GDPR Compliance

Our Commitment to GDPR

fire-warp is committed to compliance with the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018. We take our responsibilities regarding your personal data seriously and have implemented appropriate measures to ensure compliance.

Legal Basis for Processing

We process your personal data under the following legal bases:

Consent

When you enroll in our programs or submit forms on our website, you provide explicit consent for us to process your personal information for the purposes stated.

Contract Performance

Processing is necessary to fulfill our contractual obligations when you enroll in our educational programs.

Legitimate Interests

We may process data based on our legitimate interests in operating and improving our services, provided this does not override your rights and freedoms.

Legal Obligations

We process data when required to comply with legal obligations, such as safeguarding requirements for working with children.

Your GDPR Rights

Under GDPR, you have the following rights regarding your personal data:

Right to Access

You can request a copy of the personal data we hold about you. We will provide this information in a commonly used electronic format.

Right to Rectification

You can request correction of inaccurate or incomplete personal data.

Right to Erasure

You can request deletion of your personal data in certain circumstances, such as when it's no longer necessary for the purposes it was collected.

Right to Restrict Processing

You can request that we limit how we use your personal data in certain situations.

Right to Data Portability

You can request to receive your personal data in a structured, machine-readable format and have it transferred to another controller.

Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes.

Rights Related to Automated Decision Making

You have the right not to be subject to decisions based solely on automated processing. We do not use automated decision-making or profiling.

How to Exercise Your Rights

To exercise any of your GDPR rights, please contact us at:

Email: [email protected]
Subject line: GDPR Data Request

We will respond to your request within one month. If your request is complex or we receive multiple requests, we may extend this period by two additional months, and we will inform you.

You will not have to pay a fee to exercise your rights unless your request is clearly unfounded, repetitive, or excessive.

Data Protection Principles

We ensure that all personal data is:

• Processed lawfully, fairly, and transparently
• Collected for specified, explicit, and legitimate purposes
• Adequate, relevant, and limited to what is necessary
• Accurate and kept up to date
• Kept only as long as necessary
• Processed securely with appropriate technical and organizational measures

Data Security Measures

We have implemented appropriate technical and organizational security measures to protect your personal data, including:

• Encryption of data in transit and at rest
• Regular security assessments and audits
• Access controls limiting data access to authorized personnel only
• Staff training on GDPR compliance and data protection
• Secure data storage systems with regular backups
• Incident response procedures

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will:

• Notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach
• Notify affected individuals without undue delay if the breach is likely to result in high risk to their rights
• Document the breach and our response

International Data Transfers

We store and process your data within the United Kingdom. If we need to transfer data outside the UK or EEA, we will ensure appropriate safeguards are in place, such as:

• Standard contractual clauses approved by the European Commission
• Adequacy decisions confirming the destination country provides adequate protection
• Your explicit consent for the transfer

Children's Data

We take extra care when processing data relating to children. We only collect information about minors through their parents or legal guardians. Parents have the right to:

• Access their child's data
• Request correction or deletion
• Withdraw consent at any time
• Object to processing

We maintain appropriate safeguarding measures when working with children and teenagers.

Third-Party Processors

When we use third-party service providers who process personal data on our behalf, we ensure they:

• Comply with GDPR requirements
• Process data only according to our instructions
• Implement appropriate security measures
• Sign data processing agreements

Data Retention

We retain personal data only as long as necessary for the purposes for which it was collected, including:

• Duration of enrollment in programs plus reasonable follow-up period
• Legal retention requirements (e.g., safeguarding records)
• Resolution of disputes or enforcement of agreements

After the retention period, we securely delete or anonymize personal data.

Complaints

If you believe we have not complied with GDPR or your data protection rights, you have the right to lodge a complaint with the supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
United Kingdom
Tel: 0303 123 1113
Website: fire-warp.com

We encourage you to contact us first so we can address your concerns directly.

Updates to This Policy

We may update this GDPR compliance statement to reflect changes in our practices or legal requirements. We will notify you of any material changes and update the "Last updated" date.

Contact Our Data Protection Officer

For any questions about GDPR compliance or data protection:

fire-warp
Data Protection Officer
42 Chichester Street
Belfast BT1 4JB
United Kingdom
Email: [email protected]