This notice explains how Pitstone Training Ltd uses personal information when you visit our website, enquire about training or buy or undertake a course. Effective date: 25 September 2026.
Who is responsible for your information
Pitstone Training Ltd is responsible for deciding how and why it uses personal information for its website, enquiries, sales, employer bookings and customer support. Pitstone Training Ltd is registered in England and Wales under company number 17337514. Its registered office is 118 Westfields, Stanley, England, DH9 7DF.
For privacy questions or rights requests, email info@pitstonetraining.co.uk or write to our registered office.
Who this notice covers
This notice covers website visitors, people making enquiries, customers, individual learners, employer contacts, learners enrolled by an employer, suppliers and other people who communicate with Pitstone.
Information we may collect
Identity information. Names, job titles and the organisation a person represents.
Contact information. Email address, postal address and other contact details supplied to us.
Order and payment information. Courses, prices, billing details, invoices, payment status, refunds and transaction references. Stripe handles online card processing. We receive payment confirmations and limited payment-method information; full card numbers and security codes are not held in our website order records.
Learner information. Learner name, individual email address, enrolment, course access, progress, assessment status, completion and certificate records.
Communication information. Enquiries, support requests, complaints, feedback and correspondence.
Technical information. IP addresses, device and browser information, session identifiers, website requests and security or delivery records generated when you use our website and payment services.
Support information. You may tell us what adjustment or assistance you need. Please avoid sending medical records or unnecessary health details. If we need to process health information, we will explain why and obtain explicit consent where that is the appropriate legal condition, or identify another applicable condition before using it.
How we receive information
We may receive information directly from the individual, from a customer purchasing for another learner, from an employer arranging a group booking, from the Highfield-integrated learning and certificate systems, from payment and website providers, and from correspondence about an order or learner.
If a buyer or employer gives us your learner details, we will provide this notice within the period required by law: ordinarily within one month, or at our first communication or disclosure if earlier. We also ask the buyer to share it with you when collecting your details.
Why we use information and our lawful bases
Enquiries and course guidance. To respond, provide requested information and take steps before a contract. We rely on steps requested before entering a contract and our legitimate interest in providing customer service.
Orders and payments. To process an order, confirm payment, provide receipts, handle refunds and manage the customer contract. We rely on contract and legal obligations.
Enrolment and learning records. Where you are the customer, we use information necessary to deliver your contract. Where another person or your employer buys for you, we rely on our legitimate interests in arranging your requested training, supporting access and maintaining completion records, taking account of your rights. We do not treat a contract with your employer as a contract with you.
Employer bookings. We use business contact details, quotations and learner lists to administer the booking and communicate relevant progress or completion information to the purchasing employer where this is part of the disclosed arrangement. For employee and business-contact data, our basis is legitimate interests in delivering and administering workplace training. We use contract where the individual is personally a party to the contract.
Customer support and complaints. To investigate problems, maintain service standards, resolve disputes and protect legal rights. We rely on contract, legal obligations and legitimate interests.
Accounting and compliance. To keep financial, tax, company and transaction records and respond to lawful requests. We rely on legal obligations and legitimate interests in managing the business.
Website security and improvement. To protect accounts, prevent fraud, diagnose faults and understand how the service performs. We rely on legitimate interests and, for non-essential cookies or similar technology, consent where required.
Marketing. We do not currently operate an email marketing programme. Buying a course or making an enquiry does not subscribe you to promotional emails. Before introducing a service such as Mailchimp, we will update this notice with the relevant provider details and explain how to subscribe and unsubscribe. Service emails about purchases and support will continue where needed.
When information is required
Some information is needed to form or perform a contract, including the purchaser's details, payment information, and each learner's correct full name and individual email address. If required information is not supplied, we may be unable to process the order, enrol the learner, provide support or issue the certificate correctly.
Who we may share information with
Highfield. We share learner identity, contact and relevant learning records with Highfield Elearning Limited (company number 07380246) to provide course access, learning records and associated support. Highfield acts as our processor for the course and support processing covered by our reseller agreement. Its own privacy information is available at https://www.highfieldelearning.com/privacy-policy/.
Website and support providers. GoDaddy provides our website hosting. WordPress and WooCommerce, together with our payment, enrolment, order-completion, checkout-consent and email-log plugins, process information within the website. Hosting and technical service providers may have access where necessary to operate, secure, maintain or restore the service. Installing a plugin does not itself mean its developer receives your information.
Stripe and banks. We share payment and transaction information needed to process payments and refunds, prevent fraud and keep financial records. Stripe may act as a processor or an independent controller, depending on the activity, including its own fraud prevention and legal duties. Stripe explains its entities, uses of information and rights arrangements at https://stripe.com/gb/privacy.
Email and business services. We use Microsoft 365 for business email. Our website email service and Check & Log Email plugin process delivery records for troubleshooting; these can include recipient, sender, subject, delivery status and message information. We also keep invoices and an invoice-status spreadsheet on our business computer. We limit access to information needed to administer the business.
