Encryption of data in transit and at rest
  • Regular security testing and vulnerability assessments
  • Staff training on data protection practices
  • Access controls and authentication mechanisms
  • Incident response procedures

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay. Where the breach poses a high risk, we will communicate directly with affected individuals.

We will also report qualifying breaches to the Information Commissioner's Office within 72 hours of becoming aware of the breach.

Third-Party Processors

We engage third-party service providers who process data on our behalf. All processors are bound by data processing agreements that require them to:

  • Process data only on our documented instructions
  • Implement appropriate security measures
  • Assist with data subject rights requests
  • Delete or return data upon contract termination
  • Maintain records of processing activities

Supervisory Authority

The Information Commissioner's Office (ICO) is the UK supervisory authority for data protection. You have the right to lodge a complaint with the ICO if you believe we have not complied with data protection law.

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk

We encourage you to contact us first so we may address your concerns directly.

Updates to GDPR Compliance

This document is reviewed regularly to ensure ongoing compliance with UK GDPR and relevant data protection legislation. Material changes will be communicated through our website and, where appropriate, directly to enrolled students.