Privacy Notice

Total Training Solutions & Consultancy Ltd respects your privacy and is committed to protecting your personal information.

This Privacy Notice explains what information we collect, how and why we use it, who we may share it with, how long we keep it and the rights available to you.

1. Who we are

Total Training Solutions & Consultancy Ltd is the controller responsible for the personal information described in this notice.

Company name: Total Training Solutions & Consultancy Ltd
Company number: 07261706
ICO registration number: available on request

You can contact us about privacy or data-protection matters using:

Email: info@totaltraining.me.uk
Telephone: 01494 771935, Monday to Friday, 9am–5pm

Postal address:

We do not have a formally appointed Data Protection Officer. Privacy enquiries are handled by Total Training.

2. Who this notice applies to

This notice applies to:

• customers purchasing training for themselves;
• managers and organisations purchasing training for staff;
• learners completing e-learning, Live Zoom or classroom training;
• people who create or use an account;
• people who contact us with an enquiry or complaint;
• people who subscribe to our marketing communications;
• visitors to our website; and
• trainers, suppliers and other business contacts where applicable.

3. Information we may collect

The information we collect depends on how you interact with us.

Customer and manager information

We may collect:

• name;
• email address;
• telephone number;
• organisation name;
• job title or role;
• billing address;
• account login details;
• orders, bookings and subscription information;
• invoices and payment status;
• correspondence, enquiries and complaints; and
• marketing preferences.

Learner information

We may collect:

• full name;
• email address, where supplied;
• telephone number, where supplied;
• home address, where required;
• date of birth, where required;
• employer or organisation;
• job title or role;
• account and login information;
• courses assigned or booked;
• Live Zoom and classroom attendance;
• e-learning progress;
• assessment answers and results;
• completion history;
• certificates;
• renewal and expiry dates;
• communications with our team; and
• support enquiries.

We do not normally hold completed Care Certificate workbooks, workplace competency assessments or employer Care Certificate sign-off records. These remain the responsibility of the learner’s employer or manager.

Technical information

Our website, platform and service providers may generate limited technical and security records, such as:

• dates and times of account access;
• login and security events;
• website cookie preferences;
• pages or services accessed; and
• information necessary to diagnose faults or protect the platform.

Further information about website cookies is available in our Cookie Policy and cookie preference centre.

4. Where we obtain information

We may obtain personal information:

• directly from you;
• from a manager or employer who creates a learner account;
• from an organisation purchasing training for its staff;
• through our website, account area or contact forms;
• when a learner completes training or an assessment;
• during a Live Zoom or classroom session;
• through emails, telephone calls or other correspondence;
• through our marketing sign-up forms; and
• from payment and accounting providers when processing a transaction.

Where a manager or employer creates an account for a learner, they are responsible for ensuring that they are permitted to provide the learner’s information to us and that the learner is made aware of this Privacy Notice.

Where a learner email address is supplied, we may use it to send essential account, booking, training and certificate communications.

5. How and why we use personal information

We use personal information to:

• create and administer customer and learner accounts;
• accept and process orders;
• manage subscriptions and recurring payments;
• assign and provide e-learning;
• book learners onto Live Zoom and classroom sessions;
• send joining instructions and training reminders;
• record attendance, progress and assessment results;
• issue and store certificates;
• calculate whether training is up to date, due soon or overdue;
• provide access to the Manager Dashboard;
• respond to enquiries and provide customer support;
• investigate concerns and complaints;
• provide reasonable adjustments;
• manage safeguarding concerns;
• maintain the security and operation of our website and platform;
• prevent misuse, unauthorised account sharing and fraud;
• maintain financial and business records;
• comply with legal, tax, safeguarding and regulatory responsibilities;
• improve our training, website and services; and
• send marketing where we have permission or another lawful basis to do so.

6. Our lawful bases

We rely on different lawful bases depending on why information is being used.

Contract

We use personal information where it is necessary to:

• process an order;
• provide training;
• administer an account;
• manage a booking or subscription;
• issue a certificate; or
• provide customer support connected with a purchase.

Legal obligation

We may use or retain information where necessary to comply with legal responsibilities, including:

• financial and tax record keeping;
• responding to lawful requests;
• protecting legal rights; and
• meeting applicable safeguarding responsibilities.

Legitimate interests

We may use information where it is necessary for our legitimate business interests and those interests are not overridden by the individual’s rights.

