GDPR Compliance Statement

Last Updated: September 23, 2026

Our Commitment to Data Protection

We are committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR). This page outlines how we comply with GDPR requirements and respect your data protection rights.

Legal Basis for Processing

We process your personal data under the following legal bases:

• Consent: When you voluntarily provide information through our enrollment forms
• Contract: To fulfill our obligations in providing educational services
• Legitimate Interest: To improve our services and communicate relevant information
• Legal Obligation: When required to comply with applicable laws

Data We Collect and Why

We collect only the personal data necessary to provide our educational services:

• Contact information for enrollment and communication
• Course preferences to match you with appropriate programs
• Communication history to provide better service

Your GDPR Rights

Under GDPR, you have the following rights regarding your personal data:

Right to Access

You have the right to request copies of your personal data. We may charge a reasonable fee for multiple copies.

Right to Rectification

You have the right to request correction of inaccurate or incomplete personal data.

Right to Erasure

You have the right to request deletion of your personal data under certain conditions.

Right to Restrict Processing

You have the right to request restriction of processing your personal data under certain conditions.

Right to Data Portability

You have the right to request transfer of your data to another organization or directly to you.

Right to Object

You have the right to object to our processing of your personal data under certain conditions.

Rights Related to Automated Decision Making

We do not use automated decision-making or profiling that produces legal effects concerning you.

Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in our Privacy Policy, unless a longer retention period is required by law. When data is no longer needed, we securely delete or anonymize it.

Data Security Measures

We implement appropriate technical and organizational security measures to protect your personal data, including:

• Encryption of data in transit and at rest
• Regular security assessments and updates
• Access controls and authentication procedures
• Staff training on data protection practices

International Data Transfers

Your data is primarily stored and processed within the United Kingdom and the European Economic Area. If we transfer data outside these regions, we ensure appropriate safeguards are in place.

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and relevant authorities within 72 hours as required by GDPR.

How to Exercise Your Rights

To exercise any of your GDPR rights, please contact us at:

contact at marsh-bison.com
42 Deansgate, Manchester M3 2AY, United Kingdom

We will respond to your request within one month. If your request is complex, we may extend this period by two additional months and will inform you of any extension.

Right to Lodge a Complaint

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection.

Information Commissioner's Office
Website: ico.org.uk

Updates to This Statement

We may update this GDPR compliance statement to reflect changes in our practices or legal requirements. We will post any updates on this page with a revised date.