Privacy policy

Last updated: 3 September 2026

1. Introduction

Engage Implant Education Limited (“Engage”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how we collect, use, store and share personal information when you:

• visit or use our website;
• contact or enquire with us;
• register your interest in an Engage course;
• book or attend an Engage course, workshop or educational event;
• receive continuing professional development (“CPD”) certification;
• communicate with us before or after a course;
• access post-course support;
• participate in photographs, filming, testimonials or other educational content;
• subscribe to marketing communications;
• interact with us on social media; or
• otherwise deal with Engage in a professional or commercial capacity.

It also explains your rights under UK data protection law.

We process personal information in accordance with applicable legislation, including the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (“PECR”), in each case as amended from time to time.

2. Who we are

The data controller responsible for the personal information described in this Privacy Policy is:

Engage Implant Education Limited
Company number: 17232238

Registered office:

167–169 Great Portland Street
5th Floor
London
England
W1W 5PF

Please note: our registered office is a virtual registered office and is not a correspondence address. It does not accept mail on our behalf.

For all privacy enquiries, requests to exercise your data protection rights or concerns about how we handle personal information, please contact:

Email: contact@engageimplant.co.uk

You can also contact us through the Contact page on our website.

We have not appointed a formal Data Protection Officer unless and until we are legally required to do so. Responsibility for data protection remains with Engage Implant Education Limited.

3. Scope of this Privacy Policy

This Privacy Policy applies principally to personal information for which Engage determines the purposes and means of processing and therefore acts as the data controller.

In some limited circumstances, particularly where a dentist or dental practice provides patient information to us solely so that we can provide educational or restorative support on their instructions, Engage may instead act as a data processor.

Where another organisation is the controller, that organisation is primarily responsible for explaining to the individual how their information is processed.

This Policy does not replace the privacy policies of third-party websites, booking providers, payment processors, social-media platforms or other independent organisations that you may use in connection with Engage.

4. The personal information we may collect

The information we collect depends on how you interact with Engage.

4.1 Identity information

We may collect:

• first name;
• surname;
• title;
• preferred name;
• professional title;
• signature where required;
• photograph or image where relevant.

4.2 Contact information

We may collect:

• email address;
• telephone number;
• postal address where required for billing or another legitimate purpose;
• business or practice address;
• employer or practice details;
• social-media contact information where you communicate with us through those channels.

4.3 Professional information

Because Engage provides professional dental education, we may collect information including:

• profession;
• job role;
• employer or dental practice;
• GDC registration number;
• other professional registration information;
• professional qualifications;
• level of implant or restorative experience;
• stated educational objectives;
• areas of clinical interest;
• previous Engage courses attended;
• professional development information relevant to a course;
• information required to determine whether a course is appropriate for you.

We may verify professional information using publicly accessible professional registers where reasonably necessary.

5. Booking and transaction information

When you book or enquire about a course, we may collect:

• the course selected;
• course date;
• booking date;
• booking reference;
• amount paid;
• applicable discounts or promotional codes;
• invoicing information;
• billing address;
• VAT information where relevant;
• employer or practice purchasing information;
• payment status;
• cancellation or transfer information;
• correspondence regarding the booking.

Payments may be processed by a specialist third-party payment provider.

Engage does not normally need to receive or store your complete payment-card number or card security code. These may instead be handled directly by the relevant payment processor.

6. Course attendance and CPD information

We may process information relating to your attendance and professional development, including:

• registration at the event;
• arrival and departure information where relevant;
• attendance duration;
• participation in course activities;
• course completed;
• date of completion;
• CPD hours completed;
• course learning aims and outcomes;
• GDC development outcomes;
• CPD certificate number or reference;
• date of certificate issue;
• replacement certificate requests;
• course evaluations and feedback;
• evidence required to verify completion.

This information allows Engage to administer courses and provide accurate evidence of verifiable CPD.

7. Dietary, accessibility and health-related information

You may choose to provide information concerning:

• food allergies;
• dietary requirements;
• disabilities;
• mobility requirements;
• medical conditions relevant to attendance;
• communication requirements;
• accessibility requirements; or
• other adjustments that may reasonably be required to allow you to participate safely and effectively.

Some of this information may constitute special-category personal data under UK data protection law.