These interests may include:

• operating and improving our training services;
• managing customer relationships;
• securing our website and platform;
• preventing fraud and misuse;
• maintaining appropriate business records;
• responding to complaints;
• understanding how our services are used; and
• communicating with business contacts about relevant services.

Consent

We rely on consent where appropriate, including for:

• optional email marketing;
• some non-essential cookies; and
• certain health, disability or reasonable-adjustment information.

Consent can be withdrawn at any time, although this will not affect processing that took place before consent was withdrawn.

Vital interests and substantial public interest

In exceptional circumstances, we may process or share information where necessary to protect someone from serious harm or deal with a safeguarding concern.

7. Health, disability and reasonable-adjustment information

A learner or customer may occasionally tell us about a health condition, disability or accessibility requirement so that we can consider a reasonable adjustment.

This information is normally provided by email and is not routinely stored in the learner’s online account.

We will:

• collect only the information reasonably needed;
• limit access to people who need it;
• use it to consider and provide suitable adjustments;
• avoid sharing unnecessary medical details; and
• delete it when it is no longer required, unless it must be retained for a complaint, safeguarding issue or legal reason.

Because health information receives additional legal protection, we will identify both a lawful basis and an appropriate special-category condition before using it.

Depending on the circumstances, this may include explicit consent, employment or social-protection obligations, safeguarding, legal claims or protection of vital interests.

8. Safeguarding information

If a learner makes a safeguarding disclosure or a concern arises during training, we may create a written safeguarding record.

We may use or share relevant information with:

• the learner’s employer or manager;
• a local authority safeguarding service;
• the police;
• emergency services;
• a regulator; or
• another appropriate organisation.

We will consider the nature of the concern, the level of risk, confidentiality and our legal and safeguarding responsibilities.

Safeguarding records will be kept securely and only for as long as reasonably necessary, taking account of the nature of the concern, safeguarding guidance and any legal or evidential need.

9. Learners under 18

Our training may be used by learners aged 16 or 17, usually through an account created by their employer.

Young learners have the same data-protection rights as adults. We aim to describe our use of their information in clear and understandable language.

Where a learner is under 18:

• the employer remains responsible for deciding whether the training is suitable;
• we will take additional care when handling their information;
• we will not use their information for marketing without an appropriate lawful basis; and
• safeguarding information may be shared where necessary to protect them or another person.

A young learner may contact us directly to ask questions about their information or exercise their data-protection rights.

10. Manager access to learner information

Managers who are authorised by an organisation can access information relating to learners connected with that organisation.

This may include:

• training assigned;
• booking and attendance information;
• course progress;
• assessment results;
• completed and incomplete training;
• certificates;
• training history;
• renewal dates; and
• whether training is up to date, due soon, in progress or overdue.

Managers may also create learner accounts and assign or book training.

The organisation is responsible for:

• deciding which managers are authorised to access learner information;
• keeping manager account details secure;
• removing access when it is no longer required;
• using learner information appropriately; and
• meeting its own obligations as an employer and data controller.

11. Payments and subscriptions

Online payments and recurring subscription payments are processed by Opayo.

Payment-card details are entered into the payment provider’s secure environment. Total Training does not store full payment-card details.

We may retain:

• transaction references;
• payment status;
• amount and date paid;
• invoice and billing information;
• refund information;
• subscription plan and payment history; and
• limited information required to investigate a failed or disputed payment.

We use FreeAgent for accounting and financial record keeping.

12. Live Zoom training

Live Zoom sessions are provided using Zoom.

We may use Zoom to process:

• learner name;
• email address, where required;
• session date and time;
• attendance and joining information;
• chat or participation information; and
• technical information required to provide the session.

Live Zoom sessions are not normally recorded by Total Training.

Learners must not record, photograph or redistribute a session without our prior written permission.

13. Marketing communications

We use Mailchimp to manage email marketing subscriptions and communications.

You may join our mailing list through:

• the Mailchimp sign-up form on our website; or
• an optional marketing choice during account creation or checkout.

Marketing consent is optional and is not required to create an account or purchase training.

Where you opt in, we may send occasional emails about:

• care training news and guidance;
• new courses or services;
• updates to our training;
• bundles and subscriptions; and
• relevant promotions or offers.

You can unsubscribe at any time by:

• using the unsubscribe link in any marketing email; or
• contacting us at info@totaltraining.me.uk.

