GDPR Policy

Introduction

At Trainforce, we are committed to protecting personal information and respecting the privacy rights of our customers, website visitors, training delegates and business contacts.

Trainforce, operating through trainforce.co.uk, is a trading style of Autec Training Ltd, registered in England and Wales under company number 05192184.

This GDPR Policy explains our approach to handling personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable UK data protection legislation.

It applies to personal information processed in connection with our website, enquiries, quotations, training bookings, delegate administration, certification and associated business activities.

This policy should be read alongside our Privacy Policy and Cookie Policy.

1. Our Commitment to Data Protection

We aim to process personal information lawfully, fairly, transparently and securely.

Our approach is based on the following data protection principles:

• Lawfulness, Fairness and Transparency: Personal information must be processed on an appropriate legal basis and individuals must be informed about how their information is used.
• Purpose Limitation: Personal information should be collected for specified, explicit and legitimate purposes.
• Data Minimisation: Only information reasonably necessary for the relevant purpose should be collected.
• Accuracy: Reasonable steps should be taken to keep personal information accurate and up to date.
• Storage Limitation: Personal information should not be retained longer than necessary.
• Integrity and Confidentiality: Appropriate safeguards should protect personal information against unauthorised access, loss, misuse and disclosure.
• Accountability: We are responsible for demonstrating compliance with applicable data protection requirements.

These principles guide how personal information is collected, managed and protected.

2. Data Controller Responsibilities

For personal information processed in connection with our website and business activities, Autec Training Ltd will act as the data controller where it determines the purposes and means of processing.

As a data controller, our responsibilities include:

• Identifying appropriate lawful bases for processing
• Providing clear information about how personal data is used
• Maintaining appropriate data protection procedures
• Responding to requests from individuals exercising their rights
• Implementing suitable security measures
• Managing personal data breaches appropriately
• Ensuring appropriate arrangements with third-party processors
• Reviewing data retention and disposal practices
• Assessing privacy risks where required

Where another organisation independently determines how personal information is processed, that organisation may act as a separate controller.

3. Personal Information We Process

Depending on the services requested, we may process the following categories of personal information.

Customer and Business Contact Information

• Names
• Email addresses
• Telephone numbers
• Business names
• Job titles
• Correspondence addresses
• Billing details
• Customer communication records

Training and Booking Information

• Course enquiries and booking details
• Preferred training dates and locations
• Delegate names and contact details
• Employer or sponsoring organisation details
• Training requirements
• Equipment and machinery categories where relevant
• Previous experience and qualifications
• Existing operator cards and accreditation records
• Attendance records
• Practical and theoretical assessment results
• Certification and qualification records
• Training card or certificate information

Health and Accessibility Information

Where necessary, we may process limited health or accessibility information to arrange reasonable adjustments or support safe participation in training.

Such information may constitute special category personal data and requires additional legal safeguards.

Website and Technical Information

• IP addresses
• Browser and device information
• Website usage information
• Cookie identifiers
• Contact form submissions
• Website analytics information where applicable

We aim to collect only information relevant to the services and activities involved.

4. Lawful Bases for Processing

We process personal information only where an appropriate lawful basis applies under Article 6 of the UK GDPR.

These may include:

Contractual Necessity

Processing required to enter into or fulfil a contract with an individual, including training arrangements and booking administration.

Legitimate Interests

Processing necessary for legitimate business purposes, such as responding to enquiries, maintaining customer relationships, managing training operations and protecting our systems, where those interests are not overridden by individual rights.

Legal Obligations

Processing required to comply with applicable legal requirements, including taxation, accounting, health and safety and data protection obligations.

Consent

Processing based on an individual's freely given, specific, informed and unambiguous agreement, where consent is appropriate.

Consent may be relevant to certain marketing activities and non-essential website tracking technologies.

Where consent is relied upon, individuals can withdraw it at any time.

Other lawful bases may apply in particular circumstances where permitted by legislation.

5. Special Category Personal Data

Some training arrangements may require information about a delegate's health, disability or accessibility requirements.

This information is treated with particular care.

Where special category personal data is processed, we will identify both an Article 6 lawful basis and an appropriate Article 9 condition under the UK GDPR.

Depending on the circumstances, this may involve explicit consent or another applicable legal condition.

