Privacy Policy

This policy explains how MSDM (Manchester School of Digital Marketing) collects, uses, shares and protects personal data when you use our website, enrol in our courses, or otherwise interact with us. It is written to comply with the UK GDPR, the Data Protection Act 2018, and the Data (Use and Access) Act 2025 (DUAA).

1. Who We Are

MSDM (Manchester School of Digital Marketing) is an education consultancy and training provider based in Manchester, United Kingdom. For the purposes of data protection law, MSDM is the data controller for the personal data described in this policy.

Field	Detail
Trading name	MSDM (Manchester School of Digital Marketing)
Registered company name / number	Manchester School of Digital Marketing. Company No. 15840696
Registered address	Gainsborough House, 109 Portland Street, Manchester, M1 6DN
Email	info@msdm.co.uk
Phone	+44 (0) 75 1288 5936
Data protection contact	Md. Anwar Hossain

If MSDM uses a data processor (e.g. a course platform, CRM or payment provider) to process data on its behalf, that processor is identified in section 6.

2. What Data We Collect & Why

We collect only the data necessary for each purpose below.

Purpose	Data Collected	Special Category Data
Education & Welfare	Name, contact details, date of birth, gender, next of kin, photos, exam results, financial/payment information, right-to-work status	Racial or ethnic origin, health data collected only where you choose to share it, for student support purposes
Queries & Claims	Correspondence details, name, contact history	Health information, if you mention it in your query
Marketing & Updates	Name, contact details, address, photos	Racial/ethnic origin or health data  only via explicit opt-in, for diversity monitoring or tailored events

Special category data (health, racial/ethnic origin, and similar) needs its own lawful condition under Article 9 UK GDPR, separate from the lawful basis for the rest of your data see section 3.

3. Our Lawful Bases

We rely on the following lawful bases under UK GDPR Article 6 (and, for special category data, an Article 9 condition):

Purpose	Lawful Basis
Delivering your course, enrolment, student records	Contract (necessary to perform our agreement with you)
Financial/payment records, right-to-work checks, regulatory reporting	Legal obligation
Marketing communications	Consent — withdrawable at any time (see section 4)
Diversity monitoring or tailored events (special category data)	Explicit consent
Health or welfare support during your studies (special category data)	Explicit consent, or where necessary for health/social care purposes with appropriate safeguards
Narrow public-interest situations, e.g. responding to an emergency, safeguarding, or a request from a public authority exercising its official functions	Recognised legitimate interests — a new, separate lawful basis introduced by the DUAA for specific pre-defined categories of processing

On “recognised legitimate interests”: this is a narrower basis than it sounds. It only covers a fixed list of situations set out in the DUAA (for example national security, safeguarding, emergency response, preventing crime, or supporting a public authority’s official functions) and explicitly does not extend to commercial processing such as marketing. We do not rely on it for marketing, which stays on consent.

For routine business purposes outside this fixed list (e.g. improving our services, network security), we would instead rely on ordinary “legitimate interests” under Article 6(1)(f), which requires us to run and document a balancing test weighing our interest against your rights unlike recognised legitimate interests, which does not require that balancing test.

4. Your Data Rights

You have the following statutory rights over your personal data:

• Access — request a copy of your personal data
• Rectification — correct inaccurate or incomplete information
• Erasure — ask us to delete your data (“right to be forgotten”), where it applies
• Restriction — limit how we process your information
• Objection — object to direct marketing at any time, or to processing based on legitimate interests
• Portability — receive your data in a portable format, or have it transferred to another provider, where this applies
• Withdraw consent — stop any processing that relies on your consent, at any time, without affecting processing already carried out

Some rights (e.g. erasure, portability) don’t apply in every situation for example, we may need to keep certain records to meet a legal obligation even after an erasure request. We will tell you if this applies to your request.

We will respond to rights requests within one calendar month of receipt, extendable by a further two months for complex or numerous requests (we will tell you within the first month if this applies and explain why).

5. Data Retention & Sources

Where we get your data: directly from you; from our network of sub-agents and partner representatives; through social media marketing; and from printed promotional material and enquiry forms.

How long we keep it:

Data	Retention period
Student/applicant records	5 years from end of enrolment
Financial/payment records	[flag — see note below] pl clarify whether or not you retain payment records or just pass on to the payment provider and not stored by MSDM
Marketing data	Until you withdraw consent or opt out

6. Sharing & International Transfers

We do not sell your personal data or operate joint-controller arrangements. We share data only with:

• Regulatory bodies and law enforcement, where legally required
• Trusted IT, hosting, and payment service providers, acting as our processors under a written data processing agreement
• The public, via social media or our website, only where you’ve given explicit testimonial/photo consent

International transfers: we do not currently use any processors based outside the UK. If this changes for example, if MSDM adopts an overseas-hosted platform, CRM or communications tool we will update this section to name the provider and confirm which UK GDPR transfer mechanism applies: a UK adequacy regulation covering the destination country, or an appropriate safeguard such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.

7. Cookies & Web Technologies

Our website currently uses only strictly necessary cookies those needed to make the site work (for example, remembering your cookie preferences or keeping your session active). We do not currently use Google Analytics or any other analytics, tracking or advertising cookies or similar technologies.

Because we don’t use any non-essential cookies at present, our website does not currently need to display a cookie consent banner strictly necessary cookies have always been exempt from consent under PECR, independently of the DUAA’s newer, narrower exemptions for low-risk analytics.

If this changes in future for example, if MSDM introduces analytics or marketing cookies we will add a cookie banner and will only set non-essential cookies with your consent, unless a specific tool genuinely qualifies for one of the DUAA’s narrow low-risk exemptions (which, notably, does not cover tools like Google Analytics that share data with a third party).

8. How to Complain

Since 19 June 2026, the DUAA requires organisations to have a formal process for data protection complaints, and gives you the right to complain to us directly before going to the regulator.

1. Contact us: email admissions@msdm.co.uk. We will acknowledge your complaint within 30 days and respond without undue delay.
2. Escalate to the ICO: if you’re unhappy with our response, or wish to go straight to the regulator, you can contact:
   • Information Commissioner’s Office (ICO)
   • Wycliffe House, Water Lane, Wilmslow, SK9 5AF
   • Helpline: 0303 123 1113 | Web: ico.org.uk/make-a-complaint

The ICO generally expects you to give us the chance to resolve your complaint first, which is why we’ve set out the steps above but this doesn’t remove your underlying right to contact the ICO directly at any point.