GDPR Policy
Introduction
At Cherry Picker Training, we are committed to protecting personal information and respecting the privacy rights of our customers, website visitors, training delegates and business contacts.
Cherry Picker Training, operating through cherrypickertraining.uk, is a trading style of Autec, registered in England and Wales under company number 05192184.
This GDPR Policy explains our approach to handling personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable UK data protection legislation.
It applies to personal information processed in connection with our website, enquiries, quotations, training bookings, delegate administration, certification and associated business activities.
This policy should be read alongside our Privacy Policy and Cookie Policy.
1. Our Commitment to Data Protection
We aim to process personal information lawfully, fairly, transparently and securely.
Our approach is based on the following data protection principles:
Lawfulness, Fairness and Transparency: Personal information must be processed on an appropriate legal basis and individuals must be informed about how their information is used.
Purpose Limitation: Personal information should be collected for specified, explicit and legitimate purposes.
Data Minimisation: Only information reasonably necessary for the relevant purpose should be collected.
Accuracy: Reasonable steps should be taken to keep personal information accurate and up to date.
Storage Limitation: Personal information should not be retained longer than necessary.
Integrity and Confidentiality: Appropriate safeguards should protect personal information against unauthorised access, loss, misuse and disclosure.
Accountability: We are responsible for demonstrating compliance with applicable data protection requirements.
These principles guide how personal information is collected, managed and protected.
2. Data Controller Responsibilities
For personal information processed in connection with our website and business activities, Autec will act as the data controller where it determines the purposes and means of processing.
As a data controller, our responsibilities include:
Identifying appropriate lawful bases for processing
Providing clear information about how personal data is used
Maintaining appropriate data protection procedures
Responding to requests from individuals exercising their rights
Implementing suitable security measures
Managing personal data breaches appropriately
Ensuring appropriate arrangements with third-party processors
Reviewing data retention and disposal practices
Assessing privacy risks where required
Where another organisation independently determines how personal information is processed, that organisation may act as a separate controller.
3. Personal Information We Process
Depending on the services requested, we may process the following categories of personal information.
Customer and Business Contact Information
Names
Email addresses
Telephone numbers
Business names
Job titles
Correspondence addresses
Billing details
Customer communication records
Training and Booking Information
Course enquiries and booking details
Preferred training dates and locations
Delegate names and contact details
Employer or sponsoring organisation details
Training requirements
Previous experience and qualifications
Attendance records
Practical and theoretical assessment results
Certification and qualification records
Training card or certificate information
Health and Accessibility Information
Where necessary, we may process limited health or accessibility information to arrange reasonable adjustments or support safe participation in training.
Such information may constitute special category personal data and requires additional legal safeguards.
Website and Technical Information
IP addresses
Browser and device information
Website usage information
Cookie identifiers
Contact form submissions
Website analytics information where applicable
We aim to collect only information relevant to the services and activities involved.
4. Lawful Bases for Processing
We process personal information only where an appropriate lawful basis applies under Article 6 of the UK GDPR.
These may include:
Contractual Necessity
Processing required to enter into or fulfil a contract with an individual, including training arrangements and booking administration.
Legitimate Interests
Processing necessary for legitimate business purposes, such as responding to enquiries, maintaining customer relationships, managing training operations and protecting our systems, where those interests are not overridden by individual rights.
Legal Obligations
Processing required to comply with applicable legal requirements, including taxation, accounting, health and safety and data protection obligations.
Consent
Processing based on an individual's freely given, specific, informed and unambiguous agreement, where consent is appropriate.
Consent may be relevant to certain marketing activities and non-essential website tracking technologies.
Where consent is relied upon, individuals can withdraw it at any time.
5. Special Category Personal Data
Some training arrangements may require information about a delegate's health, disability or accessibility requirements.
This information is treated with particular care.
Where special category personal data is processed, we will identify both an Article 6 lawful basis and an appropriate Article 9 condition under the UK GDPR.
Depending on the circumstances, this may involve explicit consent or another applicable legal condition.