We aim to:

• Collect only information necessary for the relevant purpose
• Explain why the information is required
• Restrict access to authorised individuals
• Avoid unnecessary disclosure
• Apply appropriate confidentiality safeguards
• Retain the information only for an appropriate period

We do not require delegates to provide unrelated medical information.

6. How Personal Information Is Used

Personal information may be used to:

• Respond to customer enquiries
• Provide quotations and course information
• Arrange professional training courses
• Manage training bookings
• Register delegates
• Confirm course attendance
• Coordinate instructors and training facilities
• Manage practical and theoretical assessments
• Issue or arrange operator cards and training certification
• Maintain relevant training records
• Communicate with employers and authorised representatives
• Process invoices and payments
• Respond to complaints and requests
• Meet applicable legal and regulatory obligations
• Maintain website security
• Improve our services
• Send marketing communications where permitted

Personal information will not be used for incompatible purposes without an appropriate legal basis.

7. Data Sharing and Third-Party Processors

We may share personal information with organisations where necessary to deliver services or meet legal obligations.

These may include:

• Professional training instructors and assessors
• Training centres
• Relevant accreditation and certification organisations
• Training scheme administrators
• Employers and authorised training coordinators
• Operator card and certificate providers
• Booking administration platforms
• Website hosting providers
• IT support providers
• Customer relationship management systems
• Payment and accounting service providers
• Professional advisers
• Regulatory and public authorities where required by law

Information shared will be limited to what is reasonably necessary for the relevant purpose.

Where third parties process personal information on our behalf, we will use appropriate contractual arrangements and safeguards as required by data protection legislation.

We do not sell personal information to third parties.

8. Data Security

We recognise the importance of protecting personal information against unauthorised access, accidental loss, alteration and disclosure.

Appropriate technical and organisational safeguards may include:

• Password-protected systems
• Access controls
• Secure storage arrangements
• Appropriate website security measures
• Confidential handling of delegate records
• Restricted access to sensitive information
• Secure information sharing procedures
• Staff and contractor confidentiality requirements
• Data backup and recovery arrangements
• Procedures for identifying and responding to security incidents

Security measures are reviewed as appropriate to the nature and risks of the processing.

No system can be guaranteed to be completely secure, but we aim to take reasonable and proportionate precautions.

9. Data Retention

Personal information is retained only for as long as reasonably necessary for the purposes for which it was collected.

Retention periods may depend on:

• The nature of the information
• Contractual requirements
• Applicable legislation
• Training scheme requirements
• Certification and qualification verification
• Accounting and taxation obligations
• Potential legal claims
• Legitimate operational needs

Examples include:

• Enquiry information: Retained for an appropriate period to manage enquiries and follow-up communications.
• Training booking records: Retained as necessary for course administration and customer service.
• Attendance and assessment records: Retained where required for training verification and certification.
• Operator card and qualification records: Retained where necessary to support certification, renewals and relevant scheme requirements.
• Health and accessibility information: Retained only for as long as necessary for the specific purpose and applicable obligations.
• Financial records: Retained in accordance with relevant accounting and taxation requirements.
• Marketing information: Retained until consent is withdrawn or an objection is received, where applicable.

When personal information is no longer required, we take appropriate steps to delete, anonymise or securely dispose of it.

10. Individual Data Protection Rights

Individuals have rights under the UK GDPR, subject to applicable conditions and exemptions.

These include:

Right of Access

You may request confirmation of whether we process your personal information and obtain a copy of that information.

Right to Rectification

You may request correction of inaccurate personal information or completion of incomplete information.

Right to Erasure

You may request deletion of personal information in certain circumstances.

Right to Restrict Processing

You may request that we limit the processing of your information where applicable.

Right to Data Portability

You may request certain personal information in a structured, commonly used and machine-readable format where the relevant legal conditions apply.

Right to Object

You may object to certain processing based on legitimate interests and to direct marketing.

Right to Withdraw Consent

Where processing relies on consent, you may withdraw that consent at any time.

Rights Relating to Automated Decision-Making

You may have additional rights where decisions producing legal or similarly significant effects are made solely through automated processing.

We do not intend to make solely automated decisions of this kind in the ordinary administration of training enquiries and bookings.

11. Data Subject Access Requests

Individuals may request access to personal information held about them.

Requests can be submitted through the contact details available on our website.

