Legal
GDPR Compliance
RESTEC Academy is committed to protecting your personal data and to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This statement summarises how we meet those obligations. For full detail of what we collect, why, and how long we keep it, see our Privacy Policy.
1. Data controller
RESTEC LIMITED (company number 09216601), trading as RESTEC Academy, is the data controller for personal data collected through this website and through course bookings.
Furness House, Castle Park Industrial Estate, Flint, Flintshire, CH6 5XA Β· Training@restecroofing.co.uk Β· 01352 748 600
We have not appointed a Data Protection Officer, as our processing does not meet the threshold in Article 37. Our Training team is the single point of contact for all data protection enquiries.
2. Our principles
In line with Article 5 of the UK GDPR, we:
- Process lawfully, fairly and transparently: every activity has a documented lawful basis, explained in our Privacy Policy.
- Limit our purposes: booking data is used to deliver your training, not for unrelated purposes.
- Minimise data: we ask only for what we need to run a course. We never receive or store your card details. Stripe handles them directly.
- Keep data accurate: you can review your bookings and attendee details in My Account, and ask us to correct anything.
- Limit storage: each category of data has a defined retention period, after which it is removed.
- Keep data secure: see Section 4.
- Remain accountable: we keep a Record of Processing Activities (Article 30) and review it at least annually.
3. Processors
We only use service providers that give sufficient guarantees under Article 28. Each is bound by a data processing agreement and acts only on our instructions. Where data is transferred outside the UK, it is protected by the UK International Data Transfer Agreement or the EU Standard Contractual Clauses. The current list of processors is in our Privacy Policy. We do not sell your data.
4. Security
- All traffic to this site is encrypted in transit (HTTPS/TLS), and our database is encrypted at rest.
- Card payments are processed by Stripe, a PCI DSS Level 1 certified provider. Card numbers never touch our systems.
- Customer sign-in uses email links that expire after 30 minutes, so there is no password to steal.
- Staff access is role-based and limited to what each role needs. Administrative actions are recorded in an audit log.
- Non-essential cookies are only loaded with your consent. See our Cookie Policy.
5. Your rights
Under the UK GDPR you have the right to:
- access the personal data we hold about you
- have inaccurate data corrected
- have your data erased, subject to our legal retention obligations
- restrict or object to certain processing
- receive your data in a portable format
- withdraw consent at any time, for marketing emails or non-essential cookies
You can unsubscribe from marketing at any time on our Unsubscribe page, and change your cookie choices with the Cookie settings link in the footer.
6. Making a request
To make a subject access request or exercise any other right, email Training@restecroofing.co.uk with your name, the email address you booked with, and what you are asking for. We may need to confirm your identity before we act on it.
We respond within one calendar month. For complex requests we can extend this by a further two months, and if we need to, we will tell you so within the first month. Requests are free of charge unless they are manifestly unfounded or excessive.
7. Data breaches
We have a documented incident response process. If a personal data breach occurs, we will notify the Information Commissioner's Office within 72 hours where required, and tell affected individuals without undue delay where the breach poses a high risk to their rights and freedoms.
8. Complaints
If you are unhappy with how we have handled your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.