GDPR Compliance
Information about how Bright-brook complies with UK General Data Protection Regulation
Our Commitment to Data Protection
Bright-brook is committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We recognize the importance of protecting personal data and respecting individual privacy rights.
Data Controller Information
Bright-brook acts as the data controller for personal information collected through our website and educational programmes. As data controller, we determine the purposes and means of processing your personal data.
Contact details:
Bright-brook
42 Wellington Street
Oxford, Oxfordshire OX1 2JF
United Kingdom
Email: [email protected]
Lawful Basis for Processing
We process personal data only when we have a lawful basis under UK GDPR. Our processing activities rely on:
- Consent: When you provide explicit consent for specific processing activities
- Contract: When processing is necessary to fulfill our contractual obligations for educational programmes
- Legitimate Interests: When processing serves our legitimate business interests without overriding your rights
- Legal Obligation: When processing is required to comply with UK legal requirements
Your Data Protection Rights
Under UK GDPR, you have the following rights regarding your personal data:
Right of Access
You can request a copy of the personal data we hold about you, along with information about how it is processed.
Right to Rectification
You can request correction of inaccurate or incomplete personal data.
Right to Erasure
You can request deletion of your personal data in certain circumstances, such as when it is no longer necessary for the purposes it was collected.
Right to Restrict Processing
You can request that we limit how we use your personal data in specific situations.
Right to Data Portability
You can request to receive your personal data in a structured, commonly used format and transmit it to another controller.
Right to Object
You can object to processing based on legitimate interests or for direct marketing purposes.
Rights Related to Automated Decision-Making
You have rights regarding decisions made solely by automated means that significantly affect you. We do not currently engage in automated decision-making.
Right to Withdraw Consent
Where processing is based on consent, you can withdraw that consent at any time.
How to Exercise Your Rights
To exercise any of these rights, contact us at [email protected] with your request. We will respond within one month, though this may be extended by two additional months for complex requests.
We may require identification verification to ensure we release information only to entitled individuals.
Data Security Measures
We implement appropriate technical and organizational security measures to protect personal data, including:
- Encryption of data in transit and at rest
- Access controls limiting who can view personal data
- Regular security assessments and updates
- Staff training on data protection responsibilities
- Incident response procedures for potential data breaches
Data Breach Notification
In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the Information Commissioner's Office within 72 hours of becoming aware of the breach, as required by UK GDPR.
International Data Transfers
We primarily process data within the United Kingdom. If personal data is transferred outside the UK, we ensure appropriate safeguards are in place, such as:
- Standard contractual clauses approved by regulatory authorities
- Transfers to countries with adequate data protection levels
- Other legally recognized transfer mechanisms
Data Protection by Design and Default
We incorporate data protection principles into our operations from the outset, implementing technical and organizational measures that ensure privacy protection is built into our systems and processes.
Record Keeping
We maintain records of our processing activities as required by UK GDPR, including the purposes of processing, data categories, recipients, retention periods, and security measures.
Complaints and Supervisory Authority
If you believe we have not complied with UK GDPR requirements, you can lodge a complaint with the Information Commissioner's Office (ICO):
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
United Kingdom
Website: ico.org.uk
Updates to This Information
We may update our GDPR compliance information periodically. Changes will be posted on this page with an updated revision date.