We will only collect information that is reasonably necessary for the relevant purpose.

Where appropriate, we will rely on your explicit consent to process such information.

In some circumstances another lawful condition may apply where processing is necessary to comply with a legal obligation or to protect an individual's vital interests.

You are not generally required to provide us with detailed medical information. Where possible, please tell us the practical adjustment or requirement you need rather than providing an unnecessary medical history.

For example, it is usually sufficient to tell us:

“I require step-free access”

rather than providing detailed clinical information about the reason.

8. Information submitted through our website

When you use our website or submit an online form, we may receive:

• your name;
• email address;
• telephone number;
• practice or organisation;
• enquiry details;
• course interests;
• booking information;
• information entered into free-text fields;
• date and time of submission;
• technical information associated with the submission;
• marketing-source information where used.

Our website may use third-party services to provide forms, booking functionality, customer-management services or related website functions.

Where a third-party provider processes personal information collected by Engage on our behalf, it will act as a service provider or data processor subject to appropriate contractual and data-protection obligations.

9. Technical and website-use information

When you access our website, certain information may be collected automatically, including:

• IP address;
• browser type;
• device type;
• operating system;
• approximate geographic location derived from technical information;
• referring website;
• pages viewed;
• time and date of access;
• time spent on pages;
• website interactions;
• links followed;
• cookie identifiers;
• campaign attribution information.

Some information is required for the website to function securely.

Other technologies, particularly analytics and advertising cookies, will only be used where legally permitted and, where required, after obtaining your consent.

Further information is provided in our separate Cookie Policy.

10. Correspondence and communications

If you communicate with Engage, we may retain relevant records of those communications, including:

• emails;
• website enquiries;
• telephone call notes;
• SMS messages;
• WhatsApp or similar messages where these channels are used;
• social-media messages;
• course questions;
• complaints;
• feedback;
• post-course support communications.

We retain only information reasonably necessary for the relevant purpose.

Our principal contact email is:

contact@engageimplant.co.uk

11. Post-course restorative and referral support

Certain Engage courses may include access to continued restorative, case-selection or referral support.

Where you contact us for support, we may process information concerning:

• your identity;
• the relevant course you attended;
• the nature of your clinical question;
• implant system or restorative components involved;
• radiographs, photographs or clinical information where appropriately submitted;
• correspondence between you and Engage;
• recommendations or educational guidance provided.

Patient confidentiality is important

Engage delegates should, wherever reasonably possible, de-identify patient information before sending it to Engage.

You should not routinely send:

• patient names;
• dates of birth;
• home addresses;
• NHS numbers;
• identifiable correspondence;
• full clinical records;
• facial photographs where identification is unnecessary; or
• other information capable of identifying a patient

merely to obtain educational support.

Where a clinical case can be discussed using anonymised or de-identified information, that is the preferred approach.

Responsibility of the treating dentist

If you disclose identifiable patient information to Engage, you and/or your dental practice remain responsible for ensuring that:

• the disclosure is lawful;
• there is an appropriate lawful basis;
• applicable professional confidentiality requirements are satisfied;
• the amount of information shared is limited to what is necessary;
• appropriate patient information or consent has been provided where required; and
• an appropriately secure communication channel is used.

Where Engage acts as a processor

Where identifiable patient information is supplied solely so that Engage can provide support on the instructions of the treating dentist or dental practice, Engage may process that information as a data processor on behalf of the relevant dental provider.

The dental practice or treating provider will ordinarily remain the data controller responsible for the patient's clinical information.

Engage may require an appropriate data-processing agreement before routinely receiving identifiable patient information.

12. Photographs and filming at Engage courses

Engage courses may be photographed or filmed.

This may include:

• general event photography;
• images of teaching sessions;
• images of practical exercises;
• photographs of the venue;
• group photographs;
• photographs of tutors and delegates;
• short video clips;
• interviews;
• testimonials.

We distinguish between general event documentation and prominent individual promotional use.

General event photography

We may rely on our legitimate interests for proportionate general photography or filming of an educational event where:

• attendees have been appropriately informed;
• the photography is reasonably expected;
• it does not intrude unreasonably on individuals' privacy; and
• people have a reasonable opportunity to object where practicable.

