Home About Courses Contact Advertising Content

GDPR Compliance

Our commitment to data protection and your rights

Last Updated: October 7, 2026

Our GDPR Commitment

At dune-flow.com, we are committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page explains how we comply with these regulations and what rights you have regarding your personal information.

Data Controller

For the purposes of UK GDPR, the data controller is:

dune-flow.com
52 Colmore Row
Birmingham B3 2BS
United Kingdom
Email: [email protected]

Lawful Basis for Processing

We process your personal data under the following lawful bases:

  • Consent: When you voluntarily provide information through forms or communications
  • Contract: When processing is necessary to fulfill our contractual obligations for course delivery
  • Legitimate Interests: For improving our services and communicating relevant information, balanced against your rights
  • Legal Obligation: When required by UK law

Your Rights Under GDPR

Right to Access

You have the right to request a copy of all personal data we hold about you. We will provide this information in a commonly used electronic format within one month of your request.

Right to Rectification

If you believe any information we hold about you is inaccurate or incomplete, you have the right to request correction or completion of that data.

Right to Erasure

Also known as the "right to be forgotten," you can request deletion of your personal data when:

  • The data is no longer necessary for the purposes it was collected
  • You withdraw consent and no other legal basis exists for processing
  • You object to processing and no overriding legitimate grounds exist
  • The data has been unlawfully processed

Right to Restriction of Processing

You can request that we limit how we use your data in certain circumstances, such as when you contest the accuracy of the data or object to processing.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller.

Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes at any time.

Rights Related to Automated Decision Making

We do not use automated decision making or profiling in our services. All course enrollment decisions and communications involve human review.

How to Exercise Your Rights

To exercise any of these rights, contact us at [email protected] with:

  • Your full name
  • Email address associated with your enrollment or inquiry
  • Clear description of which right you wish to exercise
  • Any relevant details to help us locate your information

We will respond to your request within one month. In complex cases, we may extend this by two additional months and will notify you if this becomes necessary.

Data Security Measures

We implement appropriate technical and organizational measures to ensure data security, including:

  • Encryption of data in transit and at rest
  • Access controls limiting who can view personal data
  • Regular security assessments and updates
  • Staff training on data protection obligations
  • Secure backup procedures

International Data Transfers

Your personal data is primarily stored and processed within the United Kingdom. If we transfer data outside the UK, we ensure appropriate safeguards are in place through adequacy decisions or standard contractual clauses approved by UK authorities.

Data Breach Notification

In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will notify you and the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach.

Retention Periods

We retain personal data only as long as necessary for the purposes outlined in our Privacy Policy:

  • Course enrollment records: 2 years after course completion
  • Email correspondence: 3 years
  • Marketing consent records: until consent is withdrawn
  • Financial records: 6 years as required by UK tax law

Children's Data

We do not process personal data of children under 13 without verified parental consent. For children aged 13-18, we obtain parental consent before collecting or processing their information for course enrollment.

Complaints

If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with the supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
United Kingdom
Tel: 0303 123 1113
Website: ico.org.uk

Updates to This Statement

We may update this GDPR compliance statement to reflect changes in our practices or legal requirements. We will post any changes on this page with an updated date.

Contact Us

For any questions regarding GDPR compliance or data protection, contact us at [email protected]