GDPR Compliance

Last Updated: June 8, 2026

1. Our Commitment to GDPR

We are committed to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page outlines how we meet our obligations and protect your rights as a data subject.

2. Data Controller Information

For the purposes of UK GDPR, the data controller is:

lush-meadow.com
Meadow House
Lower Slaughter
Cheltenham, Gloucestershire
GL54 2HY
United Kingdom

Email: [email protected]

3. Lawful Basis for Processing

We process personal data under the following lawful bases:

• Consent: When you submit enquiry forms or accept cookies
• Contract: To fulfill our service obligations when you book a programme
• Legitimate Interests: To operate our business, improve services, and prevent fraud
• Legal Obligation: To comply with UK tax, accounting, and legal requirements

4. Your Rights Under UK GDPR

4.1 Right to Be Informed

You have the right to clear information about how we collect and use your personal data. This is provided through our Privacy Policy and this GDPR page.

4.2 Right of Access

You can request a copy of the personal data we hold about you. We will provide this within one month of your request, free of charge.

4.3 Right to Rectification

If your personal data is inaccurate or incomplete, you have the right to have it corrected.

4.4 Right to Erasure

Also known as the "right to be forgotten," you can request deletion of your personal data in certain circumstances, such as when data is no longer necessary or you withdraw consent.

4.5 Right to Restrict Processing

You can request that we limit how we use your data in specific situations, such as when you contest the accuracy of the data.

4.6 Right to Data Portability

You have the right to receive your personal data in a structured, commonly used format and transmit it to another controller.

4.7 Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes.

4.8 Rights Related to Automated Decision Making

We do not use automated decision making or profiling that produces legal or similarly significant effects.

5. How to Exercise Your Rights

To exercise any of these rights, contact us at:

Email: [email protected]
Subject Line: GDPR Rights Request

We will respond within one month. In complex cases, we may extend this by two months and will inform you of the extension.

6. Data Protection Principles

We ensure that personal data is:

• Processed lawfully, fairly, and transparently
• Collected for specified, explicit, and legitimate purposes
• Adequate, relevant, and limited to what is necessary
• Accurate and kept up to date
• Kept no longer than necessary
• Processed securely with appropriate safeguards

7. International Transfers

Your personal data is primarily stored and processed within the United Kingdom. If we transfer data outside the UK, we ensure:

• An adequacy decision exists for the destination country, or
• Appropriate safeguards are in place (such as Standard Contractual Clauses)

8. Data Security Measures

We implement technical and organizational security measures including:

• Encryption of data in transit and at rest
• Access controls and authentication
• Regular security assessments
• Staff training on data protection
• Incident response procedures

9. Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will:

• Notify the Information Commissioner's Office (ICO) within 72 hours
• Inform affected individuals without undue delay if there is a high risk
• Document the breach and our response

10. Children's Data

Our services are not intended for individuals under 18. We do not knowingly process data of children. If we become aware of such processing, we will delete the data.

11. Complaints

If you believe we have not handled your data correctly, you have the right to lodge a complaint with the supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
United Kingdom

Website: ico.org.uk
Helpline: 0303 123 1113

12. Updates to This Information

We may update this GDPR compliance information to reflect changes in our practices or legal requirements. Check this page periodically for updates.

13. Contact Us

For questions about our GDPR compliance or data protection practices:

Email: [email protected]
Address: Meadow House, Lower Slaughter, Cheltenham, Gloucestershire, GL54 2HY, United Kingdom