Privacy Notice

1. Who we are

Allan Shaw Experience First Aid provides first-aid, workplace safety and mental-health training courses.

For data-protection purposes, Allan Shaw, trading as Allan Shaw Experience First Aid is the controller of the personal information described in this notice.

Contact details

Allan Shaw Experience First Aid
17 Long Lane
Banks
Southport
Merseyside
PR9 8EX
United Kingdom

Email: info@ashawexperiencefirstaid.co.uk
Telephone: 07958 261242
Website: https://ashawexperiencefirstaid.co.uk/

2. Information we collect

Depending on how a person contacts us or uses our services, we may collect:

• Name, email address, telephone number and postal or billing address.
• Information about courses booked or attended.
• Names and contact details of course participants.
• Booking, order, invoice and payment information.
• Payment status and limited payment information supplied by our payment provider. We do not receive or store complete card numbers.
• Information needed to administer training, assessments and certificates.
• Correspondence and enquiries.
• Website account details.
• Technical information such as IP address, device, browser and website activity.
• Optional information about accessibility, dietary or other practical course arrangements.

People should provide only the information reasonably necessary for us to make an arrangement. Some accessibility or dietary information may reveal information about health, disability or religious beliefs and may therefore be treated as special-category personal data.

3. Information about other participants

A person or organisation making a group booking may provide ordinary contact and course-registration information about other participants.

Bookers must have authority to provide these details and should ensure participants are given access to this Privacy Notice.

Bookers must not enter another participant’s diagnosis, medical history, disability details, religious beliefs or other sensitive personal information into the booking form. The participant should contact us directly if sensitive information needs to be discussed.

4. How we use personal information

We may use personal information to:

• Respond to enquiries and provide course information.
• Process and confirm bookings.
• Take and reconcile payments.
• Deliver courses and provide joining information.
• Manage participant numbers, venues and course arrangements.
• Make requested accessibility or dietary arrangements.
• Record attendance, assessments and course outcomes.
• Issue, replace or verify certificates.
• Meet relevant awarding, accreditation or certification requirements.
• Maintain accounting, tax and transaction records.
• Process refunds and payment disputes.
• Prevent fraud and protect our website and services.
• Respond to complaints and establish, exercise or defend legal claims.
• Comply with legal, regulatory and safeguarding obligations.
• Understand website usage where the visitor has consented to analytics cookies.

We do not sell personal information.

5. Our lawful bases

We rely on one or more of the following lawful bases:

Contract: to respond to booking requests, administer bookings and deliver purchased courses.

Legal obligation: to meet applicable tax, accounting, regulatory, safeguarding and legal requirements.

Legitimate interests: to administer and improve our services, maintain appropriate training records, prevent fraud, secure our systems and respond to complaints or legal claims, after considering the effect on individual rights.

Consent: for optional analytics cookies and, where appropriate, optional accessibility, dietary or health-related information. Consent may be withdrawn at any time without affecting processing that took place before withdrawal.

Where optional information is special-category data, we rely on explicit consent under Article 9(2)(a) of the UK GDPR unless another documented condition applies.

6. Accessibility, dietary and health-related information

People do not normally need to provide a diagnosis or medical history when booking.

If a participant chooses to provide information about an accessibility, dietary or health-related requirement, we use it only to make suitable arrangements for the course, respond to the participant’s request or protect participants where necessary.

Access is restricted to people who need the information. We normally delete this information within 30 days after the course unless it must be retained for an incident, complaint, safeguarding matter or legal claim.

A participant may contact us directly if they prefer to discuss a requirement outside the online booking form.

7. Payments and Stripe

Online card payments are processed by Stripe. Stripe may receive information including the customer’s name, contact and billing details, transaction amount, payment information, IP address and device information.

We do not receive or store complete card numbers.

Stripe may process information as our service provider and for its own legal, security and fraud-prevention purposes. Further information is available at https://stripe.com/gb/privacy.

8. Who we share information with

Where reasonably necessary, recipients may include:

• Stripe and other payment-service providers.
• Website hosting, email and IT-service providers.
• Accountants, bookkeepers and professional advisers.
• HM Revenue & Customs and other authorities where legally required.
• Relevant awarding, accreditation or certification bodies where required for registration, certification, quality assurance, verification or audit. Depending on the course, these may include FAIB or REC.
• Venues, trainers or assessors involved in delivering the course.
• Law-enforcement bodies, courts, regulators or insurers where required by law or necessary to protect legal rights.

Service providers acting on our behalf must protect personal information and use it only for the agreed purpose.

9. International transfers

Some providers, including Stripe and any future analytics or cloud-service providers, may process information outside the United Kingdom.

Where this happens, we take reasonable steps to ensure an appropriate transfer safeguard is in place.

10. How long we keep information

Normal retention periods are:

• Unsuccessful enquiries: up to 12 months after the last contact.
• Booking, order, invoice and payment records: normally six years after the end of the relevant accounting period.
• Attendance, assessment and certification records: for the period required by the relevant course or certification arrangement, commonly between three and five years.
• Optional accessibility, dietary or health-related information: normally deleted within 30 days after the course.
• Account information: while the account remains active and for a reasonable period afterwards.
• Complaints and legal correspondence: for as long as reasonably necessary to resolve the matter and meet applicable limitation periods.
• Analytics information: according to the retention period disclosed in the Cookie Policy and analytics configuration.

Information may be retained longer where required by law, an investigation, safeguarding requirement, active dispute or legal claim.

11. Cookies and website analytics

The website uses cookies and similar technologies.

Some cookies are necessary for the website, basket, checkout, security and payment process to operate. These cannot normally be disabled through the cookie controls.

Google Analytics may be introduced to understand how visitors use the website. Google Analytics must not be activated until the visitor has consented to analytics cookies. Visitors must be able to reject analytics cookies and continue using the website.

Cookie choices may be changed or withdrawn through the website’s cookie settings. Individual cookies, providers and durations are described in the Cookie Policy.

12. Security

We use appropriate organisational and technical measures designed to protect personal information against loss, misuse, unauthorised access, alteration or disclosure.

No internet service can be guaranteed to be completely secure. People should contact us promptly if they believe information they have provided may have been compromised.

13. Your rights

Depending on the circumstances, individuals may have the right to:

• Request a copy of their personal information.
• Correct inaccurate or incomplete information.
• Request deletion.
• Request restriction of processing.
• Object to processing based on legitimate interests.
• Receive certain information in a portable format.
• Withdraw consent where processing is based on consent.
• Complain to the Information Commissioner’s Office.

Some rights are subject to legal exceptions. For example, transaction information may need to be retained for tax and accounting purposes.

Requests should be sent to info@ashawexperiencefirstaid.co.uk.

14. Complaints

Please contact us first with any concerns so that we can try to resolve the matter.

A complaint may also be made to the Information Commissioner’s Office: https://ico.org.uk/make-a-complaint/data-protection-complaints/

15. Changes to this notice

We may update this notice when our services, legal obligations or use of technology changes.

The latest version will be published on our website with its effective date.