Where you do not wish to appear in identifiable general photography or filming, please notify a member of the Engage team.

We will make reasonable efforts to respect that request.

Featured promotional content

Where we specifically feature you in:

• an interview;
• testimonial;
• case study;
• prominent marketing image;
• scripted promotional film; or
• other individually focused marketing material,

we will normally obtain separate permission or consent where appropriate.

Withdrawal

Where use is based on consent, you may withdraw that consent for future use.

Withdrawal does not make use that took place lawfully before withdrawal unlawful, and it may not always be possible to withdraw printed material that has already been produced or distributed.

13. Feedback, reviews and testimonials

We may invite you to provide:

• course feedback;
• satisfaction scores;
• comments;
• reviews;
• testimonials;
• suggestions for improving the course.

We may use anonymous or aggregated feedback to:

• evaluate teaching;
• improve future courses;
• meet CPD quality-assurance requirements;
• develop new educational programmes.

We will not normally publish an identifiable testimonial for promotional purposes without an appropriate basis for doing so.

Where we ask for permission to publish your name, image, professional title, practice name or testimonial, we will explain the intended use.

14. How we obtain personal information

We may receive personal information:

Directly from you

For example, when you:

• complete a website form;
• register your interest;
• book a course;
• contact us;
• attend a course;
• complete feedback;
• subscribe to marketing;
• request support.

From your employer, dental practice or another person booking for you

A practice manager, employer or colleague may book and pay for a course on your behalf.

In these circumstances we may receive your:

• name;
• email address;
• profession;
• GDC number;
• dietary or accessibility information where appropriately provided;
• course requirements.

The person providing the information should have authority to do so.

From professional sources

We may obtain limited information from publicly available professional sources such as:

• the GDC register;
• dental practice websites;
• professional directories;
• Companies House;
• professional social-media profiles.

From service providers

We may receive relevant information from providers involved in:

• course bookings;
• payment processing;
• website forms;
• marketing communications;
• event administration.

15. Why we use personal information and our lawful bases

UK data protection law requires us to have a lawful basis for processing personal information.

Different bases may apply to different activities.

15.1 Responding to enquiries

Purpose

To answer questions, provide information about our courses and respond to requests.

Lawful basis

• taking steps at your request before entering into a contract; and/or
• our legitimate interests in responding to professional and commercial enquiries.

15.2 Processing course bookings

Purpose

To:

• register you;
• take or reconcile payment;
• issue confirmations;
• administer your booking;
• communicate course information;
• manage transfers or cancellations.

Lawful basis

• performance of a contract or steps before entering into a contract;
• legitimate interests where the contract is with your employer or practice rather than you personally.

15.3 Delivering the course

Purpose

To:

• manage attendance;
• provide teaching and practical exercises;
• administer catering and venue arrangements;
• communicate important event information.

Lawful basis

• performance of a contract; and
• legitimate interests in delivering and managing the course properly.

15.4 CPD certification

Purpose

To:

• record attendance;
• calculate verifiable CPD;
• generate certificates;
• confirm learning outcomes;
• replace certificates;
• verify completion where reasonably required.

Lawful basis

• performance of our contract;
• legitimate interests in maintaining reliable educational and CPD records;
• compliance with relevant professional or legal requirements where applicable.

15.5 Financial and accounting records

Purpose

To:

• issue invoices;
• administer payments and refunds;
• maintain financial records;
• meet accounting, tax and regulatory obligations.

Lawful basis

• performance of our contract;
• compliance with legal obligations.

15.6 Dietary, health and accessibility information

Purpose

To:

• provide appropriate adjustments;
• provide suitable food where reasonably possible;
• protect health and safety;
• facilitate participation.

Lawful basis

For ordinary personal information:

• performance of our contract;
• legitimate interests;
• compliance with legal obligations where applicable.

For special-category information:

• explicit consent where appropriate; and/or
• another applicable Article 9 condition where required by law or necessary in exceptional circumstances.

15.7 Course feedback and quality assurance

Purpose

To:

• evaluate courses;
• improve educational standards;
• develop future courses;
• demonstrate quality assurance.

Lawful basis

Our legitimate interests in evaluating and improving our professional education services.

15.8 Responding to complaints and disputes

Purpose

To:

• investigate complaints;
• resolve disputes;
• respond to allegations;
• establish, exercise or defend legal claims.

