Last updated: 14 November 2026
1. Who we are
Training22 Ltd (“Training22”, “we”, “us”) runs first aid and health and safety training courses in London. Our courses include Paediatric First Aid, Basic Life Support, Emergency First Aid at Work and First Aid at Work. We are the data controller for the personal information described in this policy.
- Company: TRAINING22 LTD, a private limited company registered in England and Wales, company number 14274359
- Registered office: Aegean House, Ground Floor Suite, 13 Lanark Square, London E14 9QD
- ICO registration: ZB394684
- Website: training22.co.uk
- Email: admin@training22.co.uk
- Phone: 07903 177781
If you have a question about this policy or about your information, please email admin@training22.co.uk.
2. Information we collect
2.1 Enquiries (Contact Us form). We collect:
- your name, company (optional), phone number and email address
- the course you are interested in and who the training is for
- your subject and message
- whether you ticked the optional box to receive marketing emails.
Our website also records the date and time, the page you used, your IP address and your browser type. If the page address contained advertising campaign details (for example from a Google advert), we record those too.
2.2 Mailing list (newsletter form). We collect your email address and the date you signed up.
2.3 Bookings. We collect your name, email address, phone number and billing address. We also record the course, date, venue and number of places, and your order, payment and refund status. You enter your card details directly with our payment provider, Stripe. We never see or store your full card number.
2.4 Training and certification. We record attendance, assessment results and certificate details so that we can issue and verify your certificate. If a course is certificated through an awarding or approval body, we share only the details needed for certification with that body. Depending on the course, this is Qualsafe Awards or the First Aid Industry Body (FAIB). Ask us if you would like to know which body applies to your course.
2.5 Marketing choices. We record whether you agreed to receive marketing emails, and when and where you agreed (for example “Website – Contact Us form”). We also record the exact wording you agreed to. If you unsubscribe, we record that too.
2.6 Website use. We collect the pages you view, your device and browser, your approximate location and how you reached our site. We use non-essential cookies and similar technologies only as described in section 8 and in our Cookie Policy.
3. How and why we use your information
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Replying to your enquiry by email or phone, including dates and how to book the course you asked about, recommending a course and helping you book | Steps you asked us to take before entering into a contract, or our legitimate interests in answering enquiries |
| Sorting enquiries by course and by individual or group, so the right person replies quickly | Legitimate interests (efficient customer service) |
| Taking bookings, payments and refunds, running courses and sending booking messages (confirmations, joining details, changes) | Contract |
| Issuing and verifying certificates and keeping training records | Contract, and legal obligation where it applies |
| Keeping financial and tax records | Legal obligation |
| Sending marketing emails about courses, dates, offers and certificate renewals, including reminders about booking a course you asked about | Consent: only if you ticked the optional box or joined our mailing list. You can withdraw at any time |
| Website analytics, measuring our adverts and session recordings | Consent, given through our cookie banner |
| Protecting our website and forms from spam and misuse | Legitimate interests (security) |
An unticked box means no marketing. We never treat an enquiry, a booking or an unticked box as permission to send marketing emails.
4. Who we share your information with
We use the following service providers. They act on our instructions.
- Website hosting and website email: Namecheap, on servers in London, United Kingdom.
- Customer records (CRM) and email: HighLevel (LeadConnector). Enquiries and bookings made on our website are copied to it automatically.
- Online shop: WooCommerce, which runs on our own website.
- Payments: Stripe (card payments and Link).
- Advertising and analytics: Google: Tag Manager, Analytics, Google Ads conversion measurement, Merchant Center (via “Google for WooCommerce”) and Site Kit.
- Enhanced conversions: if you have accepted marketing cookies and you book a course, we also send Google a one-way scrambled (hashed) copy of your email address and phone number. This helps us measure which adverts lead to bookings, and Google uses it only for this measurement. We do not send it if you have not accepted marketing cookies.
- Website experience analytics: Microsoft Clarity (heatmaps and session recordings), used only if you allow statistics cookies. Clarity is set to mask what you type into forms.
- Email delivery for our CRM messages: HighLevel’s email service.
- Certification: the awarding or approval body for your course: Qualsafe Awards or the First Aid Industry Body (FAIB), depending on the course (see 2.4).
- Professional advisers, for example our accountant, and authorities where the law requires it.
We do not sell your personal information.
5. International transfers
Some of our providers (for example HighLevel, Google, Microsoft and Stripe) may process information outside the UK, including in the United States. When they do, we rely on safeguards recognised by UK law: the UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework, where the provider is certified), or the UK International Data Transfer Agreement or Addendum.
6. How long we keep your information
| Information | How long we keep it |
|---|---|
| Enquiries that do not lead to a booking | 12 months from your last contact with us |
| Copies of Contact Us submissions stored on our website | 12 months |
| Booking, order, payment and invoice records | 6 years from the end of the financial year they relate to |
| Training, attendance and certificate records | 6 years from the course date, or longer if the relevant awarding body requires it |
| Marketing consent records | While you are subscribed, plus 2 years after you unsubscribe |
| Unsubscribe record (your email address and the date only) | For as long as needed to make sure we respect your request not to receive marketing |
| Website backups | The two most recent backups only |
| Google Analytics (statistics) | 14 months |
| Microsoft Clarity recordings and heatmaps | Microsoft’s standard retention periods |
When we no longer need information, we delete it or make it anonymous.
7. Your rights
You can ask us to:
- give you a copy of your information
- correct it
- delete it
- restrict or object to how we use it, including objecting to marketing at any time
- give you your information in a portable format, where this applies.
Where we rely on your consent, you can withdraw it at any time. This does not affect anything we did before you withdrew it.
To use any of these rights, email admin@training22.co.uk. We will reply within one month. We do not normally charge a fee. Every marketing email includes an unsubscribe link.
8. Cookies
We use strictly necessary cookies, for example for your basket, checkout and payment security, and to remember your cookie choice. We use non-essential cookies and similar technologies only if you allow them in our cookie banner:
- Statistics: Google Analytics and Microsoft Clarity
- Marketing: Google Ads conversion measurement and WooCommerce visit-source tracking.
If you reject them, Google’s tags run in a restricted mode that sets no advertising or analytics cookies. Your choice is stored in your browser for 180 days, and you can change it at any time using the cookie icon on our website. See our Cookie Policy for details.
9. Security
We use reputable providers, encrypted (HTTPS) connections and restricted administrator access. Enquiries are sent to our CRM directly from our server, and each transfer is authenticated. To protect our forms from spam, we keep a one-way scrambled (hashed) code of your IP address and email address for about an hour. Card payments are handled by Stripe.
10. Complaints
Please contact us first. You also have the right to complain to the Information Commissioner’s Office (ICO): ico.org.uk, telephone 0303 123 1113.
11. Changes to this policy
We may update this policy from time to time. The date at the top shows when it was last changed.