Professional advisers. Such as accountants, insurers, auditors and legal advisers where reasonably necessary.
Public authorities or other parties. Where disclosure is required by law, needed to protect legal rights, or necessary to prevent or investigate fraud or misuse.
We do not sell personal information. We require service providers acting on our behalf to protect information and use it only for the agreed services.
International transfers
Our providers operate internationally, so information may be processed outside the United Kingdom. Stripe identifies international processing including the United States and India; Microsoft and GoDaddy also use international operations and service providers. We require a lawful transfer arrangement where UK data protection law requires one. Depending on the provider and destination, this can be a UK adequacy regulation, including a qualifying UK–US Data Bridge transfer, or approved contractual safeguards such as the UK International Data Transfer Agreement or the UK Addendum to EU Standard Contractual Clauses. The applicable provider notices and data-processing terms explain their arrangements. Contact info@pitstonetraining.co.uk for information about a transfer affecting your data or a copy or explanation of relevant safeguards. We do not promise that all information remains in the UK.
Provider information: Microsoft privacy — https://www.microsoft.com/en-gb/privacy/privacystatement; GoDaddy data-processing terms — https://www.godaddy.com/en-uk/legal/agreements/data-processing-addendum.
How long we keep information
We keep information only as long as needed for its purpose, including legal and accounting obligations. The periods below are our retention policy. We review retained records at least annually and delete or anonymise information no longer needed. Some records are reviewed manually rather than deleted automatically. A legal obligation, unresolved dispute or other justified need may require longer retention.
Enquiries and quotations. Normally up to two years after the last meaningful contact, unless the enquiry becomes an order or a longer period is needed for a dispute.
Orders and key enrolment/completion records. Normally up to six years after the order or the end of course access, whichever is later, to handle queries and potential claims. We keep detailed learning activity only while needed to deliver the course, provide support or retain necessary evidence. We coordinate platform deletion requests with Highfield; deleting a website order does not itself delete the LMS record.
Financial and tax records. Normally six years from the end of the financial year to which they relate, or longer where the law requires.
Complaints and disputes. Normally six years after closure, depending on the nature of the issue and limitation periods.
Marketing records. We do not currently maintain an email marketing list. We will set and explain appropriate retention arrangements before introducing email marketing.
Email delivery logs. Our normal retention period for website email troubleshooting logs is one month. Relevant correspondence needed for an order, complaint or legal matter follows the corresponding longer period above. This does not mean that emails in our business inbox are deleted after one month. Technical and security records are retained according to the fault, security or operational need. Backup copies are kept for recovery and expire through the relevant backup cycle; we do not use them as a continuing archive of deleted customer records.
Security
We will use reasonable organisational and technical measures to protect information against unauthorised access, loss, alteration or disclosure. Access will be limited to people and providers who need it for an authorised purpose. No internet service can be guaranteed completely secure.
Your data protection rights
Access. You may ask for a copy of personal information we hold about you.
Correction. You may ask us to correct inaccurate or incomplete information.
Erasure. You may ask us to delete information in circumstances where the right applies. This right is not absolute, and we may need to keep information for legal or contractual reasons.
Restriction. You may ask us to restrict how information is used in certain circumstances.
Objection. You may object to processing based on legitimate interests and may object to direct marketing at any time.
Portability. You may ask to receive certain information in a portable format where the right applies.
Withdrawal of consent. Where we rely on consent, you may withdraw it at any time without affecting earlier lawful use.
Email info@pitstonetraining.co.uk to exercise a right. We may need reasonable information to verify your identity. We normally respond within one month, subject to any extension or other adjustment permitted by law, which we will explain. Rights are subject to legal conditions and exemptions; we will explain any applicable restriction.
Automated processing
Our website automatically processes successful orders and requests learner enrolment. Some learning activities or assessments are scored automatically. Contact us if you believe an order decision or result is incorrect so we can investigate and arrange review through the available course process. Stripe may use automated fraud checks that affect whether a payment is accepted; its privacy notice explains its processing and applicable rights.
Marketing choices
We do not currently send marketing emails. If we introduce them, we will explain your choices and provide a way to unsubscribe. Service messages about an order, course access, certificate, security issue or support request are not marketing and may still be sent where necessary.
Learners under 18
The website is aimed primarily at adult learners and workplace training customers. A purchaser should contact Pitstone before enrolling a learner under 18. We will consider the learner's age, the suitability of the course and the appropriate way to provide privacy information.
Complaining to the ICO
We ask individuals to contact Pitstone first so we can try to resolve the concern. They also have the right to complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Further information is available at ico.org.uk.
Changes to this notice
We will review this notice when the website, providers, data uses or law change. The current version will be published on the website with its effective date. Material changes will be brought to people's attention where appropriate.