We may keep a minimal suppression record after an unsubscribe so that we can respect the request and avoid adding the address back to the mailing list accidentally.

Service communications about an account, payment, training booking, certificate or subscription are not marketing and may still be sent where necessary.

14. Who we share information with

We may share personal information with trusted service providers where necessary to run our organisation and provide training.

These may include:

• Opayo for payment processing;
• FreeAgent for accounting;
• Zoom for Live Zoom training;
• Mailchimp for email marketing;
• Hi Hosting for email services;
• UK-based website, platform, database and hosting providers;
• IT, backup, cybersecurity and development support providers;
• trainers delivering our courses;
• professional advisers, insurers and legal representatives;
• HM Revenue & Customs and other public authorities;
• safeguarding organisations, police or emergency services; and
• regulators or courts where disclosure is required.

Service providers may only use information for the agreed purpose and must protect it appropriately.

We do not sell personal information to advertisers or unrelated third parties.

15. International transfers

Our website and main training platform are hosted in the United Kingdom.

Some external providers, including Zoom and Mailchimp, may process information outside the United Kingdom or use international support infrastructure.

Where personal information is transferred outside the UK, we will ensure that an appropriate protection is available. Depending on the destination and provider, this may include:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved standard contractual clauses; or
• another safeguard permitted by data-protection law.

Further information about a provider’s processing and international-transfer arrangements can be found in that provider’s privacy information.

16. How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, safeguarding and complaint-handling requirements.

Our usual retention periods are:

We may keep information for longer where:

• a legal claim is anticipated or ongoing;
• there is a safeguarding requirement;
• a regulator or authority requires it;
• the individual asks us to preserve it; or
• another legal obligation applies.

We may anonymise information so that it no longer identifies an individual. Anonymised information may be retained for statistical, service-development or reporting purposes.

17. Cookies

Our website uses cookies and similar technologies.

Some cookies are essential for:

• website operation;
• account login;
• shopping basket functions;
• security;
• payment processing; and
• remembering cookie choices.

Other cookies may support website analytics, embedded services or marketing and will only be used in accordance with the choices available through our cookie banner.

The website should provide clear options to:

• accept non-essential cookies;
• reject non-essential cookies; or
• manage cookie preferences.

Further information about the specific cookies, providers, purposes and durations should be available in our separate Cookie Policy or cookie preference centre.

18. Information security

We use appropriate organisational and technical measures to protect personal information.

These measures may include:

• access controls and password protection;
• limiting access according to role;
• secure UK-based hosting;
• encrypted connections;
• system monitoring and backups;
• staff confidentiality;
• platform updates and maintenance; and
• procedures for responding to suspected data breaches.

No online system can be guaranteed to be completely secure. Customers and learners must also protect their passwords and tell us promptly if they believe an account has been accessed without permission.

19. Automated processing

The Manager Dashboard may automatically calculate and display training statuses, such as:

• up to date;
• due soon;
• in progress; or
• overdue.

We may also automatically send booking, progress and renewal reminders.

These functions support training administration. We do not currently make solely automated decisions about individuals that produce legal or similarly significant effects.

20. Your data-protection rights

Depending on the circumstances and lawful basis used, you may have the right to:

• be informed about how your information is used;
• ask for access to your personal information;
• ask us to correct inaccurate or incomplete information;
• ask us to erase information;
• ask us to restrict how information is used;
• object to certain uses of information;
• receive certain information in a portable format;
• withdraw consent where processing is based on consent; and
• complain about how your information has been handled.

These rights are not absolute and may not apply in every situation.

We may need to verify your identity before responding to a request. We will normally respond within the period required by data-protection law.

A request can be made by emailing info@totaltraining.me.uk.

21. Complaints

Please contact us first if you have concerns about how we have handled your information. We will try to resolve the matter.

You also have the right to complain to the UK data-protection regulator:

Information about making a complaint is available through the ICO’s website.

22. Links to other websites

Our website may contain links to external websites and services.

We are not responsible for the privacy practices of another organisation. You should read the external organisation’s privacy notice before providing personal information.

23. Changes to this notice

We may update this Privacy Notice when our services, suppliers or legal responsibilities change.

The latest version will be published on our website with the date it was last updated.

Where a change is significant, we may also notify account holders by email or through the website or Manager Dashboard.