1. Introduction

IBS Training & Development respect the privacy of every person who visits or subscribes to our websites and publications and are committed to ensuring a safe online-experience. This Privacy Notice explains how IBS Training & Development ("we", "us", "our") collects, uses, shares, stores and protects personal information when dealing with prospective students, current students, suppliers, customers, and other individuals who interact with us. It also explains your rights under UK data protection law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act 2025 (DUAA).

We are committed to protecting your privacy. This Notice is our promise to be transparent about what we do with your personal data, and to ensure that your data is treated lawfully, fairly, and securely.

2. Who We Are

Controller: IBS Training & Development is the data controller in relation to your personal data—meaning we decide why and how your data is processed.

If you have any questions about this Privacy Notice, or how we process your data, please contact us.

3. What Personal Information We Collect

We collect different types of personal data depending on how you interact with us (e.g., as student applicant, parent/guardian, supplier, customer). The types of data we may collect include:

• Identity information: your name, title, date of birth, gender (if necessary).
• Contact information: postal address, email address, telephone number.
• Application/enrolment information: school/education history, qualifications, references, interview notes.
• Financial information: payment details, invoicing, bank account information if you are a supplier or if you are paying fees.
• Communications data: correspondence with us, feedback, complaint history.
• Service usage data: details of services requested or accessed.
• Technical data: IP addresses, browser/device information (particularly for website visitors).
• Special category data (if applicable): such as health information or disability status, where you choose to share, or where we need to take it into account for enrolment or safeguarding purposes.

We collect this data either directly from you (for example when you fill in forms, apply, contact us), or from third parties (references, exam boards, government bodies), or through your use of our website and services.

4. Why We Use Personal Data / Purposes of Processing

We process personal data for the following purposes:

Under UK GDPR, each of these purposes must rely on a lawful basis. These lawful bases include consent, contract, legal obligation, legitimate interests, and vital interests/safeguarding.

5. Lawful Basis and Consent

• We will ask for your consent when required (for example marketing emails). You can withdraw your consent at any time.
• When using legitimate interests, we will ensure that those interests are clearly described, necessary, and that your rights and freedoms are not overridden.
• Where sensitive/special category data is processed (e.g. health status), additional conditions will apply (for example explicit consent, or necessity for purposes of provision of health or social care, or safeguarding).

6. Data Sharing

We may share your personal data with third parties, including:

• Internal staff and departments when needed for the above purposes.
• Data processors who act on our behalf (e.g. IT service providers, cloud storage providers, payment processors). We require them to commit to GDPR-compliant obligations.
• Regulatory bodies, government agencies, law enforcement, or courts when required by law.
• Other parties when necessary for safeguarding or where required under contract (for example exam boards, accreditation bodies).

We will only share special category data where necessary and under strict controls.

7. International Transfers

If any of your personal data is transferred outside the UK (or outside the European Economic Area, if applicable), we will ensure appropriate safeguards are in place. These might include:

• Use of UK adequacy decisions.
• Standard Contractual Clauses approved by the UK government.
• Encryption, contractual safeguards, and strict processing agreements with the recipient.

8. How Long We Keep Your Data

We retain personal data only for as long as is necessary. Retention periods depend upon the type of record and the reason. Examples include:

At the end of the retention period, data will be securely deleted or anonymised.

9. Your Rights

You have rights under UK GDPR and the Data (Use and Access) Act 2025 in relation to your personal data. These include:

If you want to exercise any of these rights or have any question about how your data is processed, please contact us using the contact details above.

10. Children's Data

We do not knowingly collect personal data from children under the age of 13 via our website or application forms. If we learn that we have collected such data, we will take steps to destroy it as soon as possible.

If you are a parent or guardian, or dealing with us on behalf of a minor, please contact us if you believe your child's data has been collected in error.

11. Cookies and Similar Technologies

We use cookies and similar technologies to collect certain technical information, typically from visitors to our website. These help us:

• Improve website functionality and performance.
• Analyse how people use our site, to help improve content.
• Remember preferences and maintain sessions.

We do not use cookies to collect excessive personal data without your consent. More details of the cookies we use, what they do, and how you can disable or block them are set out in our Cookie Policy.

12. Data Security

We take reasonable technical and organisational measures to protect your data, including but not limited to:

• Access controls (only authorised personnel have access).
• Encryption of sensitive data in transit and at rest when possible.
• Staff training & confidentiality agreements.
• Secure storage, backups, and disaster recovery plans.

While we strive to protect your data, the internet cannot be guaranteed totally secure. If you are transmitting data via our website, you do so at your own risk. Once we have your data, we will protect it as described.

13. Complaints & Contact Information

If you have concerns or complaints about our handling of your personal data:

• First, contact us at admin@ibstraining.co.uk or by post to the address above. Please include as much detail as you can.
• If you are not satisfied with our response, you have the right to raise a complaint with the Information Commissioner's Office (ICO).

14. Changes to this Privacy Notice

We may update this Privacy Notice from time to time (e.g. when our practices change, new legal requirements arise, or we adopt new services). We will publish the updated notice on our website with a new version number and date. We encourage you to review the notice periodically.