GDPR Compliance

Last updated: January 2024

Our Commitment to Data Protection

Saffron Ridge Financial Education is committed to protecting your personal data and respecting your privacy rights. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This page explains your rights under data protection law and how we fulfil our obligations as a data controller.

Data Controller Information

Saffron Ridge Financial Education is the data controller for personal information collected through our website and in connection with our educational services.

Contact details:
Saffron Ridge Financial Education
42 Bloomsbury Square
London, WC1A 2RA
Email: [email protected]

Your Rights Under UK GDPR

Under UK data protection law, you have the following rights regarding your personal data:

Right to Be Informed

You have the right to know how your personal data is being collected and used. We provide this information through our Privacy Policy and this GDPR page.

Right of Access

You have the right to request a copy of the personal data we hold about you. This is commonly known as a Subject Access Request (SAR). We will respond to valid requests within one month.

Right to Rectification

You have the right to request correction of personal data that is inaccurate or incomplete. We will make corrections promptly upon verification of your identity and the information in question.

Right to Erasure

Also known as the "right to be forgotten," you can request deletion of your personal data in certain circumstances, such as:

• The data is no longer necessary for its original purpose
• You withdraw consent (where consent is the legal basis)
• You object to processing and there are no overriding legitimate grounds
• The data has been processed unlawfully

Please note that we may need to retain certain information for legal or legitimate business purposes.

Right to Restriction of Processing

You can request that we limit how we use your personal data in certain circumstances, such as while we verify the accuracy of data you have contested.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another data controller, where technically feasible.

Right to Object

You have the right to object to processing based on legitimate interests or for direct marketing purposes. We will stop processing unless we can demonstrate compelling legitimate grounds.

Rights Related to Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing that significantly affect you. We do not currently use automated decision-making in our services.

Exercising Your Rights

To exercise any of your data protection rights, please contact us at [email protected] with your request. We may need to verify your identity before processing your request.

We will respond to all legitimate requests within one month. If your request is particularly complex or you have made multiple requests, we may extend this period by up to two months, in which case we will inform you.

There is generally no fee for exercising your rights, although we may charge a reasonable fee for manifestly unfounded or excessive requests.

Lawful Basis for Processing

We process personal data on the following legal bases:

• Consent: Where you have given clear consent for us to process your personal data for a specific purpose
• Contract: Where processing is necessary for a contract we have with you or to take steps at your request before entering into a contract
• Legitimate interests: Where processing is necessary for our legitimate interests or those of a third party, unless overridden by your rights
• Legal obligation: Where processing is necessary to comply with a legal obligation

Data Security

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

• Encryption of personal data where appropriate
• Regular security assessments and updates
• Access controls limiting who can view personal data
• Staff training on data protection

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours. If the breach is likely to result in a high risk, we will also notify affected individuals without undue delay.

International Transfers

We primarily process personal data within the United Kingdom. If we transfer data outside the UK, we ensure appropriate safeguards are in place, such as standard contractual clauses approved by the Information Commissioner's Office.

Data Protection Officer

For a business of our size, we are not required to appoint a Data Protection Officer. However, we take our data protection responsibilities seriously and have designated internal responsibility for ensuring compliance.

Complaints

If you have concerns about how we handle your personal data, please contact us first so we can try to resolve the issue. You also have the right to lodge a complaint with the supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Website: ico.org.uk

Updates to This Information

We may update this GDPR information from time to time. Any changes will be posted on this page with an updated revision date.