Privacy Policy

1. Introduction

Protecting your personal information is extremely important to us. It’s especially important for a training company like ours, as our customers trust us to look after sensitive information on everything from their education to their medical history.

The way we collect and share your information is equally important. Our customers expect us to manage their information privately and securely. If we don’t, they’ll lose their trust in us and we could be breaking the law.

This policy tells you how we collect and process your personal information.

2. What is personal information?

When we talk about personal information we mean information about an individual that can identify them, like their name, address, e-mail address, telephone number, medical and education details. It can relate to customers, employees, and suppliers. Any reference to “information” or “data” in this policy is a reference to personal information about a living individual.

3. What information do we hold?

We may collect and process the following personal information about you:

Type of data	Description
Contact	Who you are Where you live How to contact you
Personal Details	Age Gender Visual images & personal appearance Disabilities
Documentary data & national identifiers	Your passport Drivers licence Birth certificate National Insurance number

4. Where do we get our information from?

• Information you give us directly (when you fill in forms or contact us by phone, e-mail etc.).
• Information we collect about you or receive from other sources. This could be information you provide to us electronically or through authorized websites such as Rail Sentinel.

How do we use your information?

We use personal information that we hold about you:

• To comply with any applicable industry standards such as the RSSB (Rail Safety & Standards Board), Network Rail, Transport For London and the DVLA.
• For any other purpose that we’ve agreed with you from time to time.

When you apply for training from us, the application form you fill out or the resulting contract may contain additional conditions relating to the way we use and process your personal information. These will apply in addition to the above uses.

5. Using your information in accordance with data protection laws

Data protection laws require us to meet certain conditions before we’re allowed to use your personal information in the way we describe in this privacy policy. We take these responsibilities extremely seriously. To use your personal information, we’ll rely on the following conditions, depending on the activities we’re carrying out:

• Providing our contracts & services to you: We’ll process your personal information to carry out our responsibilities resulting from any agreements you’ve entered into with us and to provide you with the information and services you’ve asked from us, which may include online services.
• Complying with applicable laws: We may process your personal information to comply with any legal obligation we’re subject to.

This requires us to carry out an assessment of our interests in using your personal data against the interests you have as a citizen and the rights you have under data protection laws.

The outcome of this assessment will determine whether we can use your personal data in the ways described in this privacy policy (except in relation to marketing, where we’ll always rely on your consent). We’ll always act reasonably and give full and proper consideration to your interests in carrying out this assessment.

6. How long do we keep your information for?

We’ll keep your personal information in accordance with our internal retention policies. We’ll determine the length of time we keep it for based on the minimum retention periods required by law, regulation, and/or Industry Standard. We’ll only keep your personal information after this period if there’s a legitimate and provable business reason to do so.

7. Who do we share your personal information with?

We’ll only disclose your information to our regulators, government (e.g. HMRC), and law enforcement or fraud prevention agencies.

8. Fraud prevention

We will check your details. If false or inaccurate information is provided and fraud is identified details will be passed to fraud prevention agencies and training bodies. Law enforcement agencies may access and use this information. We may also share information about you with other organizations and public bodies, including the police, and we may check and/or file your details with fraud prevention agencies and databases.

9. Transferring your data outside the EU

The data that we collect from you will NOT be transferred to, and stored at, a destination outside the European Economic Area ("EEA") to third-party suppliers, delegates, or agents. Unless specifically requested to and ONLY if written authorization is given.

Unfortunately, sending information via e-mail is not completely secure; anything you send is done so at your own risk. Once received, we will secure your information in accordance with our security procedures and controls.

10. Your Rights

You have rights under data protection law that relate to the way we process your personal data. If you wish to exercise any of these rights, please get in touch with your customer services team. By law, you have the right to:

• 10.1 - The right to access the personal data that we hold about you.
• 10.2 - The right to make us correct any inaccurate personal data we hold about you.
• 10.3 - The right to make us erase any personal data we hold about you. This right will only apply where:
  • We no longer need to use the personal data to achieve the purpose we collected it for.
  • You withdraw your consent if we’re using your personal data based on that consent.
• 10.4 - Where you object to the way we use your data, and there is no overriding legitimate interest.
• 10.5 - The right to restrict our processing of the personal data we hold about you. This right will only apply where:
  • You dispute the accuracy of the personal data we hold.
  • You would like your data erased, but we require to hold it to stop its processing.
  • You have the right to require us to erase the personal data but would prefer that our processing is restricted instead.
  • Where we no longer need to use the personal data to achieve the purpose we collected it for, but you need the data for legal claims.
• 10.6 - The right to object to our processing of personal data we hold about you (including for the purposes of sending marketing materials to you).
• 10.7 - The right to receive personal data, which you have provided to us, in a structured, commonly used and machine-readable format. You also have the right to make us transfer this personal data to another organization.
• 10.8 - The right to withdraw your consent, where we’re relying on it to use your personal data (for example, to provide you with marketing information about our services or products).

11. Contacts and Complaints

If you have any questions about this privacy policy or wish to exercise any of your rights, including changing your marketing preferences, please get in touch with our Office Manager.