GDPR Compliance Statement

Last updated: August 4, 2026

Our Commitment to Data Protection

Lavender-cove is committed to protecting your personal data in accordance with the UK General Data Protection Regulation and the Data Protection Act 2018. This statement outlines how we fulfill our obligations as a data controller.

Lawful Basis for Processing

We process personal data under the following lawful bases:

• Contract: Processing is necessary to fulfill our contractual obligations when you enroll in a course
• Legitimate Interest: We have a legitimate interest in improving our educational services and communicating with prospective students
• Consent: For marketing communications beyond essential course information, we obtain explicit consent

Data Subject Rights

Under GDPR, you have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data in certain circumstances
• Right to Restrict Processing: Request limitation of how we process your data
• Right to Data Portability: Receive your data in a structured, commonly used format
• Right to Object: Object to processing based on legitimate interests or for direct marketing
• Rights Related to Automated Decision Making: We do not use automated decision-making or profiling

How to Exercise Your Rights

To exercise any of these rights, send a written request to [email protected] or postal mail to 47 Whitfield Street, Fitzrovia, London W1T 4HB, United Kingdom. We will respond within one month of receiving your request.

Data Protection Officer

For data protection inquiries or concerns, contact our Data Protection Officer at [email protected].

International Data Transfers

We do not transfer personal data outside the United Kingdom or European Economic Area. All data storage and processing occurs within jurisdictions that provide adequate data protection.

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the Information Commissioner's Office within 72 hours of becoming aware of the breach.

Complaints

If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with the Information Commissioner's Office at ico.org.uk or by calling 0303 123 1113.

Children's Data

For students under 16 years old enrolling in our junior courses, we obtain verifiable parental consent before collecting or processing personal data. Parents have the right to review, modify, or request deletion of their child's information.

Retention Schedule

Personal data is retained only as long as necessary for the purposes for which it was collected, typically:

• Active enrollment records: Duration of course plus 7 years
• Marketing consent records: Until consent is withdrawn
• Website analytics: 26 months