This content is advertising in nature

GDPR Information

Last Updated: June 2026

Our Commitment to Data Protection

lush-leap is committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page provides detailed information about how we handle your personal data and your rights as a data subject.

Data Controller

lush-leap acts as the data controller for personal information collected through our website and training programmes. We are responsible for determining how and why your personal data is processed.

Contact Details:
lush-leap
Berkeley Square House
London W1J 6BD
United Kingdom
Email: [email protected]

Your Rights Under UK GDPR

Right to Be Informed

You have the right to be informed about the collection and use of your personal data. We provide this information through our privacy policy, this GDPR information page, and communications with you.

Right of Access

You have the right to request access to your personal data. This is commonly known as a "subject access request." We will provide you with a copy of your personal data undergoing processing, along with information about how it is being used.

How to Request: Send an email to [email protected] with "Subject Access Request" in the subject line. Include sufficient information to identify yourself and specify what information you wish to access.

Response Time: We will respond within one month of receiving your request. In complex cases, this may be extended by up to two additional months, and we will inform you if this extension is necessary.

Right to Rectification

You have the right to have inaccurate personal data corrected or completed if it is incomplete. If you believe any information we hold about you is incorrect or incomplete, contact us and we will correct it promptly.

Right to Erasure

Also known as the "right to be forgotten," you have the right to request deletion of your personal data in certain circumstances, including:

  • The data is no longer necessary for the purpose it was collected
  • You withdraw consent on which processing is based
  • You object to processing and there are no overriding legitimate grounds
  • The data has been unlawfully processed
  • Erasure is required to comply with a legal obligation

Note that this right is not absolute. We may need to retain certain information to comply with legal obligations or for establishing, exercising, or defending legal claims.

Right to Restrict Processing

You have the right to request restriction of processing your personal data in the following situations:

  • You contest the accuracy of the data
  • Processing is unlawful but you prefer restriction over erasure
  • We no longer need the data but you require it for legal claims
  • You have objected to processing pending verification of legitimate grounds

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format. You may also request that we transmit this data directly to another controller where technically feasible.

This right applies when:

  • Processing is based on consent or contract performance
  • Processing is carried out by automated means

Right to Object

You have the right to object to processing based on legitimate interests or for direct marketing purposes. If you object to direct marketing, we will stop processing your data for those purposes immediately.

Rights Related to Automated Decision Making

You have the right not to be subject to decisions based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you. We do not currently engage in automated decision-making of this nature.

How to Exercise Your Rights

To exercise any of the rights described above, contact us at:

Email: [email protected]
Subject Line: Clearly indicate which right you wish to exercise

We will respond to your request within one month. We may request additional information to verify your identity before processing your request.

Data Processing Activities

Categories of Personal Data We Process

  • Identity data (name, professional title)
  • Contact data (email address, postal address)
  • Technical data (IP address, browser type, device information)
  • Usage data (website navigation, pages viewed)
  • Course participation data (enrolment records, progress, completion status)

Lawful Bases for Processing

We process personal data under the following lawful bases:

  • Consent: You have given clear consent for us to process your data for a specific purpose
  • Contract: Processing is necessary for a contract we have with you
  • Legal Obligation: Processing is necessary to comply with the law
  • Legitimate Interests: Processing is necessary for our legitimate interests or the legitimate interests of a third party, provided your interests and rights do not override those interests

Data Retention

We retain personal data for as long as necessary to fulfil the purposes for which it was collected, including:

  • Enquiry data: Retained for two years if no course enrolment follows
  • Course participant data: Retained for seven years after course completion
  • Payment records: Retained for seven years for tax and accounting purposes
  • Website analytics data: Retained for two years

International Data Transfers

We primarily store and process data within the United Kingdom. If we transfer data outside the UK, we ensure appropriate safeguards are in place, such as:

  • Standard contractual clauses approved by the UK authorities
  • Transfer to countries with adequacy decisions
  • Binding corporate rules

Data Security

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

  • Encryption of data in transit and at rest
  • Regular security assessments and audits
  • Access controls and authentication mechanisms
  • Staff training on data protection principles
  • Incident response procedures

Data Breach Notification

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay. We will also report the breach to the Information Commissioner's Office (ICO) within 72 hours if required by law.

Complaints

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
United Kingdom
Telephone: 0303 123 1113
Website: ico.org.uk

Updates to This Information

We may update this GDPR information periodically to reflect changes in our practices or legal requirements. Significant updates will be communicated through prominent website notices or direct communication to registered users.

Questions and Concerns

If you have questions about how we handle your personal data or wish to discuss your data protection rights, please contact us at [email protected]