GDPR Compliance

General Data Protection Regulation

Branch-field is committed to compliance with the General Data Protection Regulation (GDPR) and UK data protection laws. This page outlines how we protect your rights and handle your personal data in accordance with these regulations.

Data Controller

Branch-field acts as the data controller for personal information collected through our website and course enrollment processes.

Contact Details:
Branch-field Financial Education Centre
47 Whiteladies Road, Clifton
Bristol BS8 2LS
United Kingdom
Email: [email protected]

Your Rights Under GDPR

Right to be Informed

You have the right to be informed about the collection and use of your personal data. We provide this information through our privacy policy and enrollment materials.

Right of Access

You can request access to the personal data we hold about you. We will provide a copy of your data in a commonly used electronic format within one month of your request.

Right to Rectification

If your personal data is inaccurate or incomplete, you have the right to have it corrected. Contact us to update your information at any time.

Right to Erasure

Also known as the "right to be forgotten," you can request deletion of your personal data in certain circumstances, including:

• The data is no longer necessary for the purpose it was collected
• You withdraw consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• The data was unlawfully processed

Note: We may need to retain certain data to comply with legal obligations or defend legal claims.

Right to Restrict Processing

You can request that we restrict processing of your personal data in specific situations, such as when you contest the accuracy of the data or object to processing.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.

Right to Object

You can object to processing of your personal data where we rely on legitimate interests as the legal basis. This includes objecting to direct marketing communications.

Rights Related to Automated Decision Making

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects on individuals.

Exercising Your Rights

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month, though this may be extended by two additional months for complex requests.

We may need to verify your identity before processing your request to ensure data security.

Lawful Basis for Processing

We process personal data only when we have a lawful basis, including:

• Consent: You have given clear consent for us to process your personal data for specific purposes
• Contract: Processing is necessary to fulfill a contract with you or to take steps at your request before entering a contract
• Legal Obligation: Processing is necessary to comply with the law
• Legitimate Interests: Processing is necessary for our legitimate interests or those of a third party, provided your rights do not override those interests

Data Protection Measures

We implement appropriate technical and organizational measures to ensure data security, including:

• Encryption of data in transit and at rest
• Access controls and authentication procedures
• Regular security assessments
• Staff training on data protection
• Secure data storage and backup systems

Data Breach Procedures

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. If the breach poses a high risk, we will also notify affected individuals without undue delay.

International Data Transfers

We primarily store and process data within the United Kingdom. If we transfer data outside the UK, we ensure appropriate safeguards are in place, such as adequacy decisions or standard contractual clauses.

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including:

• Student enrollment and course administration records: 7 years after course completion
• Financial records: as required by law (typically 6-7 years)
• Marketing consent records: until consent is withdrawn
• Website usage data: typically 12-24 months

Children's Data

For children under 18 enrolling in our courses, we require parental or guardian consent. We collect only data necessary for course administration and emergency contact purposes.

Lodging a Complaint

If you believe we have not handled your data in accordance with GDPR, you have the right to lodge a complaint with a supervisory authority.

Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Phone: 0303 123 1113
Website: ico.org.uk

Updates to This Document

We may update this GDPR compliance statement to reflect changes in our practices or legal requirements. Significant changes will be communicated through our website and, where appropriate, via email to enrolled students.