Privacy Policy

Last updated: 1 May 2027

1. Introduction

Pennine Operations Group Ltd ("we", "us", "our") is committed to protecting the privacy and security of your personal data. This policy explains how we collect, use, store, and share information about you when you interact with our website, services, and training programmes. We are registered in England and Wales under company number 13684291, with our registered address at Castle Gate House, 25 Castle Gate, Nottingham NG1 7AQ.

2. Data Controller

Pennine Operations Group Ltd is the data controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. If you have questions about this policy or how we handle your data, you may contact us at enquiries@pennineops.co.uk or by post at the address above.

3. Information We Collect

We may collect the following categories of personal data:

• Identity data: your name, job title, and employer name.
• Contact data: your email address, telephone number, and postal address.
• Inquiry data: information you provide when completing our contact form, including the service you are interested in and any message content.
• Transaction data: details of training courses you have booked or attended, payment information, and invoicing records.
• Technical data: your IP address, browser type and version, time zone setting, operating system, and platform. This data is collected automatically when you visit our website.
• Usage data: information about how you use our website, including pages visited, time spent on pages, and navigation paths.

4. How We Collect Your Data

We collect personal data through the following means:

• Directly from you: when you complete our contact form, send us an email, speak with us by telephone, or register for a training course.
• Automatically: when you browse our website, through cookies and similar technologies.
• From third parties: occasionally from your employer when they book training on your behalf.

5. How We Use Your Data

We process your personal data for the following purposes and on the following lawful bases under UK GDPR:

• To respond to your inquiries (lawful basis: legitimate interest — it is in our legitimate business interest to respond to potential clients).
• To deliver training services you or your organisation have contracted us to provide (lawful basis: performance of a contract).
• To issue invoices and process payments (lawful basis: performance of a contract and legal obligation).
• To send you relevant information about our services where you have given consent or where we have a legitimate interest to do so (lawful basis: consent or legitimate interest). You may withdraw consent at any time.
• To maintain and improve our website (lawful basis: legitimate interest).
• To comply with legal obligations, including tax and accounting requirements (lawful basis: legal obligation).

6. Cookies

Our website uses cookies to ensure it functions properly and to improve your browsing experience. We use a small number of strictly necessary cookies and, with your consent, analytical cookies that help us understand how visitors use the site. You can manage your cookie preferences through the consent banner displayed when you first visit our site. For more detail on the specific cookies we use, please contact us.

7. Data Sharing

We do not sell your personal data to any third party. We may share your data in the following limited circumstances:

• Service providers: we use a small number of trusted providers for web hosting, email delivery, and payment processing. These providers process data on our behalf and under our instructions.
• Professional advisers: our accountants and legal advisers, where necessary for the conduct of our business.
• Legal requirements: where we are required to disclose data by law, regulation, or court order.

All third-party processors are contractually bound to protect your data and to process it only for specified purposes.

8. International Transfers

We store and process your data within the United Kingdom. Where any data is transferred outside the UK, we ensure appropriate safeguards are in place, such as standard contractual clauses approved by the Information Commissioner's Office (ICO), or transfers to countries recognised as providing an adequate level of protection.

9. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected. As a general guide:

• Inquiry data is retained for up to 24 months following your last interaction with us.
• Client and transaction data is retained for 7 years following the end of our business relationship, in line with HMRC requirements.
• Website usage data is retained for up to 12 months.

When data is no longer required, it is securely deleted or anonymised.

10. Your Rights

Under UK GDPR, you have the following rights in respect of your personal data:

• Right of access: you may request a copy of the personal data we hold about you.
• Right to rectification: you may ask us to correct inaccurate or incomplete data.
• Right to erasure: you may ask us to delete your personal data in certain circumstances.
• Right to restrict processing: you may ask us to limit how we use your data.
• Right to data portability: you may request that we transfer your data to another organisation in a structured, commonly used format.
• Right to object: you may object to our processing of your data where we rely on legitimate interest as the lawful basis.
• Right to withdraw consent: where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at enquiries@pennineops.co.uk. We will respond to your request within one calendar month.

11. Data Security

We take the security of your personal data seriously. We have implemented appropriate technical and organisational measures to protect your data against unauthorised access, loss, destruction, or alteration. These measures include encrypted storage, access controls, and regular security reviews. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

12. Complaints

If you are dissatisfied with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection. You can contact the ICO at:

• Website: ico.org.uk
• Telephone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

We would appreciate the opportunity to address your concern before you approach the ICO, so please contact us first if possible.

13. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or for legal, regulatory, or operational reasons. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

If you have any questions about this privacy policy or our data practices, please contact us at enquiries@pennineops.co.uk or write to us at Castle Gate House, 25 Castle Gate, Nottingham NG1 7AQ.