GDPR Compliance

Last updated: May 25, 2026

1. Our Commitment to Data Protection

Flickering Quest Financial Education is committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page explains how we meet our obligations and your rights under this legislation.

2. Data Controller

For the purposes of data protection legislation, the data controller is:

Flickering Quest Financial Education
42 Castle Street
Liverpool, L2 7LQ
United Kingdom
Email: [email protected]

3. Lawful Basis for Processing

We process personal data under the following lawful bases:

  • Consent: When you have given clear consent for us to process your personal data for specific purposes
  • Contract: When processing is necessary for a contract we have with you, or to take steps before entering into a contract
  • Legal Obligation: When we must process your data to comply with the law
  • Legitimate Interests: When processing is necessary for our legitimate interests or those of a third party, provided your rights don't override these interests

4. Your Rights Under GDPR

You have the following rights regarding your personal data:

Right to Be Informed

You have the right to clear, transparent information about how we use your personal data. This is provided through our Privacy Policy and this GDPR page.

Right of Access

You can request a copy of your personal data that we hold. This is known as a Subject Access Request (SAR). We will respond within one month.

Right to Rectification

You can ask us to correct inaccurate or incomplete personal data.

Right to Erasure

Also known as the "right to be forgotten," you can request deletion of your personal data in certain circumstances.

Right to Restrict Processing

You can ask us to restrict processing of your personal data in certain circumstances.

Right to Data Portability

You can request your personal data in a structured, commonly used, and machine-readable format to transfer to another service.

Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes.

Rights Related to Automated Decision Making

You have rights regarding automated decision-making and profiling. We do not currently use automated decision-making processes.

5. How to Exercise Your Rights

To exercise any of your rights, please contact us:

We will respond to your request within one month. If your request is complex or we receive multiple requests, this may be extended by two months, and we will inform you.

6. Data We Collect

We collect and process the following categories of personal data:

  • Contact information (names, email addresses, postal addresses)
  • Child's age and educational level
  • Programme preferences and booking information
  • Communication history with us
  • Payment information (processed securely through third-party providers)
  • Website usage data (IP address, browser type, pages visited)

7. How We Protect Your Data

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

  • Encryption of data in transit and at rest
  • Regular security assessments
  • Access controls and authentication measures
  • Staff training on data protection
  • Secure storage and backup systems

8. Data Retention

We retain personal data only for as long as necessary:

  • Enquiry data: Up to 2 years after last contact
  • Client data: Up to 7 years after completion of services (for safeguarding and legal reasons)
  • Financial records: 7 years (legal requirement)
  • Marketing consents: Until withdrawn or 3 years of inactivity

9. Data Sharing

We may share your data with:

  • Service providers who assist in delivering our services (subject to data processing agreements)
  • Payment processors (who are PCI DSS compliant)
  • Legal and regulatory authorities when required by law

We do not sell or rent your personal data to third parties for marketing purposes.

10. International Transfers

We primarily store and process data within the United Kingdom. If we transfer data outside the UK, we ensure appropriate safeguards are in place in accordance with data protection legislation.

11. Children's Data

When we process data about children participating in our programmes, we do so with parental consent and in accordance with safeguarding requirements. We take extra care to protect children's data and limit processing to what is necessary for educational purposes.

12. Data Breach Notification

In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will notify you and the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach.

13. Complaints

If you have concerns about how we handle your personal data, please contact us first. If you remain dissatisfied, you have the right to lodge a complaint with the supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Tel: 0303 123 1113
Website: flickering-quest.com

14. Updates to This Page

We may update this GDPR compliance page to reflect changes in our practices or legal requirements. We will notify you of significant changes through our website or by email.