GDPR Compliance

Last updated: 25 May 2026

Our Commitment to Data Protection

luminary-tide is committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page outlines how we comply with these regulations.

Data Controller Information

For the purposes of UK GDPR, the data controller is:

luminary-tide
47 Rosemary Street
Belfast BT1 1QB
United Kingdom
Email: [email protected]

Lawful Basis for Processing

We process personal data under the following lawful bases:

Consent (Article 6(1)(a))

When you voluntarily submit information through our contact forms or subscribe to communications, you provide explicit consent for us to process that data for the stated purposes.

Contract (Article 6(1)(b))

Processing is necessary to fulfil our contractual obligations when you enrol in our educational programmes, including communication about schedules, materials, and programme delivery.

Legitimate Interests (Article 6(1)(f))

We process certain data based on legitimate interests, such as:

• Website analytics to improve user experience
• Security and fraud prevention
• Internal administration and record-keeping

We carefully balance these interests against your rights and freedoms.

Your Rights Under UK GDPR

You have the following rights regarding your personal data:

Right to Access (Article 15)

You can request confirmation of whether we process your personal data and obtain a copy of that data.

Right to Rectification (Article 16)

You can request correction of inaccurate personal data and completion of incomplete data.

Right to Erasure (Article 17)

You can request deletion of your personal data in certain circumstances, such as when it's no longer necessary for the purposes collected or when you withdraw consent.

Right to Restriction of Processing (Article 18)

You can request we restrict processing of your data in specific situations, such as when you contest its accuracy.

Right to Data Portability (Article 20)

You can request your personal data in a structured, commonly used, machine-readable format and have it transmitted to another controller.

Right to Object (Article 21)

You can object to processing based on legitimate interests or for direct marketing purposes.

Rights Related to Automated Decision-Making (Article 22)

We do not use automated decision-making or profiling that produces legal effects concerning you.

Exercising Your Rights

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month, though this may be extended by two additional months for complex requests.

We may request additional information to verify your identity before processing requests.

Data Protection Principles

We adhere to the UK GDPR data protection principles, ensuring personal data is:

• Processed lawfully, fairly, and transparently
• Collected for specified, explicit, and legitimate purposes
• Adequate, relevant, and limited to what's necessary
• Accurate and kept up to date
• Kept only as long as necessary
• Processed securely with appropriate safeguards

Data Security Measures

We implement appropriate technical and organisational measures to ensure data security, including:

• Encryption of data in transit and at rest
• Regular security assessments and updates
• Access controls limiting data access to authorised personnel
• Staff training on data protection requirements
• Incident response procedures for data breaches

Data Breach Notification

In the event of a personal data breach likely to result in risk to your rights and freedoms, we will notify you and the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach, as required by Article 33 and 34 of UK GDPR.

International Data Transfers

We primarily process data within the United Kingdom. If we transfer personal data outside the UK, we ensure appropriate safeguards are in place, such as:

• Adequacy decisions by the UK government
• Standard contractual clauses approved by the ICO
• Binding corporate rules

Children's Data

While our programmes serve children and teenagers, we collect personal information only from parents or legal guardians. We process children's data with particular care and only when necessary for programme delivery, always with parental consent.

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, or reporting requirements. Specific retention periods include:

• Programme participant data: 3 years after programme completion
• Enquiry data (unconverted): 12 months
• Financial records: 6 years (legal requirement)
• Website analytics: 26 months

Third-Party Data Processors

When we engage third-party service providers who process personal data on our behalf, we ensure they:

• Provide sufficient guarantees of GDPR compliance
• Process data only on our documented instructions
• Maintain appropriate security measures
• Are bound by written data processing agreements

Complaints and Supervisory Authority

If you believe we have not handled your data in accordance with UK GDPR, you have the right to lodge a complaint with:

Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
United Kingdom
Telephone: 0303 123 1113
Website: luminary-tide.com

Updates to This Information

We may update this GDPR compliance information to reflect changes in our practices or legal requirements. The "Last updated" date indicates when the most recent changes were made.

Contact Us

For questions about our GDPR compliance or to exercise your data protection rights, contact us at [email protected].