Privacy Policy — Construction Skills Professionals Ltd

1. Who We Are

construction-skills.com is operated by Construction Skills Professionals Ltd ("we", "us", "our"), a company registered in England & Wales under company number 17339725, with its registered office at Hyat Hub, Suite 14, Durning Hall, Earlham Grove, London, E7 9AB.

We are the data controller for the personal information described in this policy.

For any questions about this policy or your data, contact us at: support@construction-skills.com or by phone on 0330 094 7015.

For data protection queries specifically, you can also reach us at privacy@construction-skills.com.

This policy applies to visitors to construction-skills.com from the UK. If you are accessing the site from outside the UK, UK data protection law (UK GDPR) still governs how we handle your data as the site operator.

2. What Personal Data We Collect

We collect personal data when you interact with construction-skills.com, including:

We do not knowingly collect special category data (e.g. health information) through this site. If you disclose such information to us voluntarily (for example, in a free-text enquiry), we will only use it for the purpose you provided it and in line with this policy.

3. How We Use Your Data and Our Legal Basis

We do not currently send marketing emails or newsletters. If we introduce this in future, we will update this section and only do so on the basis of your consent, which you'll be able to withdraw at any time (see Section 8).

4. Who We Share Your Data With

We do not sell your personal data. We may share it with:

• Training delivery partners and awarding/certifying bodies — Construction Skills Professionals Ltd works with a range of accredited organisations to actually deliver and certify your training, depending on the service you need. Depending on your enquiry, we may pass on the details necessary to arrange your training to the relevant delivery partner or awarding/certifying body for your qualification — for example, the organisation responsible for CSCS card applications, CITB testing, NVQ registration for your specific trade, CPCS registration, or SSSTS/SMSTS course delivery. These partners may change from time to time as we work with different accredited organisations across the industry.

  We only pass on what's necessary for that organisation to deliver or certify your training. Each of these organisations is a separate data controller for the information they hold and process once it's passed to them — they are not processing your data on our behalf, but in their own right as the training provider or awarding/certifying body for your qualification. For details of how a specific partner handles your data, please see their own privacy policy directly — we're happy to confirm which organisation is handling your enquiry if you contact us.

• Other service providers who process data on our behalf under contract, such as:

  • Payment processor — Stripe — processes your card/bank payment details when you book a course, test, or card application via our online checkout. Stripe is a PCI-DSS certified payment processor; we do not see or store your full card details ourselves.
  • CRM/lead management platform — Zoho CRM — our account is hosted in Zoho's EU data centre (crm.zoho.eu).
  • Website hosting and analytics providers (Google Tag Manager/Google Analytics, where you've consented to analytics cookies)

• Regulators or authorities, where required by law.

Any third-party processor we use is required to protect your data to a standard consistent with UK GDPR, and only processes it on our documented instructions.

5. International Transfers

• Zoho CRM: our account is hosted in Zoho's EU data centre (crm.zoho.eu). Personal data processed via Zoho CRM is stored within the EU, which the UK's data protection framework already recognises as offering an equivalent standard of protection to the UK — so no additional transfer safeguard is required for this processing.
• Stripe: as a global payment processor, Stripe may process payment data outside the UK/EEA as part of its own infrastructure and fraud-prevention systems. Stripe applies its own safeguards for any such transfers (including Standard Contractual Clauses) — see Stripe's own privacy policy for full detail on how they handle your payment data.

We do not currently use any other service provider that transfers personal data outside the UK/EEA. If this changes, we will update this section to confirm the transfer mechanism used.

5a. How We Protect Your Data

We take the security of your personal data seriously and use appropriate technical and organisational measures, including:

• Encryption — SSL/TLS encryption for all data submitted through the site (forms, quiz, and Stripe-hosted checkout)
• Access control — access to personal data is restricted to staff and partners who need it to perform their role, with authentication requirements in place
• Incident response — we maintain procedures to identify, contain, and respond to any suspected data breach, including notifying the ICO and affected individuals where required under UK GDPR

No method of transmission or storage is 100% secure, but we review these measures regularly as the site and its integrations evolve.

6. Cookies

We use cookies and similar technologies to operate the site and, where you consent, to understand site usage. You can manage your preferences at any time via the cookie banner on the site ("Manage Preferences"), which lets you control:

• Essential cookies — required for the site to function (always on)
• Analytics cookies — help us understand how visitors use the site
• Marketing cookies — used for advertising purposes, where applicable

Your preference is stored on your device and respected until you change it. See our separate Cookie Policy for full details of individual cookies used.

6a. Google Sign-In (Google One Tap)

With your consent, our website may display a Google sign-in prompt to visitors who are already signed into a Google account in their browser. If you choose to use this feature, Google shares your name and email address with us to pre-fill our contact form, saving you from typing it manually. We do not receive your Google password or any other Google account data, and this feature is never used for advertising purposes. This prompt only appears after you have accepted marketing cookies via our cookie banner, and you can decline or close it at any time without affecting your ability to use the site. For more information on how Google handles this data, see Google's Privacy Policy.

7. How Long We Keep Your Data

We keep personal data only as long as necessary for the purposes it was collected:

• Enquiry/quiz data with no follow-up engagement: 12 months from your last contact with us, then deleted
• Enrolled learner records: for the duration of your training relationship with us and our delivery partner, plus 6 years afterward, in line with standard UK practice for education/training records and contract-related limitation periods
• Payment records: retained as required for tax and accounting purposes (see below) — Stripe holds the underlying transaction data as an independent controller under its own policy
• Records we're legally required to keep (e.g. for tax purposes): as required by law (currently up to 6 years for UK tax records)

8. Your Rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data, where applicable
• Object to or restrict certain processing
• Withdraw consent at any time (e.g. unsubscribe from marketing emails via the link in any email, or by contacting us)
• Data portability, where applicable
• Complain to the UK Information Commissioner's Office (ICO) at ico.org.uk if you believe we haven't handled your data properly

To exercise any of these rights, contact us at support@construction-skills.com.

9. Children's Privacy

Our services are intended for individuals seeking construction industry training and are not directed at children. We do not knowingly collect data from anyone under 18.

10. Changes to This Policy

We may update this policy from time to time, for example as our third-party providers or services change. The "Last updated" date at the top will reflect the most recent revision. Material changes will be highlighted on the site.

11. Our Relationship With Training Partners and Awarding Bodies

Construction Skills Professionals Ltd operates this site and coordinates your training enquiry — we help you identify the right course or card route, check your funding eligibility, and arrange delivery. We do not deliver, assess, or certify qualifications ourselves.

Depending on the service you need, your enquiry and the relevant details are passed to the organisation that actually delivers or certifies it — for example, organisations responsible for CSCS card applications, CITB testing, NVQ registration for your trade, CPCS registration, or SSSTS/SMSTS course delivery. We work with a number of accredited delivery partners and awarding/certifying bodies across the industry, and which one handles your enquiry depends on the qualification or service you're pursuing — we're happy to confirm this directly if you ask us.

See the disclaimer at the foot of every page of this site for how this coordinator/delivery-partner relationship works in practice.

Once your details are passed to any of these organisations for the purpose of delivering, registering, or certifying your training, they act as an independent data controller for the information they hold and process — not as a processor acting on our instructions. For details of how a specific partner or awarding body handles your data, please see their own privacy policy directly. This Privacy Policy covers how Construction Skills Professionals Ltd handles your data up to and including that handover.