Last updated: August 2026
buonusment is committed to complying with the General Data Protection Regulation (GDPR) and protecting the privacy rights of individuals whose personal data we process. This page outlines our data protection practices and your rights under GDPR.
buonusment acts as the data controller for personal information collected through our educational services and website. We are responsible for ensuring that personal data is processed lawfully, fairly, and transparently.
We process personal data only when we have a lawful basis to do so:
You have the right to request confirmation of whether we process your personal data and to obtain a copy of that data. We will provide this information within one month of your request.
You may request correction of inaccurate or incomplete personal data we hold about you. We will correct such data without undue delay.
You have the right to request deletion of your personal data in certain circumstances, including when the data is no longer necessary for the purposes for which it was collected, or when you withdraw consent.
You may request that we restrict processing of your personal data in specific situations, such as when you contest the accuracy of the data or object to processing.
Where processing is based on consent or contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used format and to transmit it to another controller.
You have the right to object to processing of your personal data where we rely on legitimate interests as the lawful basis for processing. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.
Where processing is based on consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted prior to withdrawal.
We implement appropriate technical and organizational measures to ensure data security, including:
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. Programme enrollment and participation records are typically retained for seven years for administrative and legal compliance purposes.
We process personal data within the United Kingdom. If we transfer data outside the UK or European Economic Area, we ensure appropriate safeguards are in place to protect your information in accordance with GDPR requirements.
In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR.
We do not use automated decision making or profiling that produces legal effects or similarly significantly affects individuals.
Some of our educational programmes are designed for children. When processing data of individuals under 16 years of age, we obtain consent from the person holding parental responsibility for the child.
To exercise any of your GDPR rights or if you have questions about our data protection practices, please contact us using the details provided on our contact page. We will respond to your request within one month.
You have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection, if you believe our processing of your personal data violates GDPR.