London Centre for Compliance and Legal Studies (LCCLS)
Effective Date: 30th May 2025

1. Introduction

At the London Centre for Compliance and Legal Studies (LCCLS), we are committed to protecting your personal data and upholding your privacy in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy outlines how we collect, use, share, store, and protect your personal data, as well as your rights under applicable data protection laws.

2. Who We Are

LCCLS is the data controller for the purposes of UK GDPR. We determine the purposes and means of processing your personal information.

Contact Information:
📧 Email: info@lccls.org
📍 Address: [Insert Registered Address]
📞 Phone: [Insert if applicable]
📋 ICO Registration Number: [Insert if registered]

3. What Data We Collect

We may collect the following types of personal data:

• Identity Data: Name, date of birth, nationality
• Contact Data: Email, phone number, billing address
• Academic Data: Course enrolment details, attendance, assessment results, certifications
• Financial Data: Payment transactions (card details are processed securely and not stored)
• Technical Data: IP address, browser type, device type, session activity
• Communication Data: Emails, feedback, survey responses, and customer support requests
• Marketing Preferences: Consent to receive promotional materials

We do not collect special category data (e.g., health data, biometric data) unless required for legal compliance or accessibility requests, and we will always request your explicit consent.

4. How We Collect Your Data

Data is collected directly from you when you:

• Register or enrol in a course
• Complete assessments or download materials
• Contact us via email or support channels
• Subscribe to marketing communications
• Interact with our website or digital content

We may also collect data through cookies and analytics platforms (see Section 10).

5. Legal Basis for Processing

We process your data under one or more of the following legal bases:

• Contractual Necessity – To provide services and fulfil our contractual obligations
• Legal Obligation – To comply with financial, tax, and education regulations
• Legitimate Interests – To operate, evaluate, and improve our services
• Consent – For email marketing and optional services (can be withdrawn at any time)

6. How We Use Your Data

We use your personal data for the following purposes:

• Course registration, delivery, and certification
• Account management and technical support
• Assessment tracking and progress management
• Payment processing and financial records
• Service communications and updates
• Event invitations, surveys, and promotions (if consented)
• Legal compliance and fraud prevention

7. Data Retention

We only retain personal data for as long as necessary:

Data Type	Retention Period
Course & Academic Data	While active + 6 years after completion
Payment Data	6 years for tax and accounting purposes
Communication Data	2 years from last contact
Marketing Preferences	Until withdrawn

You may request deletion earlier unless required by law to retain it.

8. Sharing of Data

We do not sell your personal data. We may share your data with trusted third-party service providers for purposes such as:

• Payment processing (e.g., Stripe, PayPal)
• Learning management systems and course platforms
• Email delivery and CRM systems
• Accreditation or certification partners
• Legal, regulatory, or governmental bodies (where required)

All third-party processors are subject to contractual obligations to maintain confidentiality and comply with data protection regulations.

9. International Transfers

If we transfer your data outside the UK (e.g., for hosting or support services), we ensure appropriate safeguards such as:

• UK adequacy decisions (where applicable)
• Standard Contractual Clauses (SCCs)
• Encryption and security protocols

10. Data Security

We take appropriate measures to protect your data, including:

• SSL encryption across our website
• Encrypted storage and access control
• Secure user authentication
• Regular audits and vulnerability scanning
• Staff training in data protection
• Data minimisation and access logging

In the event of a breach, we follow procedures outlined in Section 11.

11. Data Breach Response

If a personal data breach occurs:

• It will be promptly assessed by our Data Protection Officer (DPO)
• If there is a high risk to your rights or freedoms, you will be notified without undue delay
• We will notify the Information Commissioner’s Office (ICO) within 72 hours, where legally required
• Remedial actions will be taken, and the breach will be logged and reviewed

12. Your Rights Under UK GDPR

You have the right to:

• Access your personal data
• Correct inaccurate or outdated data
• Request erasure of your data (where applicable)
• Restrict processing in certain circumstances
• Object to processing based on legitimate interests
• Port your data to another provider
• Withdraw consent for marketing or optional features
• Complain to the ICO if you believe your rights are violated

📍 ICO Website: https://ico.org.uk
📞 ICO Helpline: 0303 123 1113