GDPR Compliance Statement

Our Commitment to Data Protection

suntneortha is committed to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We take our responsibilities regarding the protection of personal data seriously and have implemented appropriate policies, procedures, and technical measures.

Data Protection Principles

We adhere to the following data protection principles in all processing activities:

• Lawfulness, Fairness, and Transparency: We process data lawfully, fairly, and in a transparent manner
• Purpose Limitation: Data is collected for specified, explicit, and legitimate purposes
• Data Minimization: We collect only data that is adequate, relevant, and necessary
• Accuracy: Personal data is kept accurate and up to date
• Storage Limitation: Data is retained only as long as necessary
• Integrity and Confidentiality: Data is processed securely with appropriate protection measures
• Accountability: We demonstrate compliance and take responsibility for processing activities

Legal Bases for Processing

We process personal data under one or more of the following legal bases:

Contract

Processing is necessary for the performance of a contract with you, including:

• Managing course enrolments and student relationships
• Delivering educational services
• Processing payments
• Providing course materials and support

Legitimate Interests

Processing is necessary for our legitimate business interests, including:

• Responding to enquiries from prospective students
• Improving our services and website functionality
• Preventing fraud and ensuring security
• Managing business operations efficiently

Legal Obligation

Processing is necessary to comply with legal requirements, including:

• Maintaining financial records for tax purposes
• Responding to lawful requests from authorities
• Meeting regulatory obligations

Consent

Where required, we obtain explicit consent before processing, particularly for:

• Marketing communications
• Optional data collection beyond what is necessary for service delivery

Your Rights Under UK GDPR

You have the following rights regarding your personal data:

Right of Access

You can request confirmation of whether we process your personal data and obtain a copy of that data. We will provide this information free of charge within one month of your request.

Right to Rectification

You can request correction of inaccurate or incomplete personal data. We will make corrections promptly upon verification.

Right to Erasure

In certain circumstances, you can request deletion of your personal data, including when:

• The data is no longer necessary for the purposes it was collected
• You withdraw consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed

This right may be limited by legal obligations requiring data retention.

Right to Restriction of Processing

You can request that we limit how we use your data in specific situations, such as when:

• You contest the accuracy of the data
• Processing is unlawful but you prefer restriction over erasure
• We no longer need the data but you require it for legal claims
• You have objected to processing pending verification of legitimate grounds

Right to Data Portability

Where processing is based on consent or contract and carried out by automated means, you can request to receive your data in a structured, commonly used, machine-readable format and transmit it to another controller.

Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.

Rights Related to Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. We do not currently engage in automated decision-making of this nature.

Exercising Your Rights

To exercise any of these rights, contact us at:

Email: [email protected]
Address: 42 Donegall Place, Belfast BT1 5AE, United Kingdom

We will respond to your request within one month. In complex cases, this may be extended by up to two additional months, and we will inform you of any extension.

We may request additional information to verify your identity before processing requests.

Data Security Measures

We implement appropriate technical and organizational measures to ensure data security, including:

• Encryption of data in transit and at rest
• Access controls limiting data access to authorized personnel
• Regular security assessments and penetration testing
• Secure backup and disaster recovery procedures
• Staff training on data protection responsibilities
• Incident response procedures for data breaches

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will:

• Notify the Information Commissioner's Office within 72 hours of becoming aware
• Notify affected individuals without undue delay if there is a high risk
• Document the breach and our response measures
• Take steps to mitigate harm and prevent recurrence

Data Processors and Third Parties

Where we engage third-party processors to handle personal data on our behalf, we ensure:

• Written contracts are in place specifying processing requirements
• Processors provide sufficient guarantees of appropriate security measures
• Processors only process data according to our documented instructions
• Processors assist with fulfilling data subject rights requests
• Processors notify us of any data breaches

International Data Transfers

If we transfer personal data outside the United Kingdom, we ensure appropriate safeguards are in place, such as:

• Adequacy decisions recognizing equivalent protection standards
• Standard contractual clauses approved by UK authorities
• Binding corporate rules for intra-organizational transfers

Records of Processing Activities

We maintain comprehensive records of our processing activities, including:

• Purposes of processing
• Categories of data subjects and personal data
• Categories of recipients
• Details of international transfers
• Retention periods
• Security measures

Privacy by Design and Default

We implement data protection principles at the design stage of any new processing activities and throughout the data lifecycle. This includes:

• Minimizing data collection to what is necessary
• Implementing appropriate default privacy settings
• Building security into systems from inception
• Conducting Data Protection Impact Assessments for high-risk processing

Complaints and Supervisory Authority

If you believe we have not handled your personal data in accordance with UK GDPR, you can lodge a complaint with:

Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
United Kingdom

Telephone: 0303 123 1113
Website: ico.org.uk

We encourage you to contact us first so we can address your concerns directly.

Updates to This Statement

We review and update this GDPR compliance statement periodically to reflect changes in our processing activities or regulatory requirements. Significant updates will be communicated through our website and, where appropriate, directly to affected individuals.

Contact Information

For questions regarding our GDPR compliance or data protection practices, contact us at:

Email: [email protected]
Address: 42 Donegall Place, Belfast BT1 5AE, United Kingdom