Privacy & Cookie Policy

When we enter into a training agreement with your organisation, we may collect and process:

• Names and contact details of booking contacts and delegates
• Job roles and departments
• Health, safety and welfare information relevant to training delivery (for example, physical limitations or medical conditions that may affect participation in physical intervention training)
• Attendance records and training completion data
• Feedback and evaluation responses

Where client organisations provide us with delegate information, they do so as Data Controllers in their own right. Stand2 acts as a Data Processor in respect of that delegate data and handles it only for the purposes of delivering the contracted training.

StandPoint Platform Data

StandPoint is Stand2’s online learning platform, available to delegates and client organisations as part of our training programmes. When you access StandPoint, we may collect:

• Login credentials (securely stored and encrypted)
• Platform usage data, including content accessed and progress records
• Communications sent through the platform

This data is used to support your learning and to enable client organisations to manage their training records. It is not shared with any third party except where required by law or with the explicit consent of the client organisation.

Recruitment Data

If you apply for a role with Stand2, we collect:

• Contact details, employment history and qualifications
• Right to work documentation
• References and, where applicable, DBS check information

Recruitment data is used only for the purposes of assessing your application and is handled in accordance with section 7 of this policy.

Website and Analytics Data

Our website uses an anonymised version of Google Analytics to help us understand how visitors use the site. This data is collected only with your consent via our cookie banner. We do not use targeting or advertising cookies. See Section 9 for full details.

3. Legal Basis for Processing

We process personal data on the following legal bases under UK GDPR:

• Contract: To fulfil our obligations under a training agreement or service contract.
• Legitimate interests: To respond to enquiries, manage client relationships, and improve our services — where this does not override your rights and interests.
• Legal obligation: To comply with our obligations under employment law, tax law, health and safety legislation, and other applicable regulations.
• Consent: For marketing communications and non-essential cookies. You may withdraw consent at any time.

4. How We Use Your Information

We use personal data only for the purposes for which it was collected:

• Responding to enquiries and providing quotations
• Delivering training programmes and managing delegate records
• Administering the StandPoint platform
• Processing invoices and managing client accounts
• Communicating updates about our services (where you have consented)
• Complying with legal and regulatory obligations
• Improving our website and service delivery

We do not use your personal data for automated decision-making or profiling.

5. Sharing Your Data

Stand2 does not sell personal data. We do not share personal information with third parties for marketing purposes.

In limited circumstances, we may share data with:

• IT and system support providers who assist in operating our platforms — subject to data processing agreements
• Public authorities where we are required to do so by law
• Professional advisers (such as legal or financial advisers) where necessary

Where data is shared with third-party processors, we ensure appropriate contractual protections are in place.

6. Security of Your Information

We take the security of personal data seriously. Our measures include:

• SSL encryption for our website and email communications
• Two-factor authentication for access to administrative systems
• Role-based access controls limiting who can access personal data
• Regular software and security updates
• Password-protected devices and secure storage of physical records

7. How Long We Retain Your Data

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by law. Our standard retention periods are set out below.

Category of Data	Retention Period
Customer and training records	6 years after the last interaction or completion of services
Payment details	Duration of transaction only, unless required for legal or accounting purposes
Employee and recruitment records	6 years after employment ends or recruitment process concludes
Marketing and communication records	Until consent is withdrawn or you opt out
Website analytics data	12 months
Health, safety and welfare records	3–6 years depending on the nature of the record
Financial and invoicing records	6 years in compliance with HMRC requirements
StandPoint platform usage data	For the duration of the licence or service agreement, plus 6 years

After these periods, personal data is securely deleted or irreversibly anonymised.

8. Marketing and Communication Preferences

Stand2 may contact you about our training services, new programmes, and relevant updates in the following circumstances:

Where you have contacted us for a quotation, expressed interest in our services, or engaged us as a client, we may send you relevant communications on the basis of our legitimate interests as a business – specifically, to keep you informed about services that are directly relevant to your enquiry or your organisation’s training needs. This is a common and lawful basis for business-to-business marketing communications under UK GDPR.

Where you have explicitly opted in to receive our newsletter or marketing updates, we will process your data on the basis of your consent.

In either case, you have the right to opt out of marketing communications at any time, at no cost and without providing a reason, by:

• Clicking the unsubscribe link in any email we send you
• Contacting us directly at [email protected]

We will action all opt-out requests promptly. Opting out will not affect any communications that are necessary to fulfil a contract or service agreement with you, such as joining instructions, invoices, or training confirmation emails.

9. Cookies and Website Tracking

What Are Cookies?

Cookies are small text files placed on your device when you visit our website. They help us understand how our site is used and improve your experience.

Cookies We Use

• Essential cookies: Required for the website to function correctly. These cannot be disabled.
• Performance cookies: Collect anonymised data to help us understand how visitors use our site (via Google Analytics, anonymised). These are only placed with your consent.
• Functional cookies: Remember your preferences to improve your experience.

We do not use targeting or advertising cookies.

Managing Cookies

You can manage or disable non-essential cookies at any time via the cookie settings on our website, or through your browser settings. Please note that disabling certain cookies may affect your experience of our site. For further guidance, visit the ICO’s cookies guidance at ico.org.uk.

10. Your Rights Under Data Protection Law

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access: To request a copy of the personal data we hold about you.
• Right to rectification: To request correction of inaccurate or incomplete data.
• Right to erasure: To request deletion of your personal data where there is no legitimate reason for us to continue processing it.
• Right to restriction: To request that we limit how we process your data in certain circumstances.
• Right to object: To object to processing based on legitimate interests.
• Right to data portability: To receive your data in a structured, commonly used format.

To exercise any of these rights, contact us at [email protected]. We will respond within one calendar month of receiving your request. We may need to verify your identity before processing your request.

11. How to Make a Complaint

If you have concerns about how we handle your personal data, please contact us in the first instance using the details below. We will do our best to resolve your concern promptly.

If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

• Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
• Telephone: 0303 123 1113
• Website: ico.org.uk

12. How to Contact Us

For any questions about this policy, or to exercise your data protection rights, please contact us:

• Email: [email protected]
• Address: Stand2, Waterside, Basin Road, Worcester, WR5 3DA

 

This policy is reviewed annually and updated as necessary to reflect changes in our practices or applicable law.