GDPR Compliance

Last updated: January 2024

vibe-quark is committed to ensuring compliance with the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018. This page outlines how we handle personal data in accordance with these regulations.

Data Controller

vibe-quark acts as the data controller for the personal information we collect. Our contact details are:

vibe-quark
42 Queen Square
Bristol, BS1 4LH
United Kingdom
Email: [email protected]

Legal Basis for Processing

We process personal data under the following legal bases:

Contract: Processing necessary for the performance of a contract with you (e.g., providing educational services you have enrolled in)
Consent: Where you have given explicit consent for processing (e.g., receiving marketing communications)
Legitimate Interests: Where processing is necessary for our legitimate business interests, provided these do not override your rights
Legal Obligation: Where processing is necessary for compliance with legal obligations

Your Rights Under GDPR

Under GDPR, you have the following rights regarding your personal data:

Right of Access

You have the right to request a copy of the personal information we hold about you. We will provide this within one month of receiving your request.

Right to Rectification

You have the right to request that we correct any inaccurate or incomplete personal data we hold about you.

Right to Erasure

You have the right to request that we delete your personal data in certain circumstances, such as when the data is no longer necessary for the purpose it was collected.

Right to Restrict Processing

You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.

Right to Object

You have the right to object to the processing of your personal data in certain circumstances, including processing for direct marketing purposes.

Rights Related to Automated Decision Making

You have the right not to be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you.

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including:

Customer account information: Duration of relationship plus 6 years
Programme records: 6 years after completion
Marketing consent records: Until consent is withdrawn
Website analytics: 26 months

International Data Transfers

We primarily store and process data within the United Kingdom and European Economic Area. Where data is transferred outside these regions, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses.

Data Security

We implement appropriate technical and organisational measures to protect personal data, including:

Encryption of data in transit and at rest
Access controls and authentication
Regular security assessments
Staff training on data protection

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours and, where required, notify affected individuals without undue delay.

Exercising Your Rights

To exercise any of your GDPR rights, please contact us at [email protected]. We will respond to your request within one month. If your request is complex or we receive a high volume of requests, we may extend this period by up to two additional months, in which case we will inform you.

Complaints

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow, Cheshire SK9 5AF
Website: ico.org.uk