We aim to:
Collect only information necessary for the relevant purpose
Explain why the information is required
Restrict access to authorised individuals
Avoid unnecessary disclosure
Apply appropriate confidentiality safeguards
Retain the information only for an appropriate period
We do not require delegates to provide unrelated medical information.
6. How Personal Information Is Used
Personal information may be used to:
Respond to customer enquiries
Provide quotations and course information
Arrange cherry picker and MEWP training
Manage training bookings
Register delegates
Confirm course attendance
Coordinate instructors and training facilities
Manage practical and theoretical assessments
Issue or arrange training certification
Maintain relevant training records
Communicate with employers and authorised representatives
Process invoices and payments
Respond to complaints and requests
Meet applicable legal and regulatory obligations
Maintain website security
Improve our services
Send marketing communications where permitted
Personal information will not be used for incompatible purposes without an appropriate legal basis.
7. Data Sharing and Third-Party Processors
We may share personal information with organisations where necessary to deliver services or meet legal obligations.
These may include:
Training instructors and assessors
Training centres
Accreditation and certification organisations
Training scheme administrators
Employers and authorised training coordinators
Certificate and training card providers
Booking administration platforms
Website hosting providers
IT support providers
Customer relationship management systems
Payment and accounting service providers
Professional advisers
Regulatory and public authorities where required by law
Information shared will be limited to what is reasonably necessary for the relevant purpose.
Where third parties process personal information on our behalf, we will use appropriate contractual arrangements and safeguards as required by data protection legislation.
We do not sell personal information to third parties.
8. Data Security
We recognise the importance of protecting personal information against unauthorised access, accidental loss, alteration and disclosure.
Appropriate technical and organisational safeguards may include:
Password-protected systems
Access controls
Secure storage arrangements
Appropriate website security measures
Confidential handling of delegate records
Restricted access to sensitive information
Secure information sharing procedures
Staff and contractor confidentiality requirements
Data backup and recovery arrangements
Procedures for identifying and responding to security incidents
Security measures are reviewed as appropriate to the nature and risks of the processing.
No system can be guaranteed to be completely secure, but we aim to take reasonable and proportionate precautions.
9. Data Retention
Personal information is retained only for as long as reasonably necessary for the purposes for which it was collected.
Retention periods may depend on:
The nature of the information
Contractual requirements
Applicable legislation
Training scheme requirements
Certification and qualification verification
Accounting and taxation obligations
Potential legal claims
Legitimate operational needs
Examples include:
Enquiry information: Retained for an appropriate period to manage enquiries and follow-up communications.
Training booking records: Retained as necessary for course administration and customer service.
Attendance and assessment records: Retained where required for training verification and certification.
Qualification records: Retained where necessary to support certification, renewals and relevant scheme requirements.
Health and accessibility information: Retained only for as long as necessary for the specific purpose and applicable obligations.
Financial records: Retained in accordance with relevant accounting and taxation requirements.
Marketing information: Retained until consent is withdrawn or an objection is received, where applicable.
When personal information is no longer required, we take appropriate steps to delete, anonymise or securely dispose of it.
10. Individual Data Protection Rights
Individuals have rights under the UK GDPR, subject to applicable conditions and exemptions.
These include:
Right of Access
You may request confirmation of whether we process your personal information and obtain a copy of that information.
Right to Rectification
You may request correction of inaccurate personal information or completion of incomplete information.
Right to Erasure
You may request deletion of personal information in certain circumstances.
Right to Restrict Processing
You may request that we limit the processing of your information where applicable.
Right to Data Portability
You may request certain personal information in a structured, commonly used and machine-readable format where the relevant legal conditions apply.
Right to Object
You may object to certain processing based on legitimate interests and to direct marketing.
Right to Withdraw Consent
Where processing relies on consent, you may withdraw that consent at any time.
Rights Relating to Automated Decision-Making
You may have additional rights where decisions producing legal or similarly significant effects are made solely through automated processing.
We do not intend to make solely automated decisions of this kind in the ordinary administration of training enquiries and bookings.
11. Data Subject Access Requests
Individuals may request access to personal information held about them.
