Last updated: 25 August 2026
This policy explains what personal information Bowtec collects, why we collect it, who we share it with and what rights you have over it. It covers this website and the training, testing and consultancy services we deliver.
Who we are
“Bowtec”, “we”, “us” and “our” refer to two companies that act as joint data controllers for the information described in this policy:
- Bowtec Training Services Limited — registered in England and Wales, company number 14474652. Registered office: C5 Business Centre, North Road, Bridgend Industrial Estate, Bridgend, CF31 3TP.
- Bowtec Heavy Lift Limited — registered in England and Wales, company number 16639308. Registered office: Unit 2, 50 Village Farm Industrial Estate, Pyle, Bridgend, CF33 6BN.
Both companies are responsible for the personal data handled through this website and through our training and lifting services. You can exercise your rights against either company, and contacting one counts as contacting both.
How to reach us about your data:
Email: privacy@bowtec.co.uk
Phone: 01656 502599
Post: Data Protection, Bowtec, C5 Business Centre, North Road, Bridgend, CF31 3TP
The information we collect
When you enquire or request a quote
Our enquiry form asks for your name and email address. You can also give us your company, phone number, the course category or specific course you need, experience level, preferred training location, number of delegates, a free-text message, and how you heard about us. Enquiries are stored in this website’s database and emailed to our team.
If you contact us by phone, email, WhatsApp or LinkedIn instead, we keep a record of that correspondence.
When you or your employer books training
To deliver a course, register a delegate with an awarding body and issue a certificate or card, we typically need:
- Delegate name, date of birth, contact details and employer
- A photograph, where the awarding body issues a photo ID card
- Details of existing qualifications, cards or registration numbers
- Attendance records, assessment results and instructor feedback
- Emergency contact details for the duration of a course
- Purchase order, invoicing and payment details
Where an employer books training for its staff, that employer provides us with the delegate’s details. We tell delegates how their information will be used at the point of registration.
Health and other special category information
Some courses involve operating plant, working at height or lifting operations. For those we may ask about medical conditions that affect fitness to train or operate safely, and about any adjustments you need for an assessment — for example extra time, a reader, or a language need. This is “special category” data under UK data protection law.
We only collect it where it is necessary, we keep it to the minimum, we restrict access to the staff who need it, and we do not pass it to your employer without your knowledge. Our lawful bases are your explicit consent, and our obligations and rights in the field of health and safety at work under Article 9(2)(b) UK GDPR.
When you subscribe to our newsletter
We collect your email address, and your name if you give it. We also record when you subscribed and, for delivery and reporting purposes, whether our emails were opened or clicked.
When you use this website
Our hosting and analytics tools automatically record technical information: your IP address, browser and device type, the pages you view, how you arrived at the site, and the date and time. We use this in aggregate to understand which courses people are looking for and to keep the site secure. See the Cookies section below.
Why we use it, and our lawful basis
| What we do | Lawful basis |
|---|---|
| Respond to your enquiry and prepare a quote | Steps taken at your request before entering a contract; our legitimate interest in responding to business enquiries |
| Deliver training, testing and consultancy, and manage bookings | Performance of a contract with you, or our legitimate interest in delivering a contract with your employer |
| Register delegates with awarding bodies and issue certificates and cards | Performance of a contract; our legitimate interest in operating as an approved training provider |
| Keep attendance, assessment and certification records | Legal obligation; the requirements of our awarding bodies; our legitimate interest in defending our records |
| Health, safety and welfare on our sites and courses | Legal obligation under health and safety law; protection of vital interests in an emergency |
| Invoicing, payment and accounting | Performance of a contract; legal obligation to keep financial records |
| Send newsletters and course announcements | Your consent, or our legitimate interest in marketing similar services to existing customers |
| Invite you to leave a Trustpilot review | Our legitimate interest in gathering feedback about our training |
| Site analytics, spam filtering and security | Our legitimate interest in a working, secure website |
| Handle complaints, incidents, insurance and legal claims | Our legitimate interest in establishing, exercising or defending legal claims; legal obligation |
Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights, and concluded it is not. You can object to that processing — see Your rights below.
Who we share it with
We do not sell your personal information and we do not share it for anyone else’s marketing. We do share it in these situations:
Awarding and accrediting bodies
To register delegates, record results and issue recognised qualifications and cards, we share delegate details with the relevant body — including NPORS, the ECITB, and the scheme operators behind the CCNSG Safety Passport. These bodies are independent data controllers for the records they hold, they operate their own registers and card schemes, and their own privacy policies apply. They may also audit us, which can include inspecting delegate records.
