Last updated: September 2026
For the purposes of the General Data Protection Regulation (GDPR), opal-lagoon is the data controller responsible for your personal information. We are committed to protecting and respecting your privacy in accordance with GDPR requirements.
We process personal data under the following legal bases:
You have the right to request copies of your personal data. We may charge a reasonable fee for additional copies if you request multiple instances of the same information.
You have the right to request correction of information you believe is inaccurate. You also have the right to request completion of information you believe is incomplete.
You have the right to request deletion of your personal data under certain conditions, including when the data is no longer necessary for the purposes it was collected or you withdraw consent.
You have the right to request restriction of processing your personal data under certain conditions, such as when you contest the accuracy of the data or object to processing.
You have the right to request transfer of data we have collected to another organization or directly to you under certain conditions.
You have the right to object to our processing of your personal data under certain conditions, particularly for processing based on legitimate interests or for direct marketing purposes.
We retain personal data only for as long as necessary to fulfill the purposes outlined in our privacy policy or as required by law. Course participant records are retained for administrative and legal compliance purposes.
When personal data is no longer required, it is securely deleted or anonymized to prevent identification.
Personal data collected through this website is stored and processed within the United Kingdom. We do not transfer personal data outside the UK or European Economic Area unless adequate safeguards are in place.
We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including protection against unauthorized or unlawful processing and accidental loss, destruction, or damage.
We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects individuals.
To exercise any of your GDPR rights or for questions about data processing, contact us using the email address provided on our contact page. We will respond to requests within one month, though this period may be extended by two additional months where necessary.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data protection rights have been violated.
We may update this GDPR compliance notice to reflect changes in our data processing practices or legal requirements. Updated versions will be posted on this page with a revised date.