GDPR Compliance
Last updated: October 2024
Stone-rhythm is committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page explains how we fulfil our obligations under data protection law and how you can exercise your rights.
Data Controller
Stone-rhythm acts as the data controller for personal information collected through this website and our educational services. As data controller, we determine the purposes and means of processing your personal data and are responsible for ensuring compliance with data protection principles.
Contact details for data protection enquiries:
Stone-rhythm
47 Colmore Row
Birmingham B3 2AA
United Kingdom
Email: [email protected]
Data Protection Principles
We adhere to the following principles when processing personal data:
- Lawfulness, fairness, and transparency: We process data lawfully and provide clear information about how we use it
- Purpose limitation: We collect data for specified, explicit, and legitimate purposes
- Data minimisation: We only collect data that is adequate, relevant, and necessary
- Accuracy: We keep personal data accurate and up to date
- Storage limitation: We retain data only for as long as necessary
- Integrity and confidentiality: We process data securely
- Accountability: We demonstrate compliance with these principles
Lawful Bases for Processing
We rely on the following lawful bases for processing your personal data:
Consent
Where you have provided explicit consent for us to process your data for specific purposes, such as receiving marketing communications. You may withdraw consent at any time by contacting us.
Contractual Necessity
Where processing is necessary to perform a contract with you or to take steps at your request prior to entering a contract, such as processing course enrolments.
Legitimate Interests
Where processing is necessary for our legitimate interests or those of a third party, except where such interests are overridden by your rights. Our legitimate interests include operating our business, improving our services, and communicating with enquirers.
Your Rights Under GDPR
Right of Access
You have the right to request a copy of the personal information we hold about you. We will respond to valid requests within one month.
Right to Rectification
You have the right to request correction of any inaccurate or incomplete personal data we hold about you.
Right to Erasure
You have the right to request deletion of your personal data in certain circumstances, including where it is no longer necessary for the purposes for which it was collected.
Right to Restrict Processing
You have the right to request that we restrict processing of your personal data in certain circumstances, such as where you contest the accuracy of the data.
Right to Data Portability
You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.
Right to Object
You have the right to object to processing of your personal data where we are relying on legitimate interests as our legal basis, or where we are processing data for direct marketing purposes.
Rights Related to Automated Decision-Making
You have the right not to be subject to decisions based solely on automated processing that produce legal effects or similarly significantly affect you. We do not currently engage in such automated decision-making.
Exercising Your Rights
To exercise any of your rights, please contact us using the details provided above. We may need to verify your identity before processing your request. There is no fee for making a request unless the request is manifestly unfounded or excessive.
Data Breach Notification
We have procedures in place to detect, investigate, and report personal data breaches. Where a breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay.
Children's Data
Where we process personal data relating to children enrolled in our junior programmes, we obtain consent from a parent or guardian. We take additional care to ensure children's data is handled appropriately and securely.
Complaints
If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Website: ico.org.uk
Updates to This Information
We may update this GDPR information from time to time to reflect changes in our practices or legal requirements. Please check this page periodically for updates.