Privacy Policy

1. Who We Are

ATA (Asset Training Academy) Ltd is a UK-registered training provider, incorporated on 17 December 2020. We are the data controller responsible for any personal data we collect about you.

• Company name: ATA (Asset Training Academy) Ltd
• Company registration number: 13088797
• Registered office: Business Lodge Kingsway, Caldwell Rd, Widnes, WA8 7GD
• ICO registration number: ZC138160
• Contact email: info@assettrainingacademy.com
• Phone: 01925 909 310

2. What Personal Data We Collect

Depending on how you interact with us, we may collect the following types of personal information:

2.1 Information you give us directly

• Contact details: name, email address, phone number, organisation name, job title
• Booking information: course selected, date, location, number of delegates, payment details (processed by our payment provider — see Section 5)
• Dietary requirements and accessibility needs (where relevant to attending a course)
• Enquiry information: the contents of messages you send us via our website forms, email, or phone
• Self-assessment responses: when you complete our online management self-assessment, your answers and the resulting score

2.2 Information we collect automatically

• Website usage data via Google Analytics 4 — pages visited, time spent, device type, approximate location (city level), referring website
• Cookies and similar technologies — see our Cookie Policy for details

2.3 Information we receive from third parties

• Lead enquiries from training directories such as Reed and Findcourses — typically your name, email, organisation, and the course you enquired about
• LinkedIn — basic profile information visible when you connect with or message us

3. How We Use Your Personal Data

3.1 To deliver our training services

• Processing course bookings, sending joining instructions, issuing certificates of attendance
• Communicating with you about your booking (date changes, venue details, course materials)
• Sharing your name and any dietary requirements with the venue we are using for catering and accessibility purposes
• Responding to in-house training enquiries and providing tailored quotes

3.2 To respond to your enquiries

• Replying to questions submitted via website forms, email, or phone
• Following up on enquiries received through Reed, Findcourses, or other lead aggregators

3.3 For marketing communications

• Sending our email newsletter via Mailchimp to subscribers who have opted in
• Sending occasional course information emails to past delegates under the soft opt-in basis (PECR Regulation 22(3)) — emails about similar courses, with an unsubscribe option in every message
• Sending marketing emails to enquirers only where they have given explicit consent (e.g. ticked a box on an enquiry form)
• Occasional LinkedIn outreach to professional contacts in relevant business or HR roles about our training services, where we reasonably believe the contact would find this relevant. We always honour opt-out requests.

3.4 To administer our business and improve our services

• Maintaining records of bookings, enquiries, and financial transactions
• Analysing website usage to improve our content and user experience
• Processing the management self-assessment to provide personalised course recommendations

3.5 Course recordings (occasional)

From time to time, we may record virtual masterclasses for quality assurance, trainer development, or to make a session available to delegates who could not attend live. We do not record in-person courses.

If a session is to be recorded, we will tell you in advance — typically in your booking confirmation or a follow-up email before the session — and you will have the option to decline being recorded by replying to that email or by disabling your camera and microphone during the session. Recordings are kept secure and accessed only by ATA staff and (where relevant) registered course delegates.

4. Lawful Basis for Processing

Under UK GDPR, we must have a lawful basis for processing your personal data. The bases we rely on are:

• Contract — where processing is necessary to deliver the training services you have booked (e.g. sending joining instructions, issuing certificates, taking payment).
• Consent — for marketing emails to new subscribers, for processing assessment responses, and for recording virtual sessions. You can withdraw consent at any time.
• Legitimate interests — for responding to enquiries, for B2B marketing to professional contacts where they would reasonably expect to hear from us, for soft opt-in marketing to past delegates about similar courses, and for analysing website usage. We have balanced our interests against your privacy rights.
• Legal obligation — for retaining financial records as required by HMRC and for responding to lawful requests from regulators or law enforcement.

5. Who We Share Your Data With

We do not sell your personal data. We share it only where necessary to deliver our services or to comply with legal obligations.

