This page contains advertising material

GDPR Compliance

Your data protection rights under UK GDPR

Our Commitment to Data Protection

hollow-orca is committed to full compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page explains your rights and how we uphold them in our data processing activities.

Data Controller Information

For the purposes of data protection legislation, hollow-orca acts as the data controller for personal information collected through our website and educational services.

Data Controller:
hollow-orca
47 Wellington Street
Leeds LS1 4JE
United Kingdom
Email: [email protected]

Lawful Basis for Processing

We process personal data only when we have a lawful basis under UK GDPR:

Consent

When you provide explicit consent for specific processing activities, such as receiving marketing communications. You may withdraw consent at any time.

Contract Performance

Processing necessary to fulfill our contractual obligations when you enroll in courses, including managing registrations, scheduling classes, and providing educational services.

Legitimate Interests

Processing necessary for our legitimate business interests, such as improving services, analyzing website usage, and preventing fraud, provided these interests do not override your fundamental rights.

Legal Obligation

Processing required to comply with legal obligations under UK law, including financial record-keeping and regulatory compliance.

Your Data Protection Rights

Right of Access

You have the right to request access to your personal data. We will provide a copy of the data we hold about you, along with information about how we process it. The first copy is provided free of charge; additional copies may incur a reasonable administrative fee.

Right to Rectification

You can request correction of inaccurate or incomplete personal data. We will update your information promptly upon verification of the requested changes.

Right to Erasure

Under certain circumstances, you can request deletion of your personal data, including when:

  • The data is no longer necessary for the purpose it was collected
  • You withdraw consent and no other legal basis exists
  • You object to processing and no overriding legitimate grounds exist
  • The data has been unlawfully processed
  • Erasure is required to comply with a legal obligation

Note that we may retain certain data when legal obligations require retention, such as financial records.

Right to Restrict Processing

You can request that we limit how we use your data when:

  • You contest the accuracy of the data
  • Processing is unlawful but you prefer restriction over erasure
  • We no longer need the data but you require it for legal claims
  • You have objected to processing pending verification of legitimate grounds

Right to Data Portability

For data you provided based on consent or contract, you can request a copy in a structured, commonly used, machine-readable format. Where technically feasible, we can transmit this data directly to another controller.

Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

Rights Related to Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. hollow-orca does not engage in automated decision-making or profiling that would trigger this right.

How to Exercise Your Rights

To exercise any of these rights, contact us at [email protected] with your request. Please include:

  • Your full name and contact information
  • Specific right you wish to exercise
  • Details to help us locate your information
  • Verification of your identity (if required)

We will respond to your request within one month. In complex cases, we may extend this period by two additional months, in which case we will inform you of the extension and the reasons for it.

Data Security Measures

We implement appropriate technical and organizational measures to ensure data security:

  • Encryption of data in transit and at rest
  • Access controls limiting data access to authorized personnel
  • Regular security assessments and updates
  • Staff training on data protection principles
  • Secure backup systems
  • Incident response procedures

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify you without undue delay. We will also notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach, as required by UK GDPR.

Data Retention Periods

We retain personal data only for as long as necessary:

  • Enrollment data: Seven years following course completion
  • Financial records: Seven years as required by UK tax law
  • Marketing communications: Until consent is withdrawn
  • Website analytics: Aggregated data retained indefinitely; individual data deleted after 26 months

Third-Party Data Processing

When we engage third-party processors, we ensure:

  • Written contracts specify data processing terms
  • Processors comply with UK GDPR requirements
  • Appropriate security measures are implemented
  • Processors only use data for specified purposes
  • Processors assist with data subject rights requests

International Data Transfers

If we transfer data outside the United Kingdom, we ensure adequate protection through:

  • Adequacy decisions by the UK government
  • Standard contractual clauses approved by the ICO
  • Binding corporate rules
  • Other approved transfer mechanisms

Children's Data

For children under 13 enrolled in our programs, we obtain verifiable parental consent before collecting personal data. Parents can:

  • Review their child's personal information
  • Request correction or deletion of data
  • Refuse further collection or use of data

Complaints and Supervisory Authority

If you believe we have not complied with UK GDPR or handled your data inappropriately, you have the right to lodge a complaint with the Information Commissioner's Office:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk

We encourage you to contact us first so we can address your concerns directly.

Updates to This Information

We review and update our GDPR compliance practices regularly. Any significant changes will be reflected on this page and communicated through appropriate channels.

Additional Resources

For more information about our data practices: