Privacy Policy

CSS Safety Training & Consultancy (“CSS”, “we”, “us”, “our”) is committed to protecting your personal information. This Privacy Policy explains what information we collect when you use this website, contact us, or book a course or consultancy service, how we use it, who we share it with and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

For the purposes of data protection law, the data controller is: [Registered company name, company number and registered office address, to be confirmed by CSS].

Last updated: September 2026.

We collect information in the following ways:

When you make an enquiry. If you use the contact form, a consultancy enquiry form or a course enquiry form, we collect your name, email address, telephone number, company name (if given) and the content of your message.

When you request a group booking. In addition to your contact details, we record the course you are interested in, your preferred start date and the number of attendees.

When you book a course online. To complete a booking you create a customer account. We collect your name, email address, telephone number, company name, billing address, the address where training is to be delivered (where applicable), the course, dates and number of attendees you have booked, and your order and booking history. Your account password is stored in encrypted (hashed) form and is never visible to us.

When you pay online. Payments are processed by our payment provider, Stripe. Your card details are entered into a secure form provided by Stripe and are not stored on our website. We receive confirmation of payment and a reference, not your full card number.

Information about attendees. To deliver a course and issue certificates we may need details of the people attending, such as their names. If you provide information about other people, you confirm that you are entitled to share it with us.

When you subscribe to our mailing list. We collect your email address.

Automatically, when you browse. Our web server and booking system record technical information such as your IP address, browser type, the pages you visit and how you arrived at our site. See our Cookie Policy for details of the cookies involved.

We use your information to:

• respond to your enquiries and provide quotations (our legitimate interest in running our business, and taking steps at your request before entering into a contract);
• take, manage and deliver course bookings and consultancy services, including scheduling trainers, confirming dates and issuing certificates (performance of a contract with you);
• register attendees with the relevant accredited awarding body so that qualifications can be certified (performance of a contract, and our legal and regulatory obligations as an approved training provider);
• process payments, issue invoices and keep accounting records (performance of a contract and our legal obligations);
• manage your customer account and communicate with you about your bookings (performance of a contract);
• send you news and offers by email where you have asked us to (your consent, which you can withdraw at any time);
• keep our website secure, prevent spam and fraud, and understand how the site is used (our legitimate interests);
• comply with legal obligations and respond to lawful requests from authorities.

We do not sell your personal information. We share it only where necessary with:

• Accredited awarding bodies and course providers: the organisations that accredit and certificate the courses we deliver, so that attendees can be registered and certificates issued.
• Payment provider: Stripe, which processes online card payments on our behalf.
• Service providers that host our website, provide our booking system, send our emails and support our IT, acting as processors under contract and only on our instructions.
• Our trainers and consultants, who receive the booking details they need to deliver your course or service, including the training address and contact details.
• Professional advisers such as accountants, insurers and legal advisers where necessary.
• Regulators, courts and law enforcement where we are required to by law.

Our website also embeds content from Vimeo (videos), Google (the map on our contact page and web fonts) and Cloudflare (icon files). When those features load, the provider receives your IP address and may set its own cookies, as explained in our Cookie Policy.

Our website uses a small number of cookies to make online booking and customer accounts work, to protect our forms and to record how visitors arrive at our site. Full details, including how to control cookies in your browser, are in our Cookie Policy.

We keep personal information only for as long as we need it for the purposes described above, after which it is deleted or anonymised. In general:

• Enquiries: kept for as long as needed to deal with your enquiry and for a reasonable period afterwards in case you return to us: [retention period to be confirmed by CSS].
• Bookings, accounts and payment records: kept for the life of your customer account and for at least six years after the transaction, as required for accounting and tax purposes.
• Training and certification records: kept for the period required by the relevant awarding body and our regulatory obligations: [retention period to be confirmed by CSS].
• Mailing list: until you unsubscribe or ask us to remove you.

This website is served over an encrypted (HTTPS) connection. Access to customer and booking information is restricted to staff and providers who need it to do their jobs, and account passwords are stored in hashed form. Card payments are handled by Stripe, a PCI DSS compliant payment provider, so that card details never pass through our own systems.

No method of transmission over the internet is completely secure, but we take reasonable technical and organisational measures to protect your information against unauthorised access, loss or misuse.

We are based in the United Kingdom and store your information here. Some of the providers we use (for example Stripe, Vimeo and Google) may process information outside the UK. Where that happens we rely on the safeguards recognised under UK data protection law, such as UK adequacy regulations or the International Data Transfer Agreement / standard contractual clauses.

Under UK data protection law you have the right to:

• be informed about how we use your information (this policy);
• request access to a copy of the personal information we hold about you;
• ask us to correct information that is inaccurate or incomplete;
• ask us to delete your information, where we no longer have a lawful reason to keep it;
• ask us to restrict how we use your information in certain circumstances;
• object to processing based on our legitimate interests, and to direct marketing at any time;
• receive the information you gave us in a portable format;
• withdraw consent at any time where we rely on your consent.

To exercise any of these rights, contact us using the details below. We will respond within one month and may need to confirm your identity first. Please note that we may need to keep some information, for example booking and financial records, to meet our legal obligations.

If you are unhappy with how we have handled your information you have the right to complain to the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113. We would appreciate the chance to resolve your concern first.

This website and our booking services are intended for adults. We do not knowingly collect personal information from children through this website. Where a course is delivered to under-18s, the booking is made by and information is collected from a responsible adult or organisation.

Our website contains links to other websites, including those of the awarding bodies and organisations we work with. This policy applies only to our website; we are not responsible for the privacy practices of other sites and encourage you to read their policies.

We may update this Privacy Policy from time to time. Changes will be published on this page with a revised “last updated” date, and where the change is significant we will take reasonable steps to bring it to your attention.

Questions about this policy, or requests to exercise your rights, should be sent to:

CSS Safety Training & Consultancy
Regional bases in Birmingham & Derby, delivering nationwide
Postal address: [Registered office / postal address, to be confirmed by CSS]
Email: enquiries@cssconsultancy.com
Phone: 0800 002 5869