GDPR Compliance

Last updated: September 30, 2026

Our Commitment to Data Protection

quaintlark is committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) and UK data protection laws. This page explains how we comply with these regulations.

Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Contract Performance: Processing necessary to fulfill our educational services when you enroll in courses
• Legitimate Interests: Processing necessary for our legitimate business interests, such as improving our services
• Legal Obligation: Processing required to comply with legal requirements
• Consent: Processing based on your explicit consent, which you may withdraw at any time

Your GDPR Rights

Under GDPR, you have the following rights regarding your personal data:

Right to Access

You have the right to request copies of your personal data. We may charge a reasonable fee if your request is clearly unfounded or excessive.

Right to Rectification

You have the right to request correction of any information you believe is inaccurate or incomplete.

Right to Erasure

You have the right to request deletion of your personal data under certain conditions, such as when the data is no longer necessary for the purposes it was collected.

Right to Restrict Processing

You have the right to request restriction of processing your personal data under certain conditions.

Right to Object

You have the right to object to our processing of your personal data under certain conditions.

Right to Data Portability

You have the right to request transfer of your data to another organisation or directly to you under certain conditions.

Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including:

• Course enrollment records: retained for 7 years for accounting and legal purposes
• Communication records: retained for 3 years
• Marketing consent records: retained until consent is withdrawn

Data Processing Activities

We process personal data for the following activities:

• Course enrollment and administration
• Communication with students and prospective students
• Payment processing
• Course improvement and quality assurance
• Legal compliance and record-keeping

Third-Party Data Processors

We work with carefully selected third-party service providers who process data on our behalf. All processors are bound by Data Processing Agreements that ensure GDPR compliance.

International Data Transfers

We do not transfer your personal data outside the United Kingdom or European Economic Area. If circumstances change, we will ensure appropriate safeguards are in place.

Data Breach Procedures

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and inform affected individuals without undue delay.

Exercising Your Rights

To exercise any of your GDPR rights, please contact us at:

[email protected]
27 Briggate Street, Leeds LS1 6HD, United Kingdom

We will respond to your request within one month. In complex cases, we may extend this period by two additional months and will inform you of the extension.

Right to Lodge a Complaint

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection.

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Website: ico.org.uk

Contact Our Data Protection Officer

For questions about our GDPR compliance or data protection practices, contact us at [email protected].