GDPR Compliance

Last Updated: August 2026

Our Commitment to Data Protection

base-branch is committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Data Controller

base-branch acts as the data controller for personal information collected through our website and educational programmes.

Contact Details:
base-branch
42 Wellington Place
Belfast BT1 6GE
United Kingdom
Email: [email protected]

Lawful Basis for Processing

We process personal data under the following lawful bases:

• Performance of a contract: When you enroll in a programme, we process your data to deliver the educational services
• Legitimate interests: We process data to improve our services, prevent fraud, and maintain security
• Consent: For marketing communications and optional services, we obtain your explicit consent
• Legal obligation: To comply with tax, accounting, and regulatory requirements

Your Data Protection Rights

Right to Access

You can request a copy of the personal data we hold about you. We will provide this within one month of your request.

Right to Rectification

If your personal data is inaccurate or incomplete, you have the right to request corrections.

Right to Erasure

You can request deletion of your personal data when:

• The data is no longer necessary for the purpose it was collected
• You withdraw consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed

Right to Restrict Processing

You can request that we limit how we use your data in certain circumstances, such as when you contest the accuracy of the data.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and transmit it to another controller.

Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we have compelling legitimate grounds.

Rights Related to Automated Decision Making

We do not use automated decision-making or profiling in our operations.

How to Exercise Your Rights

To exercise any of these rights, contact us at [email protected] with your request. We will respond within one month. In complex cases, we may extend this period by two additional months and will inform you of the extension.

Data Security Measures

We implement appropriate technical and organizational security measures including:

• Encryption of data in transit and at rest
• Regular security assessments and updates
• Access controls and authentication requirements
• Staff training on data protection
• Secure backup and recovery procedures

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach.

Third-Party Processing

When we use third-party service providers to process personal data on our behalf, we ensure they:

• Process data only on our documented instructions
• Implement appropriate security measures
• Assist us in meeting our GDPR obligations
• Delete or return data when services conclude

International Data Transfers

We primarily store and process data within the United Kingdom. If data is transferred internationally, we ensure appropriate safeguards are in place, such as standard contractual clauses approved by the UK authorities.

Data Retention

We retain personal data only as long as necessary for the purposes outlined in our Privacy Policy. Specific retention periods include:

• Enrollment records: 7 years after programme completion
• Financial records: 7 years for tax compliance
• Marketing consent records: Until consent is withdrawn
• Website analytics: Anonymized after 26 months

Children's Data

When processing data of minors enrolled in our Junior Money Masters programme, we obtain consent from parents or guardians and apply enhanced protection measures.

Right to Lodge a Complaint

If you are dissatisfied with how we handle your personal data, you have the right to lodge a complaint with the supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
United Kingdom
Tel: 0303 123 1113
Website: www.ico.org.uk

Updates to This Statement

We review this GDPR compliance statement annually and update it as necessary to reflect changes in our practices or legal requirements.