Privacy Policy

What is personal data?

Personal data is any information about a person which identifies them, either directly or indirectly.

What personal data do we collect?

We collect the following types of personal data:

• Identity information — such as name, date of birth, and nationality.
• Contact information — such as email address, telephone number, and postal address.
• Learner and qualification data — such as course enrolment, assessment results, and certificate records, submitted by our partner training institutes.
• Financial data — such as payment details processed when partners pay certification fees.
• Preference information — such as marketing and newsletter subscription preferences.

We do not knowingly collect sensitive data or data relating to children under 16.

How do we collect your personal data?

We collect this data when you interact with us through our website — for example, when you submit a partner application, register learners through our partner portal, subscribe to our newsletter, request certificate verification, or send us correspondence.

How and why do we use your personal data?

In accordance with data protection law, we can only use your personal data if we have a legal basis for doing so. We use personal data for the following reasons:

• To provide our certification, verification, and awarding body services to partner institutes and learners. Our legal basis is the performance of a contract, or to take steps before entering into a contract.
• To issue, record, and verify OSHEM certificates and maintain the integrity of our credential register. Our legal basis is our legitimate interests and the performance of a contract.
• To ensure that the website operates effectively and securely. Our legal basis is our legitimate interests.
• To make and receive payments. Our legal basis is the performance of a contract.
• To send you newsletters and updates where you have requested them. Our legal basis is consent.

Marketing

We will send you promotional communications, such as our HSE newsletter, only if you have requested information or subscribed. You can opt out at any time by following the opt-out links in any communication we send you. If you opt out, you will still receive essential communications relating to services we provide to you.

Do we share your personal data?

We only share personal data with third-party service providers where necessary — for example, payment processors and email delivery services. We will obtain your express consent before sharing your data with any third party for their own marketing purposes.

Where we share your personal data, we do so only where we are satisfied that the third party will take appropriate steps to protect it and that its use is limited to acting on our instructions. We may also share personal data with legal and regulatory bodies where necessary to comply with the law.

International transfers

Where we transfer your personal data outside the United Kingdom, we ensure appropriate safeguards are in place in accordance with UK data protection law.

Third-party links

Our website may include links to third-party websites or content, including live news feeds from external health and safety organisations. We have no control over these, so you should read the privacy policy of any third-party site you visit.

Is your personal data secure?

We take the security of your data seriously and have put in place appropriate measures to protect it. We limit access to your personal data to those who need it for business purposes, and they are subject to confidentiality obligations.

How long do we keep your personal data?

We only keep your personal data for as long as reasonably necessary to fulfil the purposes for which it was collected. We keep records of certificates, orders, and payments for a period of six years after our relationship with you has ended, in line with UK legal and accounting requirements.

Your legal rights

Under data protection law, you have the following rights:

• The right to be provided with a copy of the personal data we hold about you.
• The right to request correction of inaccurate or incomplete data.
• The right to request erasure of your personal data in certain circumstances.
• The right to object to, or request restriction of, our processing of your data.
• The right to data portability.
• The right to withdraw consent at any time where we rely on consent.

To exercise any of these rights, please contact us using the details below. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection, at ico.org.uk.