Privacy & Data Protection Policy

Last updated: 25 September 2026

This policy explains how Wilson Training Services Limited ("we", "us", "our"), a company registered in England and Wales, collects and uses personal data when you use this website or contact us, and the rights you have under UK data protection law (the UK GDPR and the Data Protection Act 2018).

Wilson Training Services Limited is the data controller for the personal data described here.

The information we collect

We collect only what we need to answer you and to deliver training and qualifications.

General enquiries (the contact form): your name, phone number, email address, the course you are interested in and anything you write in the message.
NVQ enrolment (the enrolment form): the above plus your date of birth, home address, emergency contact name and number, who you currently work for and since when, your employment status and job details, any construction cards or tickets you already hold and their reference numbers, the machines you want your NVQ in, and whether you carry out groundworks. A photo of your ID (driving licence, passport or birth certificate) is required so we can register you with the awarding body; you can also tell us which ID type you will provide and attach photos of any construction cards you hold. Uploaded photos reach us by email, are used only to process your enrolment, and are deleted once it has been processed. They are not stored.
Team enrolment (the employer form): your company name and your own name, phone and email, and the spreadsheet or training matrix you upload. That file contains personal data about your operators, such as their names and the information needed to check NVQ and funding eligibility. See "If you send us other people's details" below.
Newsletter sign-up (the pop-up): your email address only, and only if you choose to subscribe.
Technical and security data: when you submit a form we record the time and the IP address the submission came from, to help prevent spam and abuse. See "Cookies and similar technologies".

We do not ask for special category data (such as health information) through this website. If a specific funding scheme requires it, we will collect it separately and tell you why at the time.

Why we use it, and our lawful basis

To respond to an enquiry and give you the information you asked for. Lawful basis: our legitimate interests in dealing with enquiries about our services, and taking steps at your request before entering into a contract.
To process a training booking or NVQ enrolment, register you with the awarding body, arrange assessment and issue your certificate or card. Lawful basis: performance of a contract with you, and compliance with our legal and regulatory obligations (including funding and awarding-body record-keeping).
To handle a team enrolment for an employer and set up each operator's qualification. Lawful basis: performance of our contract with the employer, and our and the employer's legitimate interests in arranging the training; compliance with awarding-body and funding rules.
To send you course and funding updates by email, if you signed up. Lawful basis: your consent, which you can withdraw at any time using the unsubscribe link in any email.
To keep the site and our forms secure and prevent spam and fraud. Lawful basis: our legitimate interests in protecting our systems and the people who contact us.

Where your information goes

We do not sell your personal data. We share it only with the following, and only as far as needed:

Cloudflare, Inc. hosts this website and runs the service that receives our form submissions, and provides the "Turnstile" check that tells humans from bots.
Resend delivers each form submission to us by email.
Meta Platforms Ireland Ltd (Facebook and Instagram), only if you accept advertising cookies. See "Cookies and similar technologies".
Mailchimp (Intuit Inc.) holds our marketing audience. Newsletter subscribers are added there. People who only make an enquiry or an enrolment are recorded as non-marketing contacts and are not sent campaigns unless they separately opt in.
Awarding bodies and funding administrators (for example Qualifications Scotland, formerly the SQA, and the relevant funding scheme), where this is needed to register you for and award your qualification.
Professional advisers, and public authorities or regulators, where we are required to share information by law.

Some of these providers are based outside the UK, including in the United States. Where personal data is transferred outside the UK we rely on an approved safeguard, such as UK "adequacy" regulations or the International Data Transfer Agreement / EU Standard Contractual Clauses with the UK Addendum, together with each provider's own data protection commitments.

If you send us other people's details

When an employer uses the team enrolment form, they give us personal data about their operators. If you are an operator whose details were submitted by your employer: we use that information only to check your eligibility and to arrange and award your NVQ, on the lawful bases set out above. We ask every employer to confirm they have your permission and have told you their details are being shared with us for this purpose. Your rights, set out below, apply to this information in the same way. If you want to know what we hold or ask us to correct or delete it, contact us using the details at the end of this policy.

Cookies and similar technologies

We only use advertising cookies if you say yes. The first time you visit, a small bar asks you to accept or reject them, and nothing from Meta or Google loads until you click "Accept". You can change your mind at any time using the "Cookie settings" link at the bottom of every page. What we use:

Cloudflare Turnstile may store a short-lived token in your browser to confirm you are a real person when you use a form. This is strictly necessary for the form to work securely and needs no consent.
Cloudflare Web Analytics gives us anonymous, aggregated page-view counts. It sets no cookies, does not use fingerprinting and does not track you across sites.
Meta Pixel (only if you accept): a piece of code from Meta Platforms Ireland Ltd that tells us which of our Facebook and Instagram ads led people to this website and to our enquiry forms, so we can measure and improve our advertising. It sets the _fbp cookie (kept for up to 90 days) and, if you arrived from an ad, _fbc (up to 90 days). It sends Meta the pages you view, your IP address and browser details, and a note when you complete an enquiry, enrolment or newsletter form (not what you typed into it). Meta may use this in line with its own privacy policy. Lawful basis: your consent.
Google Analytics (only if you accept): a tag from Google Ireland Ltd that shows us how visitors find and use this website, including which of our Google ads brought them here, so we can improve the site and our advertising. It sets the _ga and _ga_<ID> cookies (kept for up to 2 years) and, if you arrived from a Google ad, _gcl_au (up to 90 days). It sends Google the pages you view, your IP address and browser details, and a note when you complete an enquiry, enrolment or newsletter form (not what you typed into it). Google may use this in line with its own privacy policy. Lawful basis: your consent.
Local storage: your browser keeps two small flags: one so the newsletter pop-up does not reappear during the same visit, and one that remembers your cookie choice. They are not shared with us or anyone else.

How long we keep it

Enquiries that do not lead to a booking: up to 12 months, then deleted.
Enrolment and qualification records: for the duration of your training and then for the period we are required to keep them by the awarding body and by our funding and audit obligations (typically up to 6 years), after which they are deleted or anonymised.
Uploaded team spreadsheets: kept only while we set up the enrolments, then removed from our inbox. The enrolment data taken from them is kept as above.
Newsletter subscribers: until you unsubscribe, or after a long period of inactivity.

Your rights

Under UK data protection law you have the right to ask us to: give you a copy of the personal data we hold about you; correct anything that is wrong; delete it; restrict or object to how we use it; and, where it applies, provide it in a portable format. Where we rely on consent, you can withdraw it at any time. We do not make decisions about you by automated means alone. To exercise any of these rights, contact us using the details below. We will respond within one month.

Complaints

If you are unhappy with how we have handled your personal data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF; helpline 0303 123 1113; ico.org.uk/make-a-complaint.

Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last changed. Significant changes will be highlighted on this page.

How to contact us

For any data protection question or request, contact [email protected] or write to: Data Protection, Wilson Training Services Limited, Office Suite 107, West Retford Hall, Rectory Road, Retford, Nottinghamshire DN22 7AY.