Lawful basis

• performance of our contract;
• legitimate interests in managing complaints and protecting our legal interests;
• compliance with legal obligations where applicable.

Where special-category information is relevant to legal proceedings or claims, an additional applicable Article 9 condition will be identified.

15.9 Website security and essential functions

Purpose

To:

• operate our website;
• maintain security;
• prevent abuse;
• investigate technical problems;
• protect our systems.

Lawful basis

Our legitimate interests in operating a safe, functional and secure website.

Where PECR requires consent for storage or access technologies, we will comply with those requirements.

15.10 Website analytics

Purpose

To understand:

• how people reach our website;
• which pages are useful;
• website performance;
• engagement;
• marketing effectiveness.

Lawful basis

Where personal information is involved:

• consent where required by PECR; and
• consent or legitimate interests under UK GDPR as appropriate.

Non-essential analytics cookies will not be placed before consent where consent is legally required.

15.11 Marketing

Purpose

To tell existing or potential delegates about:

• Engage courses;
• new course dates;
• educational events;
• educational content;
• blogs and resources;
• relevant Engage services.

Lawful basis

Depending on the circumstances:

• consent;
• legitimate interests; or
• another basis permitted under applicable electronic-marketing law.

Our electronic marketing also complies with PECR.

15.12 Photography and video

Purpose

To:

• document courses;
• create educational material;
• promote Engage;
• demonstrate the nature of our courses.

Lawful basis

Depending on the circumstances:

• legitimate interests for proportionate general event photography; or
• consent for particular featured promotional material where appropriate.

15.13 Post-course support

Purpose

To provide:

• educational guidance;
• case-selection support;
• restorative workflow support;
• component guidance;
• referral support.

Lawful basis

• performance of our contract where the support forms part of the course;
• legitimate interests in supporting Engage delegates.

Identifiable patient data will only be processed where an additional appropriate basis and data-protection arrangement exists.

16. Legitimate interests

Where we rely on legitimate interests, we consider:

• the legitimate purpose we are seeking to achieve;
• whether processing personal information is necessary for that purpose; and
• whether your interests, rights or freedoms override our interests.

Our legitimate interests may include:

• operating Engage efficiently;
• responding to professional enquiries;
• delivering professional education;
• communicating with delegates;
• improving our courses;
• protecting our systems and business;
• preventing fraud or misuse;
• maintaining appropriate business records;
• developing our services;
• promoting relevant professional education where lawful;
• protecting or defending our legal rights.

Where appropriate, we conduct and document a legitimate interests assessment.

17. Marketing communications

We may send marketing communications concerning Engage courses, events and educational content.

Electronic marketing is subject to additional rules under PECR.

Individual subscribers

Where applicable, including individuals, sole traders and certain partnerships, we will only send unsolicited electronic marketing where:

• you have provided appropriate consent; or
• an applicable legal exception such as the “soft opt-in” applies.

Corporate subscribers

Different PECR rules may apply where communications are sent to corporate subscribers such as limited companies or LLPs.

Where the contact information identifies an individual employee or professional contact, UK GDPR still applies and we must have a lawful basis to process that personal information.

Opting out

You can stop receiving marketing communications at any time by:

• using the unsubscribe facility contained in the communication; or
• emailing contact@engageimplant.co.uk.

You have an absolute right to object to the use of your personal information for direct marketing.

If you object, we will stop using your information for direct marketing.

We may retain a minimal suppression record, such as your email address, so that we can ensure that you are not inadvertently added back to a marketing list.

Course administration communications are different from marketing.

If you have booked a course, we may still send essential information concerning that booking even if you have opted out of marketing.

18. Cookies and similar technologies

Our website may use cookies and similar technologies.

These can include:

Strictly necessary technologies

Used for functions such as:

• website security;
• booking functionality;
• remembering essential settings;
• form submission;
• network management.

These may not require consent where they are strictly necessary.

Analytics technologies

Used to understand how visitors use the website.

Advertising and attribution technologies

Where enabled, these may help us:

• understand the source of enquiries;
• measure advertising effectiveness;
• attribute bookings to marketing campaigns;
• provide more relevant advertising.

