Information on this site is advertising in nature.

GDPR Compliance

Last updated: September 1, 2026

Our commitment to data protection

plateau-puma.com is committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Data controller

For the purposes of data protection legislation, the data controller is:

plateau-puma.com
42 Stonegate
York YO1 8AS
United Kingdom
Email:

Your rights under UK GDPR

Right to be informed

You have the right to clear, transparent information about how we use your personal data. This is provided through our privacy policy and this GDPR compliance statement.

Right of access

You can request a copy of the personal data we hold about you. This is known as a Subject Access Request (SAR). We will respond within one month of receiving your request.

Right to rectification

If personal information we hold about you is inaccurate or incomplete, you have the right to have it corrected. We will make corrections within one month of your request.

Right to erasure

Also known as the "right to be forgotten," you can request deletion of your personal data in certain circumstances, including:

  • The data is no longer necessary for the purpose it was collected
  • You withdraw consent on which processing is based
  • You object to processing and there are no overriding legitimate grounds
  • The data has been unlawfully processed

This right is not absolute. We may need to retain certain information for legal or regulatory purposes.

Right to restrict processing

You can request that we temporarily or permanently stop processing your personal data in certain circumstances, such as when:

  • You contest the accuracy of the data
  • Processing is unlawful but you do not want the data erased
  • We no longer need the data but you need it for legal claims
  • You have objected to processing and verification of legitimate grounds is pending

Right to data portability

You have the right to obtain and reuse your personal data for your own purposes across different services. This applies to data you have provided to us where processing is based on consent or contract performance and is carried out by automated means.

Right to object

You have the right to object to processing based on legitimate interests or the performance of a task in the public interest. We must stop processing unless we can demonstrate compelling legitimate grounds that override your rights.

You have an absolute right to object to processing for direct marketing purposes.

Rights related to automated decision-making

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects on individuals.

How to exercise your rights

To exercise any of these rights, contact us at

When making a request, please provide:

  • Your full name
  • Email address used for course bookings or communications
  • Specific details of your request
  • Proof of identity (if required for security purposes)

We will respond to requests within one month. In complex cases, this may be extended by up to two additional months, and we will inform you of any such extension.

Lawful basis for processing

We process personal data under the following lawful bases:

Consent

For marketing communications and certain optional features. You can withdraw consent at any time.

Contract

Processing necessary to fulfill course bookings and provide services you have requested.

Legal obligation

When required by UK law, such as retaining financial records for tax purposes.

Legitimate interests

For improving our services, website functionality, and fraud prevention, where such interests do not override your rights and freedoms.

Data security

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

  • Encryption of data in transit and at rest
  • Regular security assessments and updates
  • Access controls and authentication requirements
  • Staff training on data protection
  • Secure backup and recovery procedures

Data breach notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify you and the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach.

International data transfers

We primarily store and process data within the United Kingdom. If data is transferred outside the UK, we ensure appropriate safeguards are in place as required by UK GDPR.

Data protection officer

For questions about data protection or to exercise your rights, contact

Complaints

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the supervisory authority:

Information Commissioner's Office (ICO)
Website: ico.org.uk
Helpline: 0303 123 1113

Updates to this statement

We review and update this GDPR compliance statement regularly. Changes will be posted on this page with an updated revision date.