Last Updated: September 2026
Data Controller Information
For the purposes of data protection legislation, iris-eagle.com acts as the data controller for personal information collected through this website and associated services.
Legal Basis for Processing
We process personal data under the following legal bases:
- Legitimate Interest: Processing necessary for our business operations, including responding to inquiries and providing information about our training programs.
- Contractual Necessity: Processing required to fulfill enrollment agreements and deliver educational services.
- Consent: Where you have explicitly agreed to specific processing activities, such as receiving marketing communications.
Your Rights Under GDPR
Right of Access
You have the right to request confirmation of whether we process your personal data and to obtain a copy of that data.
Right to Rectification
You may request correction of inaccurate or incomplete personal information we hold about you.
Right to Erasure
Under certain circumstances, you can request deletion of your personal data. This right is not absolute and may be limited by legal obligations to retain certain information.
Right to Restriction of Processing
You may request that we limit how we use your personal data in specific situations, such as while disputing the accuracy of information.
Right to Data Portability
Where processing is based on consent or contract and carried out by automated means, you can request to receive your personal data in a structured, commonly used format.
Right to Object
You have the right to object to processing of your personal data based on legitimate interests. We will cease such processing unless we demonstrate compelling legitimate grounds that override your interests.
Data Retention
We retain personal information only as long as necessary for the purposes for which it was collected, or as required by legal obligations.
Inquiry data is typically retained for two years. Enrollment and educational records are kept for seven years to comply with educational recordkeeping requirements.
International Data Transfers
Personal data is processed and stored within the United Kingdom. If data transfers outside the UK become necessary, appropriate safeguards will be implemented to ensure adequate protection.
Automated Decision-Making
We do not engage in automated decision-making or profiling that produces legal effects or similarly significantly affects individuals.
Data Security Measures
We implement appropriate technical and organizational measures to protect personal data against unauthorized access, accidental loss, destruction, or damage.
Access to personal information is restricted to personnel who require it for legitimate business purposes.
Data Breach Notification
In the event of a data breach that poses risk to your rights and freedoms, we will notify you without undue delay, in accordance with GDPR requirements.
Exercising Your Rights
To exercise any of your data protection rights, submit a request through our Contact page or by email to [email protected].
We will respond to valid requests within one month. In complex cases, this period may be extended by two additional months, and we will inform you of any such extension.
Right to Lodge a Complaint
If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection matters.
Changes to This Notice
We may update this GDPR compliance notice to reflect changes in our practices or legal requirements. Material changes will be communicated through prominent notice on our website.