Our commitment to protecting your data rights
The General Data Protection Regulation (GDPR) is a comprehensive data protection law that came into effect on 25 May 2018. At starry-route, we are committed to full compliance with GDPR and to protecting the privacy and rights of all individuals whose data we process.
starry-route acts as the data controller for personal information collected through our website and in connection with our educational programmes. This means we determine the purposes and means of processing personal data and are responsible for ensuring compliance with data protection laws.
Data Controller: starry-route
Address: 47 Vicar Lane, Leeds, LS1 6AW, United Kingdom
Email: [email protected]
Under GDPR, we must have a lawful basis for processing personal data. We rely on the following bases:
When you book a programme with us, we process your personal data as necessary to fulfil our contractual obligations. This includes processing booking details, scheduling sessions, and managing payments.
For certain processing activities, we rely on your explicit consent. This includes sending marketing communications and newsletters. You may withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
We may process data based on our legitimate interests where those interests are not overridden by your rights. This includes improving our services, analysing website usage, and preventing fraud.
We may process data where necessary to comply with legal obligations, such as maintaining financial records for tax purposes.
GDPR provides you with specific rights regarding your personal data:
You have the right to request a copy of the personal data we hold about you. We will provide this information within one month of receiving your request.
If any personal data we hold about you is inaccurate or incomplete, you have the right to request its correction or completion.
Also known as the "right to be forgotten," you can request deletion of your personal data in certain circumstances, such as when the data is no longer necessary for the purposes it was collected.
You can request that we limit the way we use your data in certain circumstances, such as when you contest its accuracy.
You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit it to another controller.
You can object to processing based on legitimate interests or for direct marketing purposes. We will stop processing unless we demonstrate compelling legitimate grounds.
You have the right not to be subject to decisions based solely on automated processing that produce legal or significant effects. We do not currently use automated decision-making systems.
We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:
We primarily process data within the United Kingdom. Where data is transferred outside the UK, we ensure appropriate safeguards are in place, such as standard contractual clauses approved by the ICO.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk, we will also notify affected individuals without undue delay.
We conduct Data Protection Impact Assessments (DPIAs) for processing operations that are likely to result in high risk to individuals, ensuring we identify and minimise data protection risks.
Given that our services are designed for families with children, we take particular care with data relating to minors. We process children's data only with parental consent and for purposes directly related to providing our educational services.
To exercise any of your GDPR rights, please contact us:
Email: [email protected]
Post: Data Protection, starry-route, 47 Vicar Lane, Leeds, LS1 6AW
We will respond to all legitimate requests within one month. If your request is complex or numerous, we may extend this by a further two months, and will inform you accordingly.
If you are not satisfied with how we handle your personal data or respond to your requests, you have the right to lodge a complaint with the Information Commissioner's Office:
Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire, SK9 5AF
Tel: 0303 123 1113
Website: ico.org.uk
We may update this GDPR compliance notice from time to time. Any changes will be posted on this page with an updated revision date.
Last updated: 25 May 2026