Sandstone Training Limited

Data Protection Policy

Context

Data protection legislation in the UK – including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR) and the Data (Use and Access) Act 2025 (collectively the Legislation) – seeks to protect identifiable living individuals (the Individual(s)) by establishing standards for the processing of their personal data.

The Legislation:

(a) requires personal data to be processed lawfully, fairly and transparently, based on one of the lawful grounds set out in the Legislation (which may include consent, contract, legal obligation, legitimate interests and recognised legitimate interests, among others);

(b) confers rights on an Individual to obtain information about the processing of his or her personal data, and to require that inaccurate personal data be rectified or completed and, in some circumstances, erased or restricted;

(c) establishes rights and responsibilities for the Information Commissioner (the Commissioner), and assigns to the holder of that office responsibility for monitoring and enforcing the Legislation.

Purpose

The purpose of this policy is to implement the requirements of the Legislation as far as it applies to Sandstone Training Limited (the Company) in its capacity as a controller of personal data.

Definition of Data Processing

Data processing for the purposes of this policy shall comprise any one of the following actions by the Company relating to an Individual’s personal data:

(a) its collection, recording, organisation, structuring or storage
(b) its adaptation or alteration
(c) its retrieval, consultation or use
(d) its disclosure by transmission, dissemination or otherwise making it available
(e) its alignment or combination
(f) its restriction, erasure or destruction.

The definition applies to data however held, including paper files and computer storage systems or programs.

 Statement of Policy

Whenever the Company collects and records personal data (the Data) relating to any Individual it shall:

* Make a clear statement at the time of collection of the purpose for which the Data is to be collected, and proceed on the basis of a lawful ground under the Legislation, which may include:

- the express consent of the Individual;

- that such processing is necessary for the performance of a contract or pre‑contractual negotiations with the Individual;

- that such processing is necessary for compliance with a legal obligation to which the Company is subject;

- that such processing is necessary for the purposes of the Company’s legitimate interests, balanced against the rights and interests of the Individual; or

- where applicable, that such processing is necessary for a recognised legitimate interest expressly permitted under the Legislation (for example crime prevention or detection, responding to emergencies or safeguarding vulnerable individuals).

* Only use the Data for the purpose for which it has been collected, or for compatible further purposes that are permitted under the Legislation (for example certain research, archiving or statistical purposes), unless the Individual agrees to a new, different purpose.

* Collect and maintain only the minimum Data required for the purposes for which it has been collected (data minimisation).

* Make every reasonable attempt to ensure that Data is accurate and, where necessary, kept up to date.

* Not maintain Data beyond the period which the purpose for which it is collected requires, or beyond the period for which the Company is required to maintain books and records of account or other legally required records, whichever is longer.

* Apply reasonable and appropriate technical and organisational security measures to ensure the safeguarding of the Data against unauthorised or unlawful processing and against accidental loss, destruction or damage.

The Company shall not, as a matter of policy, intentionally collect:

* special category data as defined in the Legislation, such as data relating to race, religious beliefs or ethnicity; or

*data relating to criminal convictions or offences;

unless such collection is clearly necessary, lawful and proportionate for a specific purpose and appropriate safeguards are in place.

If, despite this policy, such data is incidentally collected, the Company will either delete it promptly or apply the higher level of protection required by the Legislation.

The Company does not carry out solely automated decision‑making that produces legal or similarly significant effects on Individuals based on their personal data. Where any automated tools are used to assist decision‑making, the Company will ensure appropriate human oversight, provide Individuals with meaningful information about such processing where required, and enable Individuals to raise queries or concerns.

Where the Company operates websites or online services, it may use cookies and similar technologies for strictly necessary, functional and analytical purposes. Strictly necessary cookies that are essential for the operation of the service do not require consent; statistical and appearance cookies will be deployed in accordance with PECR and DUAA requirements, including the provision of an informed, free and simple opt‑out mechanism where consent is not required. More detailed information is provided in the Company’s Cookie Notice.

Right of Access

The Company acknowledges an Individual’s right to access his or her personal data held by the Company. Requests may be made either by mail to the Company’s registered office or by email to: pd@sandstone.training.

In line with the Legislation, the Company will make reasonable and proportionate searches when responding to subject access requests and will respond within the time‑frame set out in the Legislation. The one‑month period generally runs from the latest of: receipt of the request; receipt of any additional information reasonably requested to confirm the requester’s identity or to identify the data requested; and receipt of a fee where the request is manifestly unfounded or excessive.

No fee shall be charged for the response to a data access request, unless it is manifestly unfounded or excessive, or if it is a repeat request for the same data already supplied; as an alternative to charging a fee in such circumstances, the Company may elect not to comply with the request, in line with the Legislation.

The Company reserves the right to require someone requesting access to their Data to prove their identity before the Data is supplied and may, where appropriate, seek clarification of the request to enable a reasonable and proportionate search.

Rights of Rectification

The Company acknowledges an Individual’s right to have incomplete or incorrect Data completed or rectified. Requests may be made either by mail to the Company’s registered office or by email to: pd@sandstone.training.

The Company undertakes to respond to all reasonable requests within the time‑frame set out in the Legislation (generally within one month of the relevant start date, subject to any permitted extension for complex requests).

No fee shall be charged for the response to a rectification request, unless it is manifestly unfounded or excessive, or if it is a repeat request for the same data already supplied; as an alternative to charging a fee in such circumstances, the Company may elect not to comply with the request, in line with the Legislation.

The Company reserves the right to require someone requesting rectification of their Data to prove their identity before the Data is supplied or amended, and to provide evidence of the accuracy of the data which they wish the Company to record.

