GDPR Compliance

Our Commitment to Data Protection

Ridge-kudu is committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page explains your rights under data protection law and how we uphold them.

Data Controller Information

Ridge-kudu is the data controller responsible for your personal data. This means we determine the purposes and means of processing your personal information.

Your Rights Under GDPR

You have the following rights regarding your personal data:

Right to Be Informed

You have the right to know what personal data we collect, why we collect it, and how we use it. Our Privacy Policy provides this information in detail.

Right of Access

You can request a copy of the personal data we hold about you. This is commonly known as a Subject Access Request (SAR). We will provide this information within one month of receiving your request.

Right to Rectification

If any personal data we hold about you is inaccurate or incomplete, you have the right to request correction. We will rectify the data within one month.

Right to Erasure

Also known as the "right to be forgotten," you can request deletion of your personal data in certain circumstances, including:

• The data is no longer necessary for its original purpose
• You withdraw consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed

Right to Restrict Processing

You can request that we limit how we use your data while a complaint is being investigated or in other specific circumstances.

Right to Data Portability

You can request your personal data in a structured, commonly used, machine-readable format, and have it transferred to another organisation where technically feasible.

Right to Object

You can object to processing based on legitimate interests or direct marketing. We will stop processing unless we demonstrate compelling legitimate grounds.

Rights Related to Automated Decision Making

You have rights regarding automated decision-making and profiling. Ridge-kudu does not currently use automated decision-making that significantly affects you.

How to Exercise Your Rights

To exercise any of these rights, please contact us using the details above. To help us process your request efficiently, please:

• Specify which right you wish to exercise
• Provide enough information to verify your identity
• Be as specific as possible about the data or processing in question

We will respond to your request within one month. In complex cases, we may extend this by up to two additional months, but we will inform you of any delay within the first month.

Lawful Basis for Processing

We only process personal data when we have a lawful basis to do so. The bases we rely on include:

Contract

Processing is necessary to fulfil a contract with you, such as delivering a course you have enrolled in.

Consent

You have given clear consent for us to process your data for a specific purpose, such as receiving marketing communications. You can withdraw consent at any time.

Legitimate Interests

Processing is necessary for our legitimate business interests, provided these do not override your rights. For example, improving our services based on feedback.

Legal Obligation

Processing is necessary to comply with a legal requirement, such as maintaining financial records.

International Data Transfers

We primarily store and process data within the United Kingdom. If we transfer data outside the UK, we ensure appropriate safeguards are in place, such as:

• Transfers to countries with adequate data protection laws
• Standard contractual clauses approved by the ICO
• Other appropriate safeguards as required by law

Data Security

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

• Encryption of personal data where appropriate
• Regular testing and evaluation of security measures
• Staff training on data protection
• Access controls to limit who can view personal data
• Secure disposal of data when no longer needed

Data Breach Procedures

In the event of a personal data breach that poses a risk to your rights and freedoms, we will:

• Notify the Information Commissioner's Office within 72 hours
• Communicate with affected individuals without undue delay if there is a high risk
• Document all breaches and our response

Children's Data

We offer programmes for young people aged 8-17. For participants under 16, we require verifiable parental or guardian consent before collecting personal data. Parents and guardians can exercise data protection rights on behalf of their children.

Complaints

If you are not satisfied with how we handle your personal data or respond to your requests, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

We would appreciate the opportunity to address your concerns before you contact the ICO, so please reach out to us first.

Updates to This Information

We may update this GDPR information page periodically. We will notify you of significant changes through our website or by email where appropriate.