GDPR Information
Last updated: August 2026
hawk-reach Financial Education is committed to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page explains how we handle personal data in accordance with these regulations.
Data Controller
hawk-reach Financial Education acts as the data controller for personal information collected through our website and services. Our contact details are:
hawk-reach Financial Education
42 Charlotte Square
Edinburgh EH2 4HQ
[email protected]
Personal Data We Process
We process the following categories of personal data:
- Identity Data: Name, title
- Contact Data: Email address, postal address
- Transaction Data: Payment details, course enrolment records
- Technical Data: Browser type, IP address, pages visited (via cookies)
- Usage Data: How you interact with our website and services
Lawful Bases for Processing
We rely on the following lawful bases under Article 6 of the UK GDPR:
Contract Performance (Article 6(1)(b)): Processing necessary to deliver courses you have enrolled in, including registration, scheduling, and payment processing.
Legitimate Interests (Article 6(1)(f)): Processing necessary for our legitimate business interests, such as responding to enquiries, improving our services, and maintaining security. We balance these interests against your rights and freedoms.
Consent (Article 6(1)(a)): Where you have freely given specific, informed consent for particular processing activities, such as receiving marketing communications.
Legal Obligation (Article 6(1)(c)): Processing required to comply with legal requirements, such as financial record-keeping obligations.
Your Rights Under UK GDPR
You have the following rights regarding your personal data:
Right of Access (Article 15): You may request a copy of the personal data we hold about you.
Right to Rectification (Article 16): You may request correction of inaccurate or incomplete data.
Right to Erasure (Article 17): In certain circumstances, you may request deletion of your personal data.
Right to Restrict Processing (Article 18): You may request that we limit how we use your data in certain situations.
Right to Data Portability (Article 20): You may request your data in a structured, machine-readable format.
Right to Object (Article 21): You may object to processing based on legitimate interests or for direct marketing purposes.
Rights Related to Automated Decision-Making (Article 22): We do not use automated decision-making that produces legal or similarly significant effects.
Exercising Your Rights
To exercise any of your data protection rights, please contact us at [email protected]. We will respond to your request within one month. In complex cases, we may extend this period by two months, in which case we will inform you of the extension and reasons.
We may need to verify your identity before processing your request. There is no fee for exercising your rights, although we may charge a reasonable fee for manifestly unfounded or excessive requests.
Data Transfers
We primarily process data within the United Kingdom. Where data is transferred outside the UK, we ensure appropriate safeguards are in place, such as standard contractual clauses approved by the Information Commissioner's Office.
Data Retention
We retain personal data only as long as necessary for the purposes for which it was collected:
- Enquiry data: 2 years from last contact
- Course records: 7 years from completion (for legal and administrative purposes)
- Financial records: As required by law
Data Security
We implement appropriate technical and organisational measures to protect personal data, including encryption, access controls, and regular security assessments.
Complaints
If you are dissatisfied with how we handle your personal data, please contact us first so we can address your concerns. You also have the right to lodge a complaint with the Information Commissioner's Office:
Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
www.ico.org.uk
Updates to This Information
We may update this GDPR information to reflect changes in our practices or legal requirements. The date at the top indicates when this page was last revised.