Privacy Policy

Who We Are

MHE Onsite Training is operated by Brian Egerton, a sole trader based in Sleaford, South Lincolnshire. We are registered with the ICO (Information Commissioner's Office) as a data controller.

What Data We Collect

When you book a course with us, we collect:

• Your business details: Company name, contact person, email, phone, address, invoice/payment details
• Candidate details: Names, dates of birth (for eligibility checks), and in some cases evidence of prior qualifications
• Course data: Theory test results, practical assessment scores, trainer comments, and attendance records
• Site information: Details of your equipment and facilities (to plan safe training)

Why We Collect It

We collect data for the following reasons:

• To deliver training and issue certificates
• To conduct fair and accurate assessments
• To meet HSE and PUWER legal requirements for operator competence records
• To manage bookings, payments, and invoicing
• To maintain records for your audit and liability purposes (minimum 6 years retention)
• To improve our training delivery and course quality

Legal Basis

We process your data under the following legal bases:

• Contract: To deliver training services you've booked
• Legal Obligation: To comply with HSE/PUWER requirements, LOLER assessments, and tax/accounting law
• Legitimate Interest: To manage our business, run our operations, and maintain records for quality and safety

Data Retention

We retain training and assessment records for a minimum of 6 years from the date of training, to support your own legal and audit requirements. After 6 years, we delete personal data unless we have a continuing legal reason to retain it.

Booking and contact details are retained for 3 years for accounting and tax purposes (UK tax law), then deleted.

Who We Share Data With

We do not routinely share your data with third parties, except:

• Our accountant/bookkeeper: For tax and VAT purposes (if applicable)
• HM Revenue & Customs: If required by UK tax law
• Our insurers: For claims or eligibility queries related to training delivered
• At your request: If you ask us to share results with another trainer or regulator

We never sell or market your data to third parties.

Your Rights

Under UK GDPR, you have the right to:

• Access: Request a copy of the data we hold about you
• Rectification: Ask us to correct inaccurate or incomplete data
• Erasure: Request deletion of your data (subject to legal retention obligations)
• Restrict Processing: Ask us to limit how we use your data
• Portability: Request a copy of your data in a portable format
• Object: Withdraw consent or object to processing on grounds of legitimate interest

To exercise any of these rights, email us at info@mheonsitetraining.co.uk

Security

We store assessment records and certificates securely. Paper records are kept in a locked cabinet; digital records are stored on password-protected devices and backed up securely. We take reasonable steps to prevent unauthorised access or loss of data.

Data Breach Notification

If a personal data breach occurs that may affect your rights or freedoms, we will notify you and the ICO within 72 hours of discovering the breach, as required by UK GDPR Article 33. We will provide details of the nature of the breach, the likely consequences, and the measures we've taken to address it.

Complaints

If you have concerns about how we handle your data, please contact us first at info@mheonsitetraining.co.uk. If you're not satisfied with our response, you can contact the Information Commissioner's Office (ICO), who oversee data protection in the UK.

Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated date.

Last updated: September 2026
If you have any questions about our privacy practices, get in touch.