We may request information necessary to verify the identity of the person making the request.

We aim to respond without undue delay and within the period required by applicable data protection law, subject to any permitted extensions or pauses.

Requests are generally handled without charge, although legislation permits fees or refusal in limited circumstances.

Where information cannot be provided, we will explain the relevant reason where required by law.

12. International Data Transfers

Some third-party service providers may store or process personal information outside the United Kingdom.

Where international transfers take place, we will apply appropriate safeguards in accordance with UK data protection legislation.

These may include:

• Transfers covered by UK adequacy regulations
• Approved contractual safeguards
• Other lawful transfer mechanisms where applicable

We aim to ensure that personal information receives an appropriate level of protection when transferred internationally.

13. Personal Data Breaches

A personal data breach may involve accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal information.

Where a suspected breach occurs, we will take appropriate steps to:

• Investigate the incident
• Identify the information affected
• Assess potential risks to individuals
• Contain the incident where possible
• Take corrective measures
• Maintain appropriate records
• Notify relevant authorities where legally required
• Inform affected individuals where required

Where a breach is notifiable to the Information Commissioner's Office, we will report it without undue delay and, where feasible, within 72 hours of becoming aware of it.

Where a breach is likely to result in a high risk to individuals' rights and freedoms, we will notify affected individuals without undue delay, unless an applicable exemption applies.

14. Cookies and Online Tracking

Our website may use cookies and similar technologies to support functionality, analyse performance and improve the visitor experience.

These may include:

• Essential website cookies
• Functional cookies
• Analytics and performance cookies
• Marketing and advertising cookies where implemented

Non-exempt cookies and tracking technologies will be subject to applicable consent requirements.

Visitors may manage cookies through their browser settings and any cookie preference tools available on our website.

Further information is available in our Cookie Policy.

15. Marketing Communications

We may contact customers and business contacts about relevant services where permitted by applicable law.

Marketing communications may include information about:

• Construction plant operator training
• MEWP and powered access training
• Workplace machinery training
• Relevant accredited training courses
• Refresher training
• Operator certification and renewals
• Other professional training services

We will comply with applicable UK GDPR and Privacy and Electronic Communications Regulations requirements.

Where consent is required, marketing communications will only be sent after the necessary consent has been obtained.

Individuals may opt out of direct marketing at any time.

16. Data Protection by Design and Default

We aim to consider data protection requirements when developing or changing our website, systems and business processes.

This includes:

• Limiting unnecessary data collection
• Restricting access to personal information
• Considering privacy risks before introducing new technologies
• Reviewing third-party service providers
• Applying appropriate security controls
• Minimising the retention of unnecessary information
• Considering the rights of individuals affected by processing

Where processing is likely to result in a high risk to individuals' rights and freedoms, we will carry out a Data Protection Impact Assessment where required.

17. Staff, Contractors and Confidentiality

Individuals handling personal information on our behalf are expected to treat it confidentially and use it only for authorised purposes.

Appropriate arrangements may include:

• Confidentiality obligations
• Access restrictions
• Data protection guidance
• Secure handling procedures
• Reporting of suspected security incidents
• Appropriate oversight of third-party processors

We aim to ensure that personal information is accessed only where necessary for legitimate business activities.

18. Complaints and Regulatory Oversight

If you have concerns about how your personal information is handled, you may contact us using the details provided on our website.

We will make reasonable efforts to investigate concerns and provide an appropriate response.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.

ICO website: www.ico.org.uk

We encourage individuals to contact us first where possible so that we have an opportunity to address concerns directly.

19. Changes to This GDPR Policy

We may update this GDPR Policy periodically to reflect changes in:

• Data protection legislation
• Regulatory guidance
• Website functionality
• Training services
• Business operations
• Information security practices
• Third-party processing arrangements

Updated versions will be published on our website.

We recommend reviewing this policy occasionally.

20. Contact Us

For questions about this GDPR Policy, personal information, data protection rights or the handling of personal data, please contact us through trainforce.co.uk.

Trainforce
A trading style of Autec Training Ltd
Registered in England and Wales
Company Number: 05192184

Registered Office: Industrial Estate, Oxney Road, Peterborough, PE1 5YW

We are committed to handling personal information responsibly and respecting the rights of individuals whose data we process.