Data Protection Policy

1. Introduction and Purpose

Kampakis and Co Ltd (trading as The Tesseract Academy) is committed to protecting the privacy and security of personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and all applicable data protection legislation. This policy sets out how we collect, process, store, and protect personal data and establishes the framework for compliance across all business activities.

The Tesseract Academy is registered with the Information Commissioner's Office (ICO) under registration number ZB715782. This policy applies to all employees, contractors, consultants, and third-party data processors acting on our behalf.

2. Scope

This policy applies to all personal data processed by the organisation, whether in electronic or paper form. It covers personal data relating to clients, employees, contractors, suppliers, website visitors, and any other individuals whose data we process in the course of our business as an AI consultancy and data science training provider.

3. Data Protection Principles

We adhere to the seven key principles of data protection as set out in Article 5 of the UK GDPR:

• Lawfulness, Fairness, and Transparency: Personal data shall be processed lawfully, fairly, and in a transparent manner in relation to the data subject.
• Purpose Limitation: Personal data shall be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes.
• Data Minimisation: Personal data shall be adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed.
• Accuracy: Personal data shall be accurate and, where necessary, kept up to date. Every reasonable step must be taken to ensure inaccurate data is erased or rectified without delay.
• Storage Limitation: Personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which it is processed.
• Integrity and Confidentiality: Personal data shall be processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage.
• Accountability: The data controller shall be responsible for, and be able to demonstrate compliance with, the above principles.

4. Lawful Basis for Processing

We identify and document the lawful basis for each processing activity before processing begins. The lawful bases we rely upon include:

5. Data Subject Rights

Under the UK GDPR, individuals have the following rights in relation to their personal data. We have procedures in place to ensure these rights can be exercised effectively:

• Right of Access (Art. 15): Individuals may request a copy of the personal data we hold about them. We will respond to Subject Access Requests (SARs) within one calendar month.
• Right to Rectification (Art. 16): Individuals may request correction of inaccurate or incomplete personal data.
• Right to Erasure (Art. 17): Individuals may request deletion of their personal data where there is no compelling reason for its continued processing.
• Right to Restrict Processing (Art. 18): Individuals may request that we restrict the processing of their data in certain circumstances.
• Right to Data Portability (Art. 20): Individuals may request their data in a structured, commonly used, and machine-readable format.
• Right to Object (Art. 21): Individuals may object to processing based on legitimate interests or direct marketing.
• Rights Related to Automated Decision-Making (Art. 22): Individuals have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects.

To exercise any of these rights, individuals should contact us at fabio@thetesseractacademy.com. We will respond to all legitimate requests within one month. In complex cases, we may extend this by a further two months, and will inform the individual accordingly.

6. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Our standard retention periods are:

7. Data Breach Procedures

A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. In the event of a breach:

• The breach must be reported internally to the Data Protection Lead within 4 hours of discovery.
• The Data Protection Lead will assess the severity, scope, and risk to individuals.
• Where a breach is likely to result in a risk to individuals' rights and freedoms, we will notify the ICO within 72 hours of becoming aware of the breach, as required by Article 33 of the UK GDPR.
• Where a breach is likely to result in a high risk to individuals, we will notify affected data subjects without undue delay (Article 34).
• All breaches, whether reportable or not, will be documented in our breach register, including the facts, effects, and remedial actions taken.

8. International Data Transfers

Where we transfer personal data outside the UK, we ensure that appropriate safeguards are in place in accordance with Chapter V of the UK GDPR. These safeguards include UK adequacy regulations, Standard Contractual Clauses (SCCs) approved by the ICO, or binding corporate rules. We conduct Transfer Impact Assessments where required to evaluate the level of data protection in the recipient country.

9. Data Protection Impact Assessments

We conduct Data Protection Impact Assessments (DPIAs) for any processing that is likely to result in a high risk to individuals' rights and freedoms, including but not limited to: large-scale processing of special category data, systematic monitoring of public areas, and automated decision-making with significant effects. Given our work in AI and data science, we pay particular attention to algorithmic fairness and bias when conducting DPIAs for machine learning projects.

10. Training and Awareness

All staff receive data protection training upon induction and annually thereafter. Additional specialist training is provided to staff whose roles involve significant data processing activities. Training records are maintained and reviewed as part of our compliance programme.

11. Contact and Complaints

For any queries regarding this policy or to exercise your data protection rights, please contact:

Data Protection Lead: Fabio Rovai
Email: fabio@thetesseractacademy.com
Address: 5 Brunswick Park Gardens, London, England, N11 1EJ
ICO Registration: ZB715782

If you are dissatisfied with our handling of your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

12. Policy Review

This policy is reviewed annually or following any significant changes to our processing activities, relevant legislation, or organisational structure. The next scheduled review is January 2026.

Kampakis and Co Ltd (trading as The Tesseract Academy) | Company No. 10459791