Employers and sponsors
Where an employer, agency or main contractor pays for your training, we confirm attendance, results and certification to them. Where training is delivered on a client site, we may need to share delegate names with that site for access and induction.
Service providers who process data for us
- Automattic — WordPress.com hosting, Jetpack site statistics and security, Akismet spam filtering, and Gravatar
- Brevo (formerly Sendinblue) — sends email from our website, including enquiry notifications and confirmations
- MailPoet — manages our newsletter list and sends our newsletters
- Trustpilot — handles review invitations and hosts the reviews shown on our site
- Google — maps and directions embedded on our contact page
- Our accountants, insurers, IT support and professional advisers
These providers act on our instructions under a contract and cannot use your information for their own purposes.
Legal and regulatory
We will disclose information where the law requires it — for example to the Health and Safety Executive following a reportable incident, to HMRC, to a court, or to our insurers in connection with a claim.
Sending data outside the UK
Some of our providers are based outside the UK, or store data outside it. Automattic, Trustpilot and Google are examples. Where information is transferred outside the UK, we rely on UK adequacy regulations, or on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, so that your information keeps an equivalent level of protection. You can ask us for details of the safeguards that apply to a specific transfer.
How long we keep it
| Information | Retention |
|---|---|
| Enquiries that do not lead to a booking | 24 months from your last contact with us |
| Training records, attendance and assessment results | At least the life of the certificate or card, and for as long as our awarding bodies require — commonly 3 to 6 years, and longer where a qualification has no expiry |
| Health and adjustment information | Deleted shortly after the course, unless it relates to an incident or an ongoing arrangement |
| Accident and incident records | As required by health and safety law, and for as long as a claim could be brought |
| Invoices and accounting records | 6 years after the end of the relevant financial year |
| Newsletter subscription | Until you unsubscribe, plus a suppression record so we do not email you again |
| Website email delivery logs | 14 days |
| Website analytics | Held in aggregate by Jetpack; individual visit data is not retained by us |
When a retention period ends we delete the information or anonymise it so it can no longer identify you.
Cookies
Cookies are small files stored on your device. This site uses:
- Essential cookies — needed to make the site work, remember your form entries and keep it secure. These do not require your consent.
- Analytics cookies — Jetpack Stats, which tells us how many people visit and which course pages they look at.
- Third-party cookies — set by embedded content such as Google Maps and Trustpilot when those elements load.
You can block or delete cookies through your browser settings. Blocking essential cookies may stop parts of the site working, including the enquiry form.
Marketing and how to stop it
We send course announcements, new accreditations and news to people who have subscribed, and to existing customers about training similar to what they have already booked. Every email has an unsubscribe link, and you can also email privacy@bowtec.co.uk at any time. Unsubscribing takes effect immediately and does not affect any training you have booked — we will still send you the emails needed to run your course.
Your rights
Under UK data protection law you can ask us to:
- Give you a copy of the personal information we hold about you
- Correct anything inaccurate or incomplete
- Delete information we no longer have a good reason to keep
- Restrict how we use it while a concern is resolved
- Transfer it to you or another organisation in a machine-readable format
- Stop using it for direct marketing — this one is absolute, and we will always act on it
- Object to processing we base on legitimate interests
- Withdraw consent you have given, without affecting anything done before you withdrew it
Email privacy@bowtec.co.uk and we will respond within one month. There is no charge. We may ask you to confirm your identity first. Some rights have limits — for example we cannot delete a training record an awarding body requires us to keep, and we cannot delete records we need for a legal claim.
Keeping your information secure
We use encrypted connections for this website, restrict access to delegate records to staff who need it, and require our providers to maintain appropriate security. No system is completely secure, but if a breach happens that is likely to put your rights at risk, we will tell you and report it to the Information Commissioner’s Office within 72 hours.
Automated decision-making
We do not make decisions about you by automated means alone. Course assessments and test results are decided by a qualified instructor or assessor.
Children
Our training is for people in work and this website is not aimed at children. Where we train a delegate under 18 — for example an apprentice — we ask for their employer’s confirmation and, where appropriate, parental consent.
Changes to this policy
We update this policy when our services or systems change. The date at the top shows the current version. Significant changes will be flagged on this page.
Complaints
If you are unhappy with how we have handled your information, please contact us first at privacy@bowtec.co.uk so we can put it right.
You can also complain to the Information Commissioner’s Office, the UK regulator for data protection:
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk