Your data protection rights under UK GDPR
Last Updated: May 2026
nova-crux is committed to protecting personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page provides information about how we comply with data protection legislation and your rights as a data subject.
nova-crux is the data controller responsible for your personal data. Our contact details are:
nova-crux
27 Cathedral Road
Cardiff CF11 9HA
Email: [email protected]
We process personal data under the following legal bases:
When you enrol a child in our programmes, we process personal data as necessary to perform our contract with you. This includes processing enrolment details, managing attendance, and delivering the educational services you have purchased.
We may process data based on our legitimate business interests, such as improving our services, maintaining security, and communicating with you about related offerings. We always balance these interests against your rights and freedoms.
For certain processing activities, such as sending marketing communications or collecting optional information, we rely on your explicit consent. You may withdraw consent at any time.
We may process data to comply with legal requirements, including financial record-keeping, safeguarding obligations, and responding to lawful requests from authorities.
You have the right to request a copy of the personal data we hold about you. We will respond to such requests within one month.
If any personal data we hold is inaccurate or incomplete, you have the right to have it corrected. Please contact us with updated information.
In certain circumstances, you have the right to request deletion of your personal data. This right is not absolute and may be subject to legal retention requirements.
You may request that we limit the processing of your personal data in certain circumstances, such as when you contest its accuracy.
Where processing is based on consent or contract and carried out by automated means, you have the right to receive your data in a structured, commonly used format.
You have the right to object to processing based on legitimate interests or for direct marketing purposes.
We do not make decisions based solely on automated processing that significantly affect you.
Our services are designed for children, but we obtain all consent from parents or guardians. We do not process children's personal data without parental knowledge and consent. Special care is taken to ensure age-appropriate data protection measures.
We primarily store and process data within the United Kingdom. If any data is transferred outside the UK, we ensure appropriate safeguards are in place in compliance with UK GDPR requirements.
We implement appropriate technical and organisational measures to protect personal data, including:
We have procedures in place to detect, report, and investigate personal data breaches. Where a breach is likely to result in a risk to your rights and freedoms, we will notify you and the Information Commissioner's Office as required by law.
To exercise any of your GDPR rights, please contact us at [email protected]. We will respond to your request within one month. There is no fee for most requests, though we may charge a reasonable fee for manifestly unfounded or excessive requests.
If you believe we have not handled your personal data appropriately, you have the right to lodge a complaint with the Information Commissioner's Office:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Website: ico.org.uk
We would appreciate the opportunity to address your concerns before you approach the ICO, so please contact us first.