GDPR Compliance

Last Updated: May 14, 2026

Our Commitment to GDPR

sparse-canyon is committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page explains how we comply with these regulations.

Data Controller

sparse-canyon acts as the data controller for the personal information we collect. We are responsible for ensuring that your personal data is processed lawfully, fairly, and transparently.

Data Controller Contact:
sparse-canyon
142 Shoreditch High Street
London E1 6JE
United Kingdom
Email: [email protected]

Lawful Basis for Processing

We only process your personal data when we have a lawful basis to do so. These lawful bases include:

1. Consent

You have explicitly consented to us processing your personal data for specific purposes, such as:

• Sending marketing communications
• Using cookies on our website (beyond essential cookies)
• Processing enquiries about our services

2. Contract

Processing is necessary to fulfill a contract with you, including:

• Processing bookings for our educational programmes
• Delivering the services you have purchased
• Managing your account and payments

3. Legal Obligation

Processing is necessary to comply with legal obligations, such as:

• Maintaining financial records for tax purposes
• Safeguarding requirements for children
• Responding to lawful requests from authorities

4. Legitimate Interests

Processing is necessary for our legitimate interests or those of third parties, including:

• Improving our services and website
• Preventing fraud and ensuring security
• Internal administrative purposes

Your Data Protection Rights

Under UK GDPR, you have the following rights regarding your personal data:

Right to be Informed

You have the right to be informed about the collection and use of your personal data. This information is provided in our Privacy Policy.

Right of Access

You can request a copy of the personal data we hold about you. We will provide this information within one month of your request, free of charge.

Right to Rectification

If any personal data we hold about you is inaccurate or incomplete, you have the right to have it corrected.

Right to Erasure ("Right to be Forgotten")

In certain circumstances, you can request that we delete your personal data, such as when:

• The data is no longer necessary for the purpose it was collected
• You withdraw consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds

Right to Restrict Processing

You can request that we restrict how we use your personal data in certain situations, such as when you contest the accuracy of the data.

Right to Data Portability

You can request to receive your personal data in a structured, commonly used, and machine-readable format, or ask us to transmit it directly to another organization.

Right to Object

You have the right to object to processing based on legitimate interests or for direct marketing purposes.

Rights Related to Automated Decision Making

You have the right not to be subject to decisions based solely on automated processing, including profiling, which produce legal effects or similarly significantly affect you.

How to Exercise Your Rights

To exercise any of your data protection rights, please contact us:

• Email: [email protected]
• Post: 142 Shoreditch High Street, London E1 6JE, United Kingdom

We will respond to your request within one month. In complex cases, we may extend this period by two additional months and will inform you if we need to do so.

Data Security Measures

We implement appropriate technical and organizational measures to ensure the security of your personal data, including:

• Encryption of sensitive data in transit and at rest
• Regular security assessments and updates
• Access controls limiting who can view your data
• Staff training on data protection principles
• Secure backup and disaster recovery procedures

Data Retention

We only retain personal data for as long as necessary to fulfill the purposes for which it was collected, including:

• Customer records: 7 years (for tax and accounting purposes)
• Marketing consent: Until consent is withdrawn or 3 years of inactivity
• Website analytics: 26 months
• Enquiry forms: 2 years from last contact

International Data Transfers

We primarily store and process data within the United Kingdom. If we transfer data outside the UK, we ensure appropriate safeguards are in place, such as:

• Standard contractual clauses approved by regulatory authorities
• Transfers to countries with adequacy decisions
• Other approved transfer mechanisms

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will:

• Notify the Information Commissioner's Office (ICO) within 72 hours
• Inform affected individuals without undue delay if there is a high risk
• Take immediate steps to mitigate the breach

Children's Data

Given the nature of our services (education for children and teenagers), we take extra care with data relating to minors:

• We collect data from parents/guardians, not directly from children under 13
• We obtain parental consent for processing children's data
• We ensure age-appropriate explanations of data processing
• We apply enhanced security measures for children's data

Complaints

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk

Updates to This Statement

We may update this GDPR compliance statement from time to time to reflect changes in our practices or legal requirements. Please check this page periodically for updates.

Questions?

If you have any questions about our GDPR compliance or data protection practices, please contact us at [email protected]