GDPR Compliance

Our Commitment to Data Protection

emerald-pebble is committed to complying with the General Data Protection Regulation (GDPR) and UK data protection laws. We respect your privacy and ensure your personal data is handled lawfully, fairly, and transparently.

Legal Basis for Processing

We process personal data under the following legal bases:

• Contract Performance: Processing necessary to fulfill course enrollment and service delivery
• Legitimate Interests: Communicating about courses and improving services
• Consent: Where you have explicitly agreed to specific processing activities
• Legal Obligation: Compliance with UK laws and regulations

Data Controller

For the purposes of GDPR, the data controller is:

emerald-pebble Financial Education
42 Stonegate
York YO1 8AS
United Kingdom
Email: [email protected]

Your GDPR Rights

Under GDPR, you have comprehensive rights regarding your personal data:

Right to Access

You can request a copy of all personal data we hold about you. We will provide this information within one month of your request.

Right to Rectification

If your personal data is inaccurate or incomplete, you have the right to request correction.

Right to Erasure

You can request deletion of your personal data when it is no longer necessary for the purpose it was collected, or if you withdraw consent.

Right to Restrict Processing

You can request that we limit how we use your data in certain circumstances.

Right to Data Portability

You can request your data in a structured, commonly used format to transfer to another service provider.

Right to Object

You can object to processing of your personal data based on legitimate interests or for direct marketing purposes.

Rights Related to Automated Decision Making

We do not use automated decision-making or profiling that produces legal effects or significantly affects you.

Data Retention

We retain personal data only as long as necessary:

• Course enrollment data: Retained for 7 years for accounting and legal purposes
• Marketing communications: Until consent is withdrawn
• General inquiries: Deleted after 2 years of inactivity

Data Security Measures

We implement appropriate technical and organizational measures to protect personal data:

• Encryption of data in transit and at rest
• Regular security assessments and updates
• Access controls limiting who can view personal data
• Staff training on data protection principles

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach.

Third-Party Processing

When we engage third-party processors, we ensure they provide sufficient guarantees of GDPR compliance through data processing agreements.

International Data Transfers

Your personal data is processed and stored within the United Kingdom. If we transfer data outside the UK, we ensure appropriate safeguards are in place.

Exercising Your Rights

To exercise any of your GDPR rights, contact us at [email protected]. We will respond to your request within one month. No fee applies unless your request is clearly unfounded or excessive.

Right to Lodge a Complaint

If you believe we have not handled your data appropriately, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Website: ico.org.uk

Updates to This Statement

We may update this GDPR statement to reflect changes in our practices or legal requirements. The revision date at the top indicates when this document was last modified.