Last updated: September 2026
We are committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page explains how we comply with these regulations and outlines your rights as a data subject.
For the purposes of data protection legislation, the data controller is:
stonyfalcon
45 Carlton Street
Nottingham, NG1 1NL
United Kingdom
[email protected]
We process your personal data only when we have a lawful basis to do so. The lawful bases we rely on include:
We process data based on your explicit consent when you submit enquiry forms, subscribe to communications, or accept cookies on our website. You may withdraw consent at any time by contacting us.
When you register for our educational programmes, we process your data to fulfil our contractual obligations to deliver the services you have requested.
We may process data based on our legitimate interests in operating and improving our educational services, provided these interests do not override your fundamental rights and freedoms.
In certain circumstances, we process data to comply with legal and regulatory requirements, such as maintaining financial records or responding to lawful requests from authorities.
The UK GDPR grants you several rights regarding your personal data:
You have the right to request a copy of the personal data we hold about you. We will provide this information free of charge within one month of your request.
If you believe any personal data we hold about you is inaccurate or incomplete, you have the right to request correction.
Also known as the "right to be forgotten," this allows you to request deletion of your personal data in certain circumstances, such as when the data is no longer necessary for the purposes it was collected.
You can request that we limit how we use your personal data in specific situations, such as when you contest the accuracy of the data or object to processing.
You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit this data to another controller.
You may object to processing of your personal data where we rely on legitimate interests as the lawful basis. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
We do not use automated decision-making or profiling that produces legal effects or similarly significant impacts on individuals.
To exercise any of your data protection rights, please submit a written request to us using the contact details provided above. We may require proof of identity to process your request and protect against unauthorized access to your data.
We aim to respond to all legitimate requests within one month. If your request is particularly complex or you have made multiple requests, it may take longer, in which case we will notify you and keep you updated.
We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:
In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. If the breach poses a high risk, we will also notify affected individuals without undue delay.
We primarily store and process data within the United Kingdom. Should we transfer data internationally, we ensure appropriate safeguards are in place, such as:
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected and to comply with legal obligations. Our standard retention periods are:
We carefully select third-party service providers and ensure they provide sufficient guarantees to implement appropriate technical and organizational measures. All processors are bound by data processing agreements that comply with UK GDPR requirements.
Where we process data relating to children as part of our educational programmes, we ensure appropriate consent is obtained from parents or guardians for participants under 13 years of age.
If you believe we have not handled your personal data in accordance with data protection law, you have the right to lodge a complaint with the supervisory authority:
Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
United Kingdom
Telephone: 0303 123 1113
Website: ico.org.uk
We review and update our GDPR compliance documentation regularly to reflect changes in our practices or regulatory requirements. Significant updates will be communicated through our website.