GDPR Compliance Information

Last updated: May 14, 2026

Our Commitment to GDPR Compliance

Cambridge Youth Finance Academy is committed to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page provides detailed information about how we handle your personal data in accordance with these regulations.

Data Controller Information

Cambridge Youth Finance Academy is the data controller responsible for your personal information:

Data Controller: Cambridge Youth Finance Academy
Address: 17 Mill Lane, Cambridge CB2 1RX, United Kingdom
Email: [email protected]

What Personal Data We Process

We process the following categories of personal data:

Contact Information

• Parent/guardian names
• Email addresses
• Postal addresses

Student Information

• Student names
• Ages and dates of birth
• Educational needs relevant to programme delivery
• Programme enrollment details
• Attendance records
• Progress reports and assessments

Technical Data

• IP addresses
• Browser type and version
• Cookie data (see our Cookies Policy)

Legal Basis for Processing

We process personal data under the following legal bases:

Contract Performance

Processing necessary to fulfill our educational service contracts, including enrollment processing, session scheduling, and programme delivery.

Legitimate Interests

Processing necessary for our legitimate business interests, such as:

• Improving our programmes and services
• Maintaining accurate records
• Communication regarding enrolled programmes
• Website analytics and improvement

Consent

For certain activities, we rely on explicit consent, including:

• Marketing communications
• Use of photographs or testimonials
• Optional data collection

Legal Obligation

Processing required to comply with legal obligations, such as safeguarding requirements and financial record-keeping.

Your Rights Under GDPR

You have the following rights regarding your personal data:

Right of Access

You can request a copy of the personal data we hold about you, free of charge.

Right to Rectification

You can request correction of inaccurate or incomplete personal data.

Right to Erasure (Right to be Forgotten)

You can request deletion of your personal data in certain circumstances, subject to legal retention requirements.

Right to Restriction of Processing

You can request that we limit how we use your personal data in certain situations.

Right to Data Portability

You can request a copy of your personal data in a commonly used, machine-readable format.

Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes.

Rights Related to Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects.

How to Exercise Your Rights

To exercise any of these rights, please contact us at:

Email: [email protected]

We will respond to your request within one month. If your request is complex, we may extend this period by up to two additional months and will inform you of any such extension.

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Enrollment records: 7 years after programme completion
• Financial records: 7 years as required by law
• Marketing consent records: Until consent is withdrawn
• Website analytics: 26 months

Data Security Measures

We implement appropriate technical and organizational security measures, including:

• Encryption of data in transit and at rest
• Access controls and authentication systems
• Regular security audits and assessments
• Staff training on data protection
• Secure backup systems
• Incident response procedures

Data Sharing and Third Parties

We do not sell or rent personal data. We may share data with:

• Service providers: Who assist in programme delivery, under strict data processing agreements
• Legal authorities: When required by law or to protect legal rights
• Professional advisors: Such as legal counsel, under confidentiality obligations

All third-party processors are required to maintain GDPR compliance.

International Data Transfers

We do not routinely transfer personal data outside the United Kingdom. Should any international transfer become necessary, we will ensure appropriate safeguards are in place in accordance with UK GDPR requirements.

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will:

• Notify the Information Commissioner's Office within 72 hours of becoming aware
• Inform affected individuals without undue delay if the breach poses a high risk
• Document all breaches and our response procedures

Children's Data

As we provide services to children and teenagers, we take extra care with children's personal data:

• We obtain parental consent before collecting children's data
• We process only data necessary for programme delivery
• We implement enhanced security measures for children's records
• We ensure age-appropriate privacy notices

Cookies and Tracking

Our use of cookies and similar technologies is detailed in our Cookies Policy. You can control cookie preferences through your browser settings.

Updates to This Information

We may update this GDPR information to reflect changes in our practices or legal requirements. The "Last updated" date at the top of this page indicates when changes were last made.

Questions and Concerns

If you have questions about our GDPR compliance or wish to exercise your rights, please contact us:

Email: [email protected]
Address: 17 Mill Lane, Cambridge CB2 1RX, United Kingdom

Right to Lodge a Complaint

If you believe we have not complied with data protection law, you have the right to lodge a complaint with the supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk