GDPR Compliance Information

Last Updated: September 1, 2026

Our Commitment to GDPR

plum-ravine is committed to complying with the General Data Protection Regulation and protecting the personal data of our course participants, website visitors, and all individuals whose information we process. This page provides specific information about how we fulfil our GDPR obligations.

Data Controller Information

For the purposes of GDPR, the data controller is:

plum-ravine
142 Division Street
Sheffield S1 4GH
United Kingdom
[email protected]

Lawful Basis for Processing

We process personal data only when we have a lawful basis under GDPR Article 6. Our processing activities rely on the following legal bases:

Contractual Necessity

Processing necessary for performing our contract with you when you enrol in our educational courses, including:

  • Managing course registrations and participant records
  • Delivering educational content and course materials
  • Processing payments and issuing receipts
  • Providing participant support and responding to course-related enquiries

Consent

Processing based on your explicit consent for:

  • Marketing communications about new courses and educational resources
  • Optional cookies for website analytics and improvement
  • Participant testimonials and success stories

You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

Legitimate Interests

Processing necessary for our legitimate business interests, including:

  • Improving course content and delivery methods
  • Analysing website usage to enhance user experience
  • Preventing fraud and ensuring platform security
  • Managing business operations and administrative functions

We have assessed these legitimate interests and determined they do not override your fundamental rights and freedoms.

Legal Obligation

Processing required to comply with legal obligations, such as:

  • Maintaining financial records for tax purposes
  • Responding to lawful requests from authorities
  • Meeting regulatory requirements for educational services

Your Rights Under GDPR

You have comprehensive rights regarding your personal data under GDPR:

Right to Access

You may request confirmation of whether we process your personal data and access to that data. We will provide a copy of your personal information in a commonly used electronic format.

Right to Rectification

You can request correction of inaccurate personal data and completion of incomplete data relevant to the processing purposes.

Right to Erasure

You may request deletion of your personal data when:

  • The data is no longer necessary for the purposes for which it was collected
  • You withdraw consent and no other legal basis exists
  • You object to processing and no overriding legitimate grounds exist
  • The data has been unlawfully processed
  • Deletion is required for compliance with legal obligations

This right may be limited by legal obligations requiring us to retain certain data.

Right to Restriction of Processing

You may request restriction of processing when:

  • You contest the accuracy of personal data during verification
  • Processing is unlawful but you prefer restriction to erasure
  • We no longer need the data but you require it for legal claims
  • You have objected to processing pending verification of our legitimate grounds

Right to Data Portability

For data processed based on consent or contract, you may receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller.

Right to Object

You may object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

Rights Related to Automated Decision-Making

We do not engage in automated decision-making or profiling that produces legal or similarly significant effects. All course enrolment decisions involve human review.

Exercising Your Rights

To exercise any of your GDPR rights, contact us at [email protected] with your request. Please include:

  • Your full name and contact information
  • Specific right you wish to exercise
  • Details of the data or processing concerned
  • Proof of identity if necessary for verification

We will respond to your request within one month, which may be extended by two months for complex requests. We do not charge fees for requests unless they are manifestly unfounded or excessive.

Data Protection Measures

We implement appropriate technical and organisational measures to ensure security of personal data, including:

  • Encryption of data in transit and at rest
  • Access controls and authentication requirements
  • Regular security assessments and vulnerability testing
  • Staff training on data protection principles
  • Incident response procedures for data breaches
  • Data minimisation and privacy by design principles

International Data Transfers

We primarily process and store data within the United Kingdom. If international transfers occur, we ensure adequate safeguards through approved mechanisms such as Standard Contractual Clauses or transfers to countries with adequacy decisions.

Data Breach Notification

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify you without undue delay. We maintain procedures to detect, report, and investigate breaches and will notify the Information Commissioner's Office within 72 hours when required.

Data Retention Periods

We retain personal data only as long as necessary for the purposes collected:

  • Course participant records: 7 years following course completion
  • Financial records: 7 years as required by law
  • Marketing consent records: Until consent is withdrawn
  • Website analytics: 2 years
  • General enquiry correspondence: 2 years

Right to Lodge a Complaint

If you believe we have not processed your personal data in accordance with GDPR, you have the right to lodge a complaint with the supervisory authority:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
United Kingdom
Telephone: 0303 123 1113
Website: ico.org.uk

Updates to GDPR Information

We may update this GDPR information to reflect changes in our processing activities or legal requirements. Significant changes will be communicated to active course participants and website visitors.

Contact for Data Protection Matters

For questions about our GDPR compliance or to exercise your data protection rights, contact us at [email protected]