SHEC LEARNING® · PRIVACY

Privacy notice

How we use personal information and how to contact us about your rights.

Updated 7 November 2026 · services@shec.co.uk

This Privacy Notice provides details of the personal data we may collect from you, what we do with it, how you might access it and who it might be shared with.


For any queries regarding this policy or our data handling, please contact: The Data Controller – SHEC Global Learning Limited; G11 Ty Cynon House, Navigation Park, Abercynon, RCT, CF45 4SN, or email: services@shec.co.uk


Why we use personal data

We use personal data to respond to enquiries, assess course suitability, arrange enrolment, deliver learning and assessment, provide learner support, administer payments and manage our relationships with clients and suppliers. Where processing is necessary to take steps at your request before entering a contract, or to perform a contract with you, our lawful basis is contract. For business administration, due diligence and managing business contacts, we rely on legitimate interests where appropriate, taking account of your rights and reasonable expectations. Where processing is required by law, we rely on the relevant legal obligation. Marketing is addressed separately below. The retention rules below replace references to keeping all records only until a service or contract ends.

How long we keep records

E-portfolios: retained for four years from enrolment and then deleted.

E-learning course records: retained for two years from enrolment and then deleted.

These periods apply to the records described above, rather than every type of information held by SHEC. For other records, the relevant criteria include the purpose for which they were collected, applicable legal requirements and any need to resolve a complaint or dispute. Contact us for information about a particular record.

Enquiries, service messages and marketing

Messages needed to respond to your enquiry or administer your course are distinct from promotional communications. Promotional email, SMS and WhatsApp messages are subject to electronic-marketing rules as well as data protection law.

For unsolicited electronic marketing to individuals, consent is required unless all conditions of an applicable soft opt-in are met. For the products-and-services soft opt-in, this includes obtaining the details during a sale or negotiations for a sale, marketing our own similar services, and offering an opt-out when details are collected and in each subsequent message. Different rules can apply to corporate subscribers; sole traders are not treated as corporate subscribers merely because they run a business.

You can object to direct marketing at any time by using the opt-out provided or contacting services@shec.co.uk. An objection to marketing does not prevent necessary communications about an existing course or service.

What personal data do we collect?

The personal data we collect depends on whether you just visit our website or use our services. If you visit our website, you do not need to provide us with any personal data. However, your browser transmits some data automatically, such as the date and time of retrieval of one of our web pages, your browser type and settings, your operating system, the last web page you visited, the data transmitted and the access status, and your IP address. We may collect personal data from indirect sources, including: Facebook, Linkedin, Twitter and Google, for the purposes of marketing and intelligence gathering. If you use our services, personal data is required to fulfil the requirements of a contractual or service relationship, which may exist between you and our organisation. Depending upon the need to fulfil our services and operational need, we may request, collect, or hold:

  • Full Name, Age, and Country of Residency.
  • Telephone, Postal, and Email Contact Details.
  • Social Media Accounts, Websites Controlled, Webpages Visited.
  • Videos, Audio Recordings, Photographs, Logos, and other Visual Media.
  • Banking, Financial and Credit History Details.
  • General and Confidential Correspondence between us.

    • Who might we share your personal data with?

    To maintain and improve our services, your personal data may need to be shared with or disclosed to service providers, other Controllers or, in some cases, public authorities. We may be mandated to disclose your personal data in response to requests from a court, police services or other regulatory bodies. Where feasible, we will consult with you prior to making such disclosure and, in order to protect your privacy, we will ensure that we will disclose only the minimum amount of your information necessary for the required purpose. As part of our business processes, we also transfer, store, or share data to the following organisations, as described below: General Contacts and Scheduling data is shared with Appointlet and Google Workspace. General Contact, Service and Payment Data is shared with Stripe Payments, GoCardless & PayPal.

    Systems used to support our services

    Our services use HighLevel for enquiry forms, contact management and communications; Quals Direct for e-portfolios; our e-learning platform for online learning; Google Workspace for business communications and administration; and Divhunt for our website. Our online shop uses SureCart. The information processed depends on the service you use.

    Relevant learner information is also shared with the awarding organisation for the qualification, where needed for registration, assessment, quality assurance and certification. Organisations involved may include ProQual, GQA Qualifications, Focus Awards and IOSH, depending on the course. This does not mean that every learner’s information is shared with every awarding organisation.

    How do we look after personal data?

    We limit personal data to what is needed for the relevant purpose and use organisational and technical measures to protect it against unauthorised access, loss, damage or destruction. While information is held, we aim to keep it accurate. The retention periods and criteria are explained above.

    Your data protection rights

    Depending on the circumstances, you may ask for access to your personal data, correction of inaccurate data, erasure, restriction of processing, or object to processing. You have an absolute right to object to the use of your personal data for direct marketing. Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of earlier processing. Data portability can apply to personal data you provided where processing is automated and based on consent or contract; it is not limited to consent-based processing. These rights are subject to applicable conditions and exemptions. To exercise a right, contact services@shec.co.uk or write to our address above. We may need information to verify your identity and identify the records concerned.

    Questions and complaints

    Please contact SHEC first so that we can consider your concern. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator.

    Make a complaint to the ICO · 0303 123 1113

    Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

    Our Policy on Cookies and Tracking Codes

    Cookies are small files stored on your device. Similar technologies, including tracking pixels, can collect information about website use or interactions with communications. Their purposes may include providing requested features, remembering preferences, understanding usage and advertising. The rules governing these technologies are separate from the rules for sending marketing messages. Where consent is required, it must be a clear, informed choice; reading this notice or continuing to browse is not, by itself, consent.

    We use the following types of cookie:

    Strictly Necessary Cookies – A cookie falls into this category if it is essential to the operation of our site, supporting functions such as logging in, shopping basket, and payment transactions.
    Analytics Cookies – It is important for us to understand how you use our site, for example, how efficiently you are able to navigate around it, and what features you use. Analytics cookies enable us to gather this information, helping us to improve our site and your experience of it.
    Functionality Cookies – Functionality cookies enable us to provide additional functions to you on our site such as personalisation and remembering your saved preferences.
    Targeting Cookies – It is also important for us to know when and how often you visit our site, and which parts of it you have used (including which pages you have visited and which links you have clicked on). As with analytics cookies, this information helps us to better understand you and, in turn, to make ours site and advertising more relevant to your interests.
    Persistent Cookies – Any of the above types of cookie may be a persistent cookie. Persistent cookies are those which remain on your computer or device for a predetermined period and are activated each time you visit our site.
    Session Cookies – Any of the above types of cookie may be a session cookie. Session cookies are temporary and only remain on your computer or device from the point at which you visit our site until you close your browser. Session cookies are deleted when you close your browser.

    You can use your browser settings to manage or delete cookies. Blocking some cookies may affect website functionality. Browser settings alone do not replace any consent that is legally required before a technology is used. For questions about cookies, tracking or your choices, contact services@shec.co.uk.