Privacy Policy

This Privacy Policy explains how Staffordshire Operator Training Ltd ("we", "us", "our") collects, uses, stores, and protects personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

1. Data Controller

Staffordshire Operator Training Ltd is the data controller responsible for your personal data.

2. Information We Collect

Depending on the training course, qualification, or service provided, we may collect and process the following personal data:

• Full name
• Address, email address, and telephone number
• Date of birth
• National Insurance number (where required for certification, funding, or compliance purposes)
• Booking, course, and attendance information
• Assessment results, certification, and qualification records
• Employer or sponsor details (where training is arranged by a third party)
• Payment confirmation and transaction reference details

We only collect personal data that is necessary for delivering training, assessment, certification, and related services.

3. How We Collect Personal Data

Personal data is collected:

• Directly from learners when they make enquiries or bookings
• From employers or sponsors when training is booked on behalf of learners
• Through secure online forms following course booking or payment
• Through correspondence by email, telephone, or in person

4. Lawful Basis for Processing

We process personal data under the following lawful bases:

• Contract – to manage bookings and deliver training and assessment services
• Legal obligation – to meet awarding body, certification, funding, and regulatory requirements
• Legitimate interests – to manage our training operations, maintain records, and communicate with learners and clients

Where high-risk personal data (such as National Insurance numbers) is required, it is collected only where necessary and solely for compliance and certification purposes.

5. How We Use Your Information

We use personal data to:

• Manage course bookings and learner records
• Deliver training, assessments, and qualifications
• Issue certificates and maintain compliance records
• Communicate with learners, employers, and clients
• Meet awarding body, accreditation, and regulatory requirements
• Maintain internal administrative and audit records

Personal data is processed within our internal administration and training management systems and is accessed only by authorised staff on a need-to-know basis.

6. Payments

Payments are processed securely by third-party payment providers including Stripe and Klarna (Buy Now, Pay Later).

• We do not store credit or debit card details
• Payment providers process payment data in accordance with their own privacy policies
• We receive confirmation of payment status and transaction references only

7. Data Sharing

We may share relevant personal data with:

• Awarding bodies and certification organisations
• Accreditation and assessment partners
• Regulatory or compliance bodies where legally required
• Service providers who host and operate our website and email systems
• Payment providers (Stripe and Klarna) for processing course payments — see section 6
• Google (Google Analytics and Google Ads) and Meta (Facebook) — for website analytics and advertising measurement, and only where you have consented to the relevant cookies. Where identifiers such as an email address are used for advertising measurement, they are hashed (pseudonymised) before being sent. See section 11 for details.

Data is shared only where necessary and only for legitimate training, certification, compliance, or (with your consent) measurement purposes. We do not sell personal data.

8. International Data Transfers

Some of our service providers (such as payment processors or hosting providers) may process data outside the United Kingdom.

Where personal data is transferred outside the UK, appropriate safeguards are in place, such as UK adequacy regulations or standard contractual clauses, to ensure data protection standards are maintained.

9. Data Security

We take appropriate technical and organisational measures to protect personal data, including:

• Secure systems and controlled access
• Restricted staff access based on role and necessity
• Secure storage of learner and certification records
• Reasonable steps to prevent unauthorised access, loss, or misuse

10. Data Retention

We retain personal data only for as long as necessary to meet:

• Legal and regulatory obligations
• Awarding body and certification requirements
• Audit and compliance needs

Once personal data is no longer required, it is securely deleted or anonymised.

11. Cookies

Our website uses cookies and similar technologies (such as browser session storage) in accordance with the Privacy and Electronic Communications Regulations (PECR). Non-essential cookies are set only with your consent, which you give or refuse via the cookie banner. You can change or withdraw your choice at any time using the "Cookie Settings" link in the footer of any page, or through your browser settings.

Essential Cookies (no consent required)

Required for the website to operate:

• cc_cookie — records your cookie consent choice so we don't ask again (6 months)
• Stripe cookies (e.g. __stripe_mid, __stripe_sid) — fraud prevention during secure checkout, set by Stripe (up to 1 year)
• session_id — secure staff login session, staff area only (24 hours)

Analytics Cookies (with your consent)

• _ga, _ga_* — Google Analytics; helps us understand how visitors use the website, e.g. which pages are popular (up to 2 years)

Marketing Cookies (with your consent)

• _gcl_aw — Google Ads; records that you arrived via one of our Google adverts so we can measure which adverts work (90 days)
• _fbp, _fbc — Meta (Facebook); measures the performance of our Facebook advertising (up to 3 months)
• ot_gclid — browser session storage (not a cookie); temporarily holds the Google ad click reference during your visit so an enquiry or booking can be linked to the advert that brought you here (deleted when you close the tab)

If you decline analytics or marketing cookies, no such identifiers are stored on your device and your personal data is not sent to Google or Meta — by your browser or by our servers. Your browser may still send Google anonymous, cookieless signals that contain no personal data and are used only for aggregate measurement.

12. Automated Decision-Making

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects on individuals.

13. Children's Data

Our training services are primarily intended for adults.

Where we process personal data relating to learners under the age of 18, this is done only where necessary and with appropriate safeguards in place.

14. Your Rights

Under UK GDPR, you have the right to:

• Access your personal data
• Request correction of inaccurate or incomplete data
• Request deletion of your data (subject to legal and certification obligations)
• Restrict or object to processing
• Request data portability

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data has been handled improperly.

Website: https://www.ico.org.uk

15. Contact Us

For privacy-related enquiries or to exercise your rights, please contact:

Last updated: January 2026