GDPR Rights and Data Protection

Last updated: 19 June 2026

Your Data Protection Rights

Under the General Data Protection Regulation and UK data protection legislation, you have specific rights regarding how your personal data is processed. This page explains those rights and how to exercise them.

Right to Access

You have the right to request confirmation of whether we process your personal data and, if so, to receive a copy of that data along with information about how it is being used. This is commonly known as a subject access request.

When you submit an access request, we will provide:

  • The categories of personal data we hold
  • The purposes for which we process your data
  • The recipients or categories of recipients with whom we share data
  • How long we intend to retain your data
  • Information about your other data protection rights
  • A copy of your personal data in a commonly used electronic format

We will respond to access requests within one month of receipt. In complex cases, we may extend this period by two additional months and will notify you of any delay.

Right to Rectification

You have the right to request correction of inaccurate or incomplete personal data we hold about you. If you identify errors in your information, we will update our records promptly and notify any third parties with whom we shared the incorrect data where appropriate.

Right to Erasure

Also known as the right to be forgotten, this allows you to request deletion of your personal data in certain circumstances, including when:

  • The data is no longer necessary for the purposes for which it was collected
  • You withdraw consent and there is no other legal basis for processing
  • You object to processing and there are no overriding legitimate grounds
  • The data has been unlawfully processed
  • Erasure is required to comply with a legal obligation

This right is not absolute. We may refuse erasure requests when we need to retain data to comply with legal obligations, establish or defend legal claims, or fulfill other legitimate purposes recognized under data protection law.

Right to Restrict Processing

You can request that we limit how we use your personal data in certain situations:

  • When you contest the accuracy of the data, pending verification
  • When processing is unlawful but you prefer restriction over erasure
  • When we no longer need the data but you require it for legal claims
  • When you have objected to processing, pending verification of our legitimate grounds

When processing is restricted, we will continue to store your data but will not process it further without your consent, except for legal claims, protection of another person's rights, or important public interest reasons.

Right to Data Portability

For data you have provided to us under contract or with consent, you have the right to receive that information in a structured, commonly used, machine-readable format. You may also request that we transmit this data directly to another organization where technically feasible.

This right applies only to personal data you provided to us, not to data derived from other sources or generated through our services.

Right to Object

You have the right to object to processing of your personal data where we rely on legitimate interests as the legal basis. Upon receiving an objection, we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is necessary for legal claims.

You have an absolute right to object to processing for direct marketing purposes at any time.

Rights Related to Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you. We do not currently employ automated decision-making processes that would trigger this protection. If our practices change, we will update this notice and ensure appropriate safeguards are in place.

Right to Withdraw Consent

Where we process your data based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted before you withdrew consent. After withdrawal, we will cease processing for purposes that required consent, unless another legal basis applies.

How to Exercise Your Rights

To exercise any of these rights, contact us at info at mesa-hawk.com with your request. Please include:

  • Your full name and contact information
  • A clear description of which right you wish to exercise
  • Any specific information relevant to your request
  • Proof of identity if required for security purposes

We will verify your identity before processing requests that involve access to or deletion of personal data. This protects your information from unauthorized disclosure or manipulation.

Response Timeframes

We aim to respond to all requests within one month of receipt. For complex requests or if we receive multiple requests from you, we may extend this period by two months. If an extension is necessary, we will inform you within one month of receiving your request and explain the reason for the delay.

Fees

We do not charge fees for most requests to exercise your data protection rights. However, if your request is clearly unfounded, repetitive, or excessive, we may charge a reasonable administrative fee or refuse to act on the request. We will explain our reasoning if we take either of these actions.

Right to Lodge a Complaint

If you believe we have not handled your personal data properly or have not responded appropriately to a request to exercise your rights, you have the right to lodge a complaint with the supervisory authority.

In the United Kingdom, the supervisory authority is the Information Commissioner's Office:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF

Telephone: 0303 123 1113
Website: ico.org.uk

We encourage you to contact us first so we have the opportunity to address your concerns directly before you approach the regulatory authority.

Data Protection Officer

For questions specifically about data protection and privacy matters, you may contact our data protection officer at info at mesa-hawk.com.

Updates to This Information

We may update this page periodically to reflect changes in data protection legislation or our practices. Significant changes will be communicated through our website and, where appropriate, by direct communication to enrolled students.