Privacy Policy

2. What this policy covers

This policy explains:

• What personal data we collect
• Why we collect it and the legal basis we rely on
• Who we share it with
• How long we keep it
• Your rights and how to complain

3. The personal data we collect

Depending on how you interact with us (enquiry, booking, qualifications, funded training, e-learning, finance, etc.) we may collect:

3.1 Identity & contact data

• Name, job title, employer/organisation (where relevant)
• Email address, phone number
• Postal address (where required)

3.2 Booking, course & learner data

• Course(s) booked, attendance, joining instructions and course communications
• Assessment outcomes, certificates and awarding-body learner identifiers
• Access details for learning platforms (usernames, learning progress, completion)

3.3 Payment & transaction data

• Invoices, payment status, and payment method
• If paying by card, card payments are processed securely by our payment provider(s), and we do not store full card details.

3.4 Funding & compliance data (where applicable)

Where training is subsidised/funded, we may collect information required by the relevant scheme and auditors, including company and learner details (e.g., eligibility evidence, National Insurance number, and other required documentation).

3.5 Special category data (only when needed)

We may collect and process “special category” data only where it is necessary, for example:

• Health information relating to reasonable adjustments, accessibility, or welfare
• Equality and diversity information (if collected for monitoring or funding/awarding-body requirements)

We will process this data only where a lawful basis applies (typically your explicit consent and/or where required to meet training/assessment obligations).

3.6 Technical & usage data (website)

• IP address, browser/device information, pages visited, and cookie identifiers
• Marketing/advertising interaction data where you have consented to relevant cookies

4. How we collect personal data

We collect personal data from:

• you (e.g., enquiry forms, booking forms, downloads, emails/phone calls, learning platform use)
• your employer or the person booking on your behalf (e.g., delegate details)
• funding bodies, employers, or partners (where a programme requires it)
• awarding bodies and quality assurance activity (where qualifications/certification apply)
• cookies and similar technologies on our website (see section 12)

5. Why we use your data (purposes and legal bases)

5.1 To respond to enquiries and provide information

Purpose: responding to questions, building quotes/proposals, and providing course information.

Legal basis: legitimate interests and/or taking steps to enter a contract.

5.2 To deliver training and services

Purpose: course booking administration, joining instructions, learner support, delivery (classroom/virtual/e-learning), assessments, certification.

Legal basis: performance of a contract.

5.3 To meet legal, regulatory, and quality obligations

Purpose: accounting/tax, compliance with funding requirements, safeguarding/quality assurance processes where relevant, responding to lawful requests.

Legal basis: legal obligation and/or legitimate interests.

5.4 Marketing communications (where permitted)

Purpose: sending updates about courses, resources, and services.

Legal basis: consent (where you opt in) and/or legitimate interests for limited “existing customer” communications where permitted by law.

You can opt out at any time (see section 6).

5.5 Website analytics and advertising (cookies)

Purpose: understand website usage and improve the site; measure advertising effectiveness.

Legal basis: consent for non-essential cookies (and legitimate interests for strictly necessary cookies).

5.6 Finance (where offered)

Purpose: if you choose to pay by finance, to support your application and administer the relationship with our finance provider.

Legal basis: taking steps to enter a contract and performance of a contract; and consent where required for specific sharing/cookies.

Important: the lender/finance provider will typically act as a separate data controller for the finance application and will provide their own privacy information.

6. Marketing

If you subscribe or opt in, we may send you marketing emails. You can unsubscribe at any time using the link in emails or by contacting us.

We do not sell your personal data.

7. Who we share your data with

We may share personal data with trusted third parties where necessary, including:

• Awarding bodies and certification organisations (where your course/qualification requires registration, assessment, moderation, or certificate issuance).
• Funding bodies and auditors (where a funded/subsidised programme requires it).
• Our learning platforms, IT, and hosting providers (to provide secure systems and services).
• Our CRM and marketing platforms (to manage enquiries, customer support, and opt-in communications).
• Analytics/advertising providers (only where you have consented to relevant cookies).
• Payment providers (to process payments).
• Finance provider(s) (only if you choose finance, and only what is necessary for the application/admin).

We require suppliers to protect personal data and only use it for the services they provide to us.

8. International transfers

Some of our service providers may process data outside the UK (and outside the EEA). When they do, we use appropriate safeguards (such as standard contractual clauses / the UK addendum and additional risk assessments) to protect your data.

9. How long do we retain your data

We retain personal data only as long as necessary for the purposes described above, including legal, contractual, training, awarding body, and funding requirements.

Typical retention periods are:

• Enquiries (no booking): up to 24 months from last contact
• Marketing records: until you unsubscribe/withdraw consent, then suppressed and minimised
• Course bookings, attendance, and learner records: typically 6 years after course completion (or longer where awarding bodies/funders require)
• Financial records (invoices, payments): typically 6 years (or as required by law)
• Finance applications (if applicable): as required to administer the finance option and meet regulatory/legal requirements (your finance provider will also set their own retention)

If you want more details for a specific programme (e.g., an apprenticeship or a funded scheme), contact us, and we’ll explain the relevant retention rules.

10. Your rights

You have rights under data protection law, including:

• access to your personal data
• correction of inaccurate data
• deletion (in certain circumstances)
• restriction of processing (in certain circumstances)
• data portability (in certain circumstances)
• objection to processing based on legitimate interests and to direct marketing
• withdrawal of consent (where we rely on consent)

To exercise your rights, contact us using the details in section 1. We may need to verify your identity before responding.

11. Cookies and similar technologies

We use cookies to:

• make the site work (e.g., preferences and basket functionality where relevant)
• remember consent choices
• analyse site usage and improve performance
• support advertising/measurement where enabled

You can manage cookies via your browser settings and (where available) our cookie banner/consent tool.

See also our Cookies Policy: https://www.tsw.co.uk/cookies-policy/

12. Analytics, advertising and third-party embeds

We may use analytics and advertising tools to understand how our website is used and to measure campaign effectiveness. If pages contain embedded content (e.g., videos), those providers may collect technical data via their own cookies—subject to your cookie choices and their privacy notices.

13. Comments and media uploads (WordPress)

13.1 Comments

If comments are enabled on any part of our site, we may collect the information shown in the comments form and technical data (e.g., IP address, browser user agent) to help spam detection.

13.2 Media

If you upload images to the website, avoid uploading images with embedded location data (EXIF GPS). All uploaded files are usually publicly accessible.

14. How we protect your data

We use appropriate organisational and technical measures to protect personal data, including (as appropriate):

• access controls and least-privilege permissions
• staff confidentiality and training
• secure systems and backups
• supplier due diligence and contractual protections
• encryption and secure transmission where available

No method of transmission/storage is 100% secure, but we work to protect your information and to minimise risk.

15. Data breach procedures

We maintain internal processes for identifying, assessing, and responding to suspected personal data breaches. Where required, we will notify the relevant regulator and affected individuals.

16. Children’s privacy

Our website and services are not designed for children under 13. If you believe a child has provided personal data without appropriate consent, contact us and we will take steps to delete it where applicable.

17. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top will show when changes were made.