GDPR Compliance Statement

Last updated: 14 May 2026

Our Commitment to GDPR

twilight-brim is committed to full compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We take our data protection responsibilities seriously and have implemented appropriate measures to ensure your data is processed lawfully, fairly, and transparently.

Data Controller

For the purposes of UK GDPR, the data controller is:

twilight-brim
42 Wellington Street
Leeds LS1 4DN
United Kingdom
Email: [email protected]

Lawful Basis for Processing

We process personal data under the following lawful bases:

• Consent: When you voluntarily provide your information through our enquiry forms
• Contract: To fulfil our obligations when delivering educational services
• Legitimate Interests: To improve our services and communicate relevant information, while respecting your fundamental rights

Your GDPR Rights

Under UK GDPR, you have comprehensive rights regarding your personal data:

Right of Access

You can request a copy of the personal data we hold about you. We will provide this within one month of your request.

Right to Rectification

If your data is inaccurate or incomplete, you can request corrections. We will update our records promptly.

Right to Erasure

Also known as the "right to be forgotten," you can request deletion of your personal data in certain circumstances.

Right to Restriction of Processing

You can request that we limit how we use your data while we resolve any issues you've raised.

Right to Data Portability

You can request your data in a structured, commonly used format to transfer to another service provider.

Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes.

Rights Related to Automated Decision Making

We do not use automated decision making or profiling that produces legal effects concerning you.

How to Exercise Your Rights

To exercise any of these rights, please contact us:

• Email: [email protected]
• Post: 42 Wellington Street, Leeds LS1 4DN, United Kingdom

We will respond to your request within one month. In complex cases, we may extend this by two additional months and will inform you of any delay.

Data Minimisation

We only collect data that is necessary for the specific purposes outlined in our Privacy Policy. We do not collect excessive or irrelevant information.

Storage and Security

We implement appropriate technical and organisational measures to protect your data:

• Encrypted data transmission
• Regular security assessments
• Access controls and staff training
• Secure data storage systems

Data Retention

We retain personal data only for as long as necessary:

• Enquiry data: 12 months from last contact
• Client records: Duration of service plus 6 years for legal compliance
• Website analytics: 26 months

International Transfers

We do not transfer your personal data outside the United Kingdom. All data is stored and processed within the UK on secure servers.

Breach Notification

In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will notify you and the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach.

Complaints

If you believe we've not handled your data correctly, you have the right to lodge a complaint with the supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Tel: 0303 123 1113
Website: ico.org.uk

Updates to This Statement

We review and update this GDPR compliance statement regularly to reflect changes in legislation or our practices. Please check this page periodically for updates.

Contact Our Data Protection Team

For any questions about GDPR compliance or data protection:

Email: [email protected]
Subject line: Data Protection Enquiry