GDPR Policy
Purpose and scope
Training Courses, trading through training-courses.uk, is a trading style of Autec Training Ltd, registered in England and Wales under company number 05192184. Registered office: Industrial Estate, Oxney Road, Peterborough, PE1 5YW. This draft should be checked against the services and personal-data practices actually used on the website. This policy describes our intended framework for compliance with the UK GDPR and Data Protection Act 2018 for website, enquiry, booking, training and related business information.
Controller and accountability
Autec Training Ltd acts as controller when it determines why and how personal information is processed. Other organisations involved in delivering or accrediting training may be independent controllers. We aim to document responsibilities and use appropriate processor contracts where required.
Data protection principles
We seek to process personal data lawfully, fairly and transparently; for specified purposes; using only necessary information; with reasonable accuracy; for limited retention periods; and with suitable security. We aim to demonstrate accountability for these principles.
Categories of data
Information may include customer contact details, enquiries, course requirements, delegate identifiers, employer details, training records, assessment outcomes, qualification details, billing records, website logs and cookie identifiers. Health or accessibility information may be processed only where relevant and lawful.
Lawful bases and purpose mapping
Each processing activity should have a documented Article 6 basis: contract or pre-contract steps, legitimate interests, legal obligation, consent or another basis where applicable. Legitimate interests must be balanced against individuals’ rights. Consent should be specific, informed and withdrawable.
Special category data
Health and disability-related information requires an Article 9 condition in addition to an Article 6 lawful basis. We seek to limit collection to reasonable adjustments or necessary safety arrangements and restrict access appropriately.
Data sources and transparency
Information may come from the individual, their employer, a booking coordinator, course providers or website technology. Privacy information should be supplied at collection and, where required, when information is obtained indirectly.
Sharing and processors
Information may be shared with instructors, assessors, accreditation bodies, employers, IT and hosting providers, payment and administration suppliers and regulators where necessary. We aim to share only appropriate data, use processor contracts where required and recognise when another party acts as independent controller.
Security measures
Appropriate measures may include user permissions, passwords, secure transmission, backups, confidentiality expectations, supplier due diligence and incident response. Controls should reflect the sensitivity, volume and risk of the data.
Retention and deletion
Retention schedules should distinguish enquiries, booking records, financial records, assessment evidence, certification records and any health information. Data should be deleted or anonymised when no longer required, subject to legal and scheme-specific obligations.
Individual rights
Individuals may have rights of access, correction, erasure, restriction, portability, objection, withdrawal of consent and safeguards for solely automated decisions. Rights are subject to applicable conditions and exemptions. Requests should be assessed and answered within statutory deadlines.
Data subject requests
Requests may be made through the website’s published contact details. Identity may be verified where necessary. We aim to respond without undue delay, usually within one month, subject to permitted extensions or other legal provisions.
International transfers
Restricted transfers outside the UK should be supported by an applicable adequacy regulation, appropriate safeguards or another lawful mechanism. Providers and transfer arrangements should be reviewed where relevant.
Personal data breaches
Suspected incidents should be assessed, contained, documented and remedied. Where a breach is notifiable, the ICO should be notified without undue delay and, where feasible, within 72 hours of awareness. Individuals must be notified where legally required due to high risk.
Cookies and direct marketing
Non-exempt storage or access technologies should follow applicable PECR consent rules. Direct marketing must comply with PECR and UK GDPR, including consent where required and the right to object to marketing at any time.
Privacy by design
New forms, systems, suppliers and processing activities should be reviewed for data minimisation, security and rights impacts. A Data Protection Impact Assessment should be carried out where legally required for high-risk processing.
Review, complaints and contact
This policy should be reviewed as services, suppliers or legislation change. For questions or requests relating to this policy, contact us using the contact details published at training-courses.uk. Legal entity: Autec Training Ltd, company number 05192184, registered office: Industrial Estate, Oxney Road, Peterborough, PE1 5YW. For data protection complaints, you may also contact the Information Commissioner’s Office at ico.org.uk.