Requests can be submitted through the contact details available on our website.
We may request information necessary to verify the identity of the person making the request.
We aim to respond without undue delay and normally within one month, subject to applicable rules permitting extensions.
Requests are generally handled without charge, although legislation permits fees or refusal in limited circumstances.
Where information cannot be provided, we will explain the relevant reason where required by law.
12. International Data Transfers
Some third-party service providers may store or process personal information outside the United Kingdom.
Where international transfers take place, we will apply appropriate safeguards in accordance with UK data protection legislation.
These may include:
Transfers covered by UK adequacy regulations
Approved contractual safeguards
Other lawful transfer mechanisms where applicable
We aim to ensure that personal information receives an appropriate level of protection when transferred internationally.
13. Personal Data Breaches
A personal data breach may involve accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal information.
Where a suspected breach occurs, we will take appropriate steps to:
Investigate the incident
Identify the information affected
Assess potential risks to individuals
Contain the incident where possible
Take corrective measures
Maintain appropriate records
Notify relevant authorities where legally required
Inform affected individuals where required
Where a breach is notifiable to the Information Commissioner's Office, we will report it without undue delay and, where feasible, within 72 hours of becoming aware of it.
Where a breach is likely to result in a high risk to individuals' rights and freedoms, we will notify affected individuals without undue delay, unless an applicable exemption applies.
14. Cookies and Online Tracking
Our website may use cookies and similar technologies to support functionality, analyse performance and improve the visitor experience.
These may include:
Essential website cookies
Functional cookies
Analytics and performance cookies
Marketing and advertising cookies where implemented
Non-exempt cookies and tracking technologies will be subject to applicable consent requirements.
Visitors may manage cookies through their browser settings and any cookie preference tools available on our website.
Further information is available in our Cookie Policy.
15. Marketing Communications
We may contact customers and business contacts about relevant services where permitted by applicable law.
Marketing communications may include information about:
Cherry picker training
MEWP operator training
Scissor lift and boom lift courses
Refresher training
Training certification and renewals
Related training services
We will comply with applicable UK GDPR and Privacy and Electronic Communications Regulations requirements.
Where consent is required, marketing communications will only be sent after the necessary consent has been obtained.
Individuals may opt out of direct marketing at any time.
16. Data Protection by Design and Default
We aim to consider data protection requirements when developing or changing our website, systems and business processes.
This includes:
Limiting unnecessary data collection
Restricting access to personal information
Considering privacy risks before introducing new technologies
Reviewing third-party service providers
Applying appropriate security controls
Minimising the retention of unnecessary information
Considering the rights of individuals affected by processing
Where processing is likely to result in a high risk to individuals' rights and freedoms, we will carry out a Data Protection Impact Assessment where required.
17. Staff, Contractors and Confidentiality
Individuals handling personal information on our behalf are expected to treat it confidentially and use it only for authorised purposes.
Appropriate arrangements may include:
Confidentiality obligations
Access restrictions
Data protection guidance
Secure handling procedures
Reporting of suspected security incidents
Appropriate oversight of third-party processors
We aim to ensure that personal information is accessed only where necessary for legitimate business activities.
18. Complaints and Regulatory Oversight
If you have concerns about how your personal information is handled, you may contact us using the details provided on our website.
We will make reasonable efforts to investigate concerns and provide an appropriate response.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.
ICO website: www.ico.org.uk
We encourage individuals to contact us first where possible so that we have an opportunity to address concerns directly.
19. Changes to This GDPR Policy
We may update this GDPR Policy periodically to reflect changes in:
Data protection legislation
Regulatory guidance
Website functionality
Training services
Business operations
Information security practices
Third-party processing arrangements
Updated versions will be published on our website.
We recommend reviewing this policy occasionally.
20. Contact Us
For questions about this GDPR Policy, personal information, data protection rights or the handling of personal data, please contact us through cherrypickertraining.uk.
Cherry Picker Training
A trading style of Autec
Registered in England and Wales
Company Number: 05192184
We are committed to handling personal information responsibly and respecting the rights of individuals whose data we process.