5.1 Service providers

• Mailchimp (Intuit Inc.) — for sending email newsletters and managing our mailing list
• Dante Booking System — for processing course bookings and managing the schedule
• Stripe / Worldpay — payment processing (via Dante's checkout flow)
• PayPal — payment processing for e-learning course purchases (including bulk invoices for organisations)
• Google (Google Analytics 4) — website usage analytics
• Microsoft (Microsoft 365 / Outlook) — for our email and document infrastructure

5.2 Course venues

When you book an in-person course, we share your name and any dietary requirements with the venue (typically Marriott or similar) for catering and accessibility purposes. We do not share contact details with venues.

5.3 Legal and regulatory bodies

We may disclose personal data where required by law, regulation, or a valid legal process — for example, in response to a court order or a request from HMRC, the Information Commissioner's Office, or other UK regulators.

5.4 Limited information shared with booking organisations

Where an organisation books a course on behalf of one or more delegates, we may confirm to the booking organisation that the delegate(s) attended, along with practical information such as joining instructions or any non-attendance. We do not share trainer feedback, individual assessment scores, or feedback you give us about the course with the booking organisation unless you have specifically agreed to this.

5.5 We do NOT share data with

• Other training providers
• Marketing data brokers
• Third parties for their own marketing purposes

6. International Data Transfers

Some of the third parties we use are based outside the UK, which means your personal data may be transferred to and stored in countries with different data protection laws.

• Mailchimp — based in the United States
• Google (GA4) — data may be processed in the United States
• Microsoft 365 — data is typically stored within the EU/UK but may be processed elsewhere
• Stripe — based in the United States
• PayPal — based in Luxembourg (PayPal (Europe) S.à r.l. et Cie, S.C.A.) with affiliated processing in the United States

Where data is transferred outside the UK, we rely on safeguards approved under UK GDPR — including the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or adequacy decisions where applicable. You can request more details on these safeguards by contacting us.

7. How Long We Keep Your Data

We keep personal data only for as long as necessary for the purposes set out in this policy, and in line with our legal obligations:

• Delegate records (course bookings, attendance): 6 years from the course date
• Enquiries that did not result in a booking: 2 years from the date of last contact
• Mailing list subscribers: until you unsubscribe or ask us to delete your data
• Financial records (invoices, payment records): 6 years (HMRC VAT requirement)
• Website analytics: aggregated and anonymised within 14 months
• Cookie consent records: 18 months
• Self-assessment responses: 2 years
• Recorded virtual sessions: 12 months unless required for ongoing course delivery

8. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of accessRequest a copy of the personal data we hold about you.
• Right to rectificationAsk us to correct inaccurate or incomplete information.
• Right to erasureAsk us to delete your personal data (subject to certain legal limits).
• Right to restrict processingAsk us to limit how we use your data while we resolve a query or correction.
• Right to data portabilityReceive your personal data in a structured, machine-readable format.
• Right to objectObject to processing based on legitimate interests, including direct marketing.
• Right to withdraw consentWithdraw consent at any time where we rely on consent.

8.1 Right to complain to the ICO

If you are unhappy with how we have handled your personal data, you can complain to the UK's Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Address: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

We would prefer the opportunity to resolve any concerns first — please contact us before raising a complaint with the ICO.

9. How We Keep Your Data Secure

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, and destruction. These measures include encrypted transmission via HTTPS, restricted access on a need-to-know basis, use of reputable third-party providers with their own robust security, regular review of our data handling practices, and staff trained in data protection responsibilities.

No method of transmitting or storing data is completely secure. While we strive to protect your data, we cannot guarantee absolute security.

10. Cookies

Our website uses cookies and similar technologies to provide functionality, analyse usage, and (where you consent) deliver tailored content. Detailed information is in our Cookie Policy, which is managed via CookieYes. You can review and change your cookie preferences at any time using the cookie settings link in the footer of our website.

11. Children's Data

Our courses and services are intended for adults (18+) in a professional context. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other operational reasons. When we make material changes, we will update the "Last updated" date below and, where appropriate, notify you by email or via a prominent notice on our website.

13. How to Contact Us

If you have any questions about this Privacy Policy or how we handle your personal data, please get in touch:

• Email: info@assettrainingacademy.com
• Phone: 01925 909 310
• Post: ATA (Asset Training Academy) Ltd, Business Lodge Kingsway, Caldwell Rd, Widnes, WA8 7GD