Where UK law requires consent, non-essential cookies and similar technologies will not be activated until you have made an appropriate choice.

Full details of the technologies actually deployed, providers and cookie durations are set out in our separate Cookie Policy and cookie preference tool.

19. Who we may share personal information with

We do not sell personal information.

We may share information where reasonably necessary with the following categories of recipient.

19.1 Website, booking and customer-management providers

We may use providers that:

• host website functionality;
• provide enquiry forms;
• administer bookings;
• maintain customer records;
• send communications.

Where these providers process personal information on our behalf, appropriate contractual and data-protection arrangements will be maintained.

19.2 Payment providers

We may share the information necessary to administer payments, refunds, fraud prevention and transaction verification with specialist payment providers.

Payment providers may act as independent controllers for certain aspects of their payment-processing activities.

19.3 Venue and catering providers

We may share information such as:

• delegate numbers;
• names where reasonably necessary;
• dietary requirements;
• allergy information;
• accessibility requirements

with the venue or catering provider where required to provide the course safely and effectively.

We will seek to minimise the amount of personal information shared.

19.4 Course tutors and support clinicians

Relevant information may be available to Engage tutors or clinicians involved in providing:

• teaching;
• course administration;
• post-course support;
• case discussion;
• referral support.

Access will be limited to information reasonably required for their role.

19.5 IT and professional advisers

We may use providers including:

• web developers;
• cloud service providers;
• IT support providers;
• cybersecurity providers;
• accountants;
• bookkeepers;
• auditors;
• solicitors;
• insurers;
• professional advisers.

These organisations may process information only where necessary for the relevant service and subject to appropriate legal obligations.

19.6 Regulators and authorities

We may disclose information where reasonably required to:

• HM Revenue & Customs;
• the Information Commissioner's Office;
• the courts;
• law-enforcement agencies;
• professional regulators;
• other government or regulatory authorities.

We will only do so where legally required or otherwise lawfully justified.

19.7 Business restructuring

If Engage is involved in:

• a merger;
• acquisition;
• investment;
• corporate restructuring;
• sale of business or assets,

personal information may be disclosed to professional advisers and prospective counterparties subject to appropriate confidentiality and data-protection safeguards.

20. Sponsors and commercial partners

Engage may work with:

• dental manufacturers;
• implant companies;
• laboratories;
• suppliers;
• education partners;
• sponsors.

Their involvement in a course does not mean that they automatically receive delegate personal information.

We will not provide a delegate mailing list to a sponsor for the sponsor's independent direct marketing merely because that organisation supports an Engage course.

If we propose to share your personal information with a commercial partner for its own marketing, we will provide appropriate information and obtain consent where required.

Where a third party independently collects information directly from you during an Engage event, its own privacy policy may apply.

21. Social media

Engage may operate accounts on social-media platforms.

If you:

• follow Engage;
• comment on our content;
• send us a direct message;
• tag Engage;
• interact with an advertisement,

the relevant social-media provider may process your information independently in accordance with its own privacy policy.

Engage may also receive information made available through the relevant platform.

We recommend reviewing the privacy settings and privacy information of any social-media service you use.

22. International transfers

Some of our technology, software, communications or service providers may process or store personal information outside the United Kingdom.

Where this results in a restricted international transfer, Engage will take appropriate steps required by UK data protection law.

Depending on the destination and provider, these may include:

• UK adequacy regulations;
• an applicable approved data privacy framework;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved EU Standard Contractual Clauses;
• another legally recognised safeguard; or
• a permitted statutory exception in limited circumstances.

Where required, we will also assess the protection available to personal information in the destination country and implement additional safeguards where appropriate.

You may email contact@engageimplant.co.uk for further information about safeguards relevant to personal information transferred internationally.

23. Data security

We take reasonable technical and organisational measures designed to protect personal information against:

• unauthorised access;
• accidental loss;
• unlawful use;
• alteration;
• disclosure;
• destruction.

Measures may include, where appropriate:

• controlled user access;
• strong authentication;
• multi-factor authentication;
• encryption in transit;
• secure cloud services;
• password management;
• staff access restrictions;
• secure backups;
• supplier due diligence;
• contractual confidentiality requirements;
• security updates and maintenance;
• appropriate incident-response procedures.

