Privacy Policy

Who We Are

MHE Onsite Training is operated by Brian Egerton, a sole trader based in Sleaford, Lincolnshire. We are the data controller for the personal data described in this policy, and we are registered with the Information Commissioner's Office (ICO), registration number ZC256822. You can contact us by email at info@mheonsitetraining.co.uk or by phone on 07522 121764.

This policy covers people who use our website or contact us, the businesses that book training, and the candidates we train.

Information We Collect

When you use our website

• Quote and enquiry form: your name, email address and training location, plus anything else you choose to add (company, phone number, number of candidates, course type, equipment, preferred dates and your message).
• Emails and phone calls: your contact details and whatever you tell us.
• Website usage: only if you accept cookies, Google Analytics and Google Ads record how you use the site and whether you came from one of our adverts. See our Cookie Policy.
• Technical data: like any website, our hosting provider receives your IP address and browser details when you load a page. This is used to deliver the site and protect it from attacks.

When your business books training

• Booking contact: company name, contact name, email, phone, site address, and invoice and payment details.
• Site information: details of your equipment and training area, so we can plan safe training.

About candidates we train

• Identity and eligibility: name, employer, date of birth (to confirm candidates meet the minimum age), and evidence of previous training where relevant.
• Training records: attendance, theory test results, practical assessment results, instructor notes, course feedback, and the certificate issued.
• Fitness to train: see the next section.

Candidate details usually come to us from their employer when the course is booked. We give every candidate a short privacy notice on the first day of training explaining how we use their information.

Health and Fitness Information

Operating a forklift safely needs a reasonable level of fitness. Before training, the employer confirms that each candidate is fit to operate the equipment. On the first day, the instructor makes a visual check and asks each candidate to confirm that they are fit to take part.

We record only that confirmation. We do not ask for, or keep, details of medical conditions. If a candidate tells us about a health matter that affects their safety or other people's, we note only what is needed to keep everyone safe. We may tell their employer, who is responsible for their fitness for work.

Health information is special category data under UK GDPR. We handle it only where it is needed to meet health and safety obligations. We keep it with the candidate's training record, and only the instructor has access to it.

Why We Use It, and Our Legal Basis

• Replying to enquiries and preparing quotes: legitimate interests (responding to people who contact us), or steps before entering a contract.
• Delivering training, assessing candidates and issuing certificates: contract with the booking business, and legitimate interests in relation to candidates.
• Keeping training records: legitimate interests, and to help employers meet their duties under the Health and Safety at Work Act, PUWER 1998 and HSE ACOP L117 to show their operators are trained.
• Invoicing, payments and accounts: contract and legal obligation (tax law).
• Fitness to train: health and safety obligations, as explained above.
• Website analytics and advertising measurement: your consent, given through our cookie banner. You can withdraw it at any time.
• Improving our courses: legitimate interests, using course feedback.

We do not use your information for automated decision-making, and we never sell it.

Who We Share It With

We use a small number of service providers who handle data for us under contract:

• Google: business email and file storage (Google Workspace), and website analytics and advertising (Google Analytics and Google Ads, only if you accept cookies).
• Cloudflare: hosts our website and runs the enquiry form.
• Resend: sends the emails generated by our enquiry form, both the notification to us and the confirmation to you.

We may also share information with:

• The booking employer: candidates' results, certificates and any safety concerns.
• Our accountant or bookkeeping provider: invoices and payment records.
• HM Revenue & Customs: where required by tax law.
• Our insurers and legal advisers: if there is a claim or dispute.
• Regulators or the police: only where the law requires it.
• Another training provider: only at your request.

International Transfers

Google, Cloudflare and Resend are based in, or use servers in, the United States and other countries outside the UK. Where personal data is transferred outside the UK, it is protected by UK adequacy regulations (including the UK–US “data bridge” for certified US companies) or by the provider's UK-approved data transfer clauses.

How Long We Keep It

• Enquiries that don't lead to a booking: 12 months from our last contact, then deleted.
• Training and assessment records, including fitness confirmations: 3 years from the end of the course, then deleted. Employers should keep their own copy of certificates for their records.
• Invoices, payment and booking records: 6 years from the end of the tax year they relate to, as required for HMRC, then deleted.
• Website analytics: Google Analytics keeps data for no more than 14 months.

We may keep information for longer if it's needed for an ongoing claim, dispute or legal requirement, and only for as long as that lasts.

Your Rights

Under UK GDPR you have the right to:

• Access: ask for a copy of the information we hold about you
• Rectification: ask us to correct anything inaccurate or incomplete
• Erasure: ask us to delete your information, where we don't need to keep it by law
• Restriction: ask us to limit how we use it
• Portability: ask for your information in a portable format
• Objection: object to us using it on the basis of legitimate interests
• Withdraw consent: change your cookie choice at any time using “Cookie Settings” in the footer

To use any of these rights, email info@mheonsitetraining.co.uk or call 07522 121764. We'll reply within one month.

Security

Paper records are kept in a locked cabinet. Digital records are stored on password-protected devices and in a password-protected Google Workspace account, and are backed up securely. Only Brian Egerton has access to training records.

Data Breaches

If a personal data breach is likely to put your rights at risk, we will report it to the ICO within 72 hours of finding out. If the risk to you is high, we will tell you directly.

Complaints

If you're unhappy with how we've handled your information, please contact us first at info@mheonsitetraining.co.uk. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint or 0303 123 1113.

Changes to This Policy

We will update this page if the way we handle personal data changes.

Last updated: 7 October 2026