Right of Erasure

The Company acknowledges an Individual’s right to request that Data relating to them be erased in circumstances set out in the Legislation. Requests may be made either by mail to the Company’s registered office or by email to: pd@sandstone.training

The Company undertakes to respond to all reasonable requests within the time‑frame set out in the Legislation (generally within one month of the relevant start date, subject to any permitted extension for complex requests).

No fee shall be charged for the response to an erasure request, unless the request is manifestly unfounded or excessive, in which case the Company may charge a reasonable fee or decline to act.

The Company shall in all cases require that someone requesting that Data relating to them be erased must prove their identity before the Data is erased and also provide a valid reason for the request, except where the Legislation provides an absolute or unconditional right.

The Company recognises the following valid reasons for requesting the erasure of Data, in line with the Legislation:

- the personal data is no longer necessary for the purpose for which it was collected;

- the Company relied on the consent of the Individual for the recording of Data, and the Individual has withdrawn such consent and there is no other lawful basis for processing;

- the Company relied on a legitimate interest to record the Data, but an Individual has objected to the processing of their Data and internal review establishes that such legitimate interest is inapplicable or overridden in the case of the Individual;

- the Company is holding the Data for direct marketing purposes and the Individual has objected;

- it can be proven that the Company has recorded the personal data unlawfully;

- there is a legal obligation other than the Legislation which requires the Data to be deleted.

In accordance with the Legislation the Company shall not erase Data when requested if any of the following applies:

- the request is manifestly unfounded or excessive;

- the Data must remain recorded in order that the right of freedom of expression and information may be exercised;

- there is a legal obligation on the Company to maintain the Data;

- erasure is not appropriate for the performance of a task carried out in the public interest or in the exercise of official authority;

- the Data is required for archiving purposes in the public interest, scientific or historical research or statistical purposes, where erasure is likely to render impossible or seriously impair the achievement of that processing;

- the Data is required for the establishment, exercise or defence of legal claims upon the Company.

When Data is erased in response to a request, it shall be deleted from live systems only. Any request to delete such Data from backup files not in current use is generally considered to be excessive and will not be complied with unless the Requestor can supply a valid reason why retention in backups constitutes an unwarranted risk to him or her under the Legislation.

Right to Restrict the Use of Data

The Company acknowledges an Individual’s right to request that Data relating to them not be used by the Company, without the requirement that it be deleted, in circumstances set out in the Legislation. Requests may be made either by mail to the Company’s registered office or by email to: pd@sandstone.training

The Company undertakes to respond to all reasonable requests within the time‑frame set out in the Legislation (generally within one month of the relevant start date, subject to any permitted extension for complex requests).

No fee shall be charged for the response to such a request, unless the request is manifestly unfounded or excessive, in which case the Company may charge a reasonable fee or decline to act.

The Company shall in all cases require that someone requesting that Data relating to them not be used must prove their identity before the restriction is applied, and also provide a valid reason for the request, in line with the Legislation.

The Company undertakes only to store and not to process such restricted Data, except where:

- the Individual’s consent to reinstate processing of the Data has been received;

- such Data must be processed for the establishment, exercise or defence of legal claims;

- such Data must be processed for the protection of the rights of another person (natural or legal);

- such Data must be processed for reasons of important public interest.

The Company acknowledges an Individual’s absolute right to request that his/her Data not be used for direct marketing purposes, and will implement such a request promptly after receipt.

Other Rights

The Company acknowledges the following rights in the Legislation and draws Individuals’ attention thereto:

* the right of an Individual to request that Data relating to him/her and held by the Company be transmitted directly to a third party (data portability), subject to restrictions, possible fees for manifestly unfounded or excessive requests, and exceptions;

* the right of an Individual to object to the use of Data relating to them in automated Individual decision‑making and profiling that produces legal or similarly significant effects, subject to restrictions and exceptions;

* the right of an Individual to lodge a complaint directly with the Company if they consider that the processing of their personal data infringes the Legislation, and to lodge a complaint with the Information Commissioner’s Office.

Data Protection Complaints

In accordance with the Legislation, the Company provides mechanisms for Individuals to raise complaints about how their personal data has been handled. Complaints may be submitted:

* by email to pd@sandstone.training;

* by post to the Company’s registered office; or

* via any electronic complaint form or process that the Company may make available from time to time.

The Company will acknowledge complaints within 30 days of receipt and will take appropriate steps to investigate and resolve complaints without undue delay, informing the Individual of the progress and outcome. Individuals also retain the right to raise concerns with the Information Commissioner’s Office.

Where Data Will Be Held

Data may be held in or transferred to the UK, Switzerland, any other EU or EEA country and any other country or territory in respect of which an adequacy decision or similar finding has been made under UK data protection law. Where Data is transferred to a country that does not benefit from such a finding, the Company will ensure that appropriate safeguards are in place and that the level of protection is not materially lower than that provided in the UK, in line with the DUAA’s revised data protection test for international transfers.

Children and Online Services

If the Company provides online services that are likely to be accessed by children, it will take children’s needs into account when deciding how to use their personal information and will seek to align with the ICO’s Age Appropriate Design Code. This may include measures such as high‑privacy default settings, age‑appropriate explanations and limitations on profiling or targeted marketing directed at children.

The ICO

The Company is registered with the UK’s Information Commissioner’s Office (ICO). This registration obliges the Company to pay a fee, but does not in itself confer additional rights or protections either on the Company or on Individuals beyond those set out in the Legislation.

V3-0626