Access to personal information is restricted to people who have a legitimate need to use it.

No system connected to the internet can be guaranteed to be completely secure. We therefore review our security arrangements proportionately to the nature of the information we process.

24. Personal data breaches

Engage maintains procedures for identifying, investigating and responding to suspected personal data breaches.

Where a breach creates a risk to individuals' rights and freedoms, we will notify the Information Commissioner's Office where required.

Where the breach is likely to result in a high risk to an affected individual, we will also notify that individual where required by law.

25. How long we keep personal information

We do not keep personal information indefinitely simply because it may be useful in the future.

Retention is based upon:

• the purpose for which the information was collected;
• contractual requirements;
• tax and accounting obligations;
• CPD verification requirements;
• legal limitation periods;
• regulatory obligations;
• potential disputes or claims;
• the sensitivity of the information.

Our indicative retention periods are set out below.

Enquiries that do not result in a booking

Normally up to 24 months after the last meaningful communication, unless there is a reason to retain the information for longer.

Course booking and attendance records

Normally six years following completion of the relevant course or transaction.

Financial and invoice records

Normally at least six years, or for the period required by applicable tax and accounting legislation.

CPD records and certification

Normally six years following the course.

This may include:

• delegate name;
• GDC number;
• course;
• date;
• verified CPD hours;
• certificate details.

Course feedback

Identifiable feedback will normally be retained for up to three years, unless:

• it forms part of another record requiring longer retention; or
• it is anonymised.

Anonymous feedback may be retained indefinitely because it no longer constitutes personal information.

Dietary and accessibility information

Ordinarily deleted or securely removed within approximately 30 days following the course once it is no longer required.

We may retain relevant information longer where:

• an incident occurred;
• a complaint or legal claim has arisen;
• you have asked us to retain it for a future confirmed course; or
• there is another lawful reason.

General correspondence

Normally retained for up to three years after the last relevant interaction, unless associated with a contract, complaint, legal claim or another record requiring longer retention.

Complaints and legal disputes

Normally retained for up to six years after closure, or longer where reasonably necessary for existing or anticipated legal proceedings.

Marketing information

We will periodically review marketing contact information.

Where you withdraw consent or object to marketing, we will stop marketing to you.

We may retain minimal suppression information for as long as reasonably necessary to ensure that your objection continues to be respected.

Photographs and video

Promotional images and recordings may be retained for as long as they remain reasonably relevant and appropriate for the original purpose.

We will periodically review older marketing assets.

Where consent is relied upon and is withdrawn, we will stop new uses where reasonably practicable, subject to lawful uses already made and material already published or distributed.

26. Data minimisation

We aim to collect only personal information reasonably required for the purpose concerned.

In particular:

• we do not need extensive medical histories from delegates;
• patient information supplied for clinical support should be de-identified wherever possible;
• we do not need full payment-card details where a payment processor can process these directly;
• we will not ask for professional information irrelevant to the educational service being provided.

27. Accuracy

We take reasonable steps to ensure that personal information is accurate and up to date.

Please notify Engage if important information changes, particularly:

• your name;
• email address;
• professional registration information;
• billing details;
• dietary requirements;
• accessibility requirements.

You can request a correction by emailing:

contact@engageimplant.co.uk

28. Your data protection rights

Depending on the circumstances and lawful basis, you may have the following rights.

28.1 Right to be informed

You have the right to clear information explaining how and why your personal information is processed.

This Privacy Policy is part of how we meet that obligation.

28.2 Right of access

You may ask:

• whether we process your personal information; and
• for a copy of the personal information we hold about you.

This is commonly known as a subject access request.

28.3 Right to rectification

You may ask us to correct inaccurate personal information or complete information that is incomplete.

28.4 Right to erasure

In certain circumstances you may ask us to delete personal information.

This right is not absolute.

For example, we may need to retain information to:

• comply with legal obligations;
• maintain required financial records;
• establish, exercise or defend legal claims.

28.5 Right to restriction

In certain circumstances you may ask us to restrict how we process personal information while an issue is resolved.

28.6 Right to data portability

Where processing:

• is based upon consent or contract; and
• takes place by automated means,

you may have the right to receive certain information in a structured, commonly used, machine-readable format and potentially transmit it to another controller.

