GDPR & Personal Information

Black & White Academy Ltd is the data controller responsible for your personal information.

We are registered in England and Wales. Our principal place of business is in the United Kingdom.

If you have any questions about how we use your personal data, please contact us at info@blackandwhiteacademy.co.uk.

When you enquire about or enrol on a course, we collect your name, email address, telephone number, and postal address.

We may collect information about your learning needs, accessibility requirements, or health conditions where this is necessary to provide appropriate support.

When you make a payment, we collect billing information. We do not store full card details — these are handled securely by our payment processor.

We may collect information you provide when contacting us, completing forms, or communicating with us by any means.

We collect technical data such as your IP address and browser type when you visit our website, in accordance with our Cookie Policy.

To process your enrolment and deliver the course or service you have requested.

To communicate with you about your booking, course updates, and any changes that affect you.

To comply with our legal obligations, including safeguarding duties, financial record-keeping, and regulatory requirements.

To send you information about our courses and services where you have given us permission to do so.

To improve our website and services through anonymised analytics.

We do not sell your personal data to third parties.

We may share your information with trusted service providers who assist us in delivering our services, such as our payment processor, email platform, or booking system. These providers are contractually required to protect your data.

We may share information with awarding bodies such as City & Guilds where required for certification purposes.

We may disclose information to regulatory authorities, law enforcement, or safeguarding bodies where we are legally required or permitted to do so.

We take the security of your personal data seriously and have appropriate technical and organisational measures in place to protect it.

Access to personal data is restricted to staff who need it to carry out their duties.

All data transmitted via our website is encrypted using SSL technology.

We regularly review our data security practices to ensure they remain appropriate.

We retain enrolment and course records for a minimum of seven years in accordance with financial and regulatory requirements.

Safeguarding records are retained in accordance with statutory guidance.

Marketing preferences and contact records are reviewed regularly and removed when no longer needed.

You may request deletion of your personal data at any time, subject to our legal obligations to retain certain records.

Right of access — you have the right to request a copy of the personal data we hold about you.

Right to rectification — you have the right to ask us to correct inaccurate or incomplete data.

Right to erasure — you have the right to ask us to delete your personal data in certain circumstances.

Right to restrict processing — you have the right to ask us to limit how we use your data.

Right to data portability — you have the right to receive your data in a structured, machine-readable format.

Right to object — you have the right to object to us processing your data for direct marketing purposes.

To exercise any of these rights, please contact us at info@blackandwhiteacademy.co.uk. We will respond within one calendar month.

If you are unhappy with how we have handled your personal data, please contact us in the first instance so we can try to resolve the matter.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent data protection authority.

ICO website: ico.org.uk | Helpline: 0303 123 1113