GDPR Compliance

Last updated: January 2024

lucid-saga is committed to ensuring the security and protection of the personal information that we process, and to provide a compliant and consistent approach to data protection. We have implemented this GDPR Compliance Statement to provide information about how we manage your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Our Role as Data Controller

For the purposes of UK data protection legislation, lucid-saga acts as the data controller for personal information collected through our website and course enrolment processes. This means we determine the purposes and means of processing personal data.

Data Protection Principles

We adhere to the principles relating to the processing of personal data set out in the UK GDPR. Personal data must be:

• Processed lawfully, fairly, and transparently: We always have a valid legal basis for processing your data and are open about how we use it
• Collected for specified, explicit, and legitimate purposes: We only collect data for clear, stated purposes
• Adequate, relevant, and limited: We only collect data that is necessary for our stated purposes
• Accurate and kept up to date: We take reasonable steps to ensure data accuracy
• Kept no longer than necessary: We retain data only for as long as needed
• Processed securely: We implement appropriate technical and organisational measures

Your Rights Under UK GDPR

As a data subject, you have the following rights regarding your personal data:

Right to Be Informed

You have the right to be informed about how we collect and use your personal data. We provide this information through our Privacy Policy and this GDPR statement.

Right of Access

You have the right to request a copy of the personal data we hold about you. This is known as a Subject Access Request (SAR). We will respond to your request within one month.

Right to Rectification

If you believe the personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or complete it.

Right to Erasure

Also known as the "right to be forgotten", you may request that we delete your personal data in certain circumstances, such as when:

• The data is no longer necessary for its original purpose
• You withdraw consent and there is no other legal basis for processing
• You object to the processing and there are no overriding legitimate grounds

Right to Restrict Processing

You may request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or object to our processing.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.

Right to Object

You have the right to object to the processing of your personal data in certain circumstances, including processing for direct marketing purposes.

Rights Related to Automated Decision-Making

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you. We do not currently use automated decision-making processes.

How to Exercise Your Rights

To exercise any of your rights, please contact us using the details below. We will respond to your request within one month. In certain circumstances, we may extend this period by a further two months, but we will inform you if this is necessary.

There is no fee for exercising your rights. However, we may charge a reasonable fee if your request is clearly unfounded or excessive, or we may refuse to act on the request in such circumstances.

Legal Basis for Processing

We process personal data on one or more of the following legal bases:

• Consent: You have given clear consent for us to process your personal data for a specific purpose
• Contract: Processing is necessary for the performance of a contract with you or to take steps at your request before entering into a contract
• Legal Obligation: Processing is necessary for compliance with a legal obligation
• Legitimate Interests: Processing is necessary for our legitimate interests or those of a third party, provided your interests and fundamental rights do not override those interests

Data Security

We have implemented appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

• Encryption of data in transit and at rest where appropriate
• Regular testing and evaluation of security measures
• Staff training on data protection and security
• Access controls and authentication procedures

Data Breach Procedures

In the event of a personal data breach, we have procedures in place to:

• Detect and investigate potential breaches
• Assess the risk to individuals
• Notify the Information Commissioner's Office (ICO) within 72 hours where required
• Notify affected individuals where the breach is likely to result in a high risk to their rights and freedoms

International Data Transfers

We primarily process data within the United Kingdom. If we transfer personal data outside the UK, we ensure appropriate safeguards are in place in accordance with UK data protection law.

Complaints

If you are unhappy with how we have handled your personal data or have concerns about our data protection practices, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Website: ico.org.uk

We would, however, appreciate the opportunity to address your concerns before you contact the ICO, so please contact us in the first instance.

Contact Us

For any questions about this GDPR statement or to exercise your data protection rights, please contact:

Data Protection Contact
lucid-saga
14 Grainger Street
Newcastle upon Tyne
NE1 5JE
Email: [email protected]