28.7 Right to object

You may object to certain processing based on legitimate interests.

We will consider the circumstances and stop processing unless we have compelling legitimate grounds to continue or processing is required for legal claims.

Direct marketing

Your right to object to direct marketing is absolute.

If you object, we will stop processing your personal information for direct-marketing purposes.

28.8 Right to withdraw consent

Where processing is based on consent, you can withdraw your consent at any time.

Withdrawal will not affect the lawfulness of processing carried out before consent was withdrawn.

28.9 Automated decision-making rights

You have rights concerning certain decisions made solely by automated processing that produce legal or similarly significant effects.

Engage does not currently use solely automated decision-making or profiling to make decisions about course eligibility, access or other matters that have legal or similarly significant effects on individuals.

If this changes materially, we will update this Privacy Policy and provide any additional information required by law.

29. Exercising your rights

To exercise any of your data protection rights, please email:

contact@engageimplant.co.uk

Please include sufficient information for us to understand your request.

You do not normally need to pay a fee to exercise your rights.

We may need to verify your identity before disclosing, deleting or amending personal information.

We will respond within the period required by applicable data protection law.

Where a request is particularly complex or multiple requests have been made, the law may permit additional time. If so, we will explain this.

Some rights are subject to exemptions and we may not always be legally required to comply fully with a request.

Where we cannot fulfil a request, we will explain why where legally required.

Please do not send privacy requests or personal information to our registered office, as it is not a correspondence address and does not accept mail on our behalf.

30. Patient requests

If you are a dental patient whose information has been provided to Engage by your dentist or dental practice solely for clinical educational or support purposes, your dental provider may remain the data controller.

You should ordinarily contact your dental practice in the first instance if you wish to exercise rights concerning your clinical record.

If Engage receives such a request where we act only as a processor, we may refer the request to the relevant controller and assist it as required.

Where Engage is independently responsible as controller for the relevant information, we will deal with the request directly.

Questions may be sent to:

contact@engageimplant.co.uk

31. Complaining about our use of personal information

We would appreciate the opportunity to deal with any concern first.

Please email:

contact@engageimplant.co.uk

if you have concerns about our processing of personal information.

You also have the right to complain to the Information Commissioner's Office (“ICO”), the UK's independent data protection regulator.

Information about making a complaint is available directly from the ICO.

Your right to complain to the ICO is not affected by first raising the matter with Engage.

32. Information relating to children

Engage provides professional dental education and does not intentionally provide courses directly to children.

Our website and course-booking services are not intended to collect personal information directly from children.

Clinical educational materials may occasionally concern paediatric patients.

Where patient information is used:

• appropriate confidentiality obligations apply;
• materials should be anonymised or appropriately authorised;
• only information necessary for the educational purpose should be used.

33. External websites and links

Our website may contain links to third-party websites, including:

• venues;
• hotels;
• manufacturers;
• educational resources;
• booking or payment providers;
• professional organisations;
• social-media platforms.

Engage is not responsible for the privacy practices of independent third-party websites.

You should review their privacy information before submitting personal information to them.

34. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• changes in law;
• regulatory guidance;
• changes to our courses;
• new website functionality;
• changes to suppliers;
• changes in how we process personal information.

The latest version will be published on our website with an updated revision date.

Where we propose a material new use of personal information that individuals would not reasonably expect, we will provide appropriate additional information before beginning that processing where required.

35. Document governance

Engage will review this Privacy Policy periodically and when there is a material change to our processing activities.

We will also maintain appropriate internal documentation concerning:

• categories of personal information processed;
• purposes;
• lawful bases;
• data processors and suppliers;
• international transfers;
• security measures;
• retention;
• data protection incidents;
• individual rights requests;
• consent where relied upon;
• legitimate interests assessments where appropriate.

36. Contact details

For questions concerning this Privacy Policy, your personal information or your data protection rights, please contact:

Engage Implant Education Limited

Email: contact@engageimplant.co.uk

Company number: 17232238

Registered office:

167–169 Great Portland Street
5th Floor
London
England
W1W 5PF

The registered office above is provided for statutory company-identification purposes only. It is a virtual office and is not a correspondence address. Please do not send post to this address. All privacy correspondence should be sent by email to contact@engageimplant.co.uk.

‍