Privacy notice

1. Who we are

PRISM Star Training Ltd ("PRISM", "we", "us") is the controller responsible for the personal information described in this notice.

2. Information we collect and its sources

• Enquiries and correspondence: your name, email address, subject, message and information you give us when you contact us.
• Bookings: attendee name, email and telephone number, selected course and date, booking correspondence, price, discount code, payment method, payment status and transaction reference. These details come from you or the person arranging training for you. Card details are entered with Stripe, our card payment provider; our booking system records payment status and references rather than full card numbers.
• Care-provider contacts: service and provider names, CQC identifiers, service types, addresses, telephone numbers, websites, registration details and ratings, together with registered manager names where published. We obtain provider information from the Care Quality Commission's public directory and syndication API. Business email addresses and contact names may come from your organisation's public website, details you or your colleagues provide, or our previous correspondence. We record the source of email contact details.
• Relationship and marketing records: relevant contact notes, course interests, follow-ups, the source and basis for contact, consent or opt-out evidence, emails sent and available delivery, bounce, complaint and unsubscribe information.
• Technical information: information needed to deliver and secure the website, such as IP addresses and request details in hosting logs. Our QR reporting uses aggregate statistics, as explained below.

Public availability does not mean that someone has consented to marketing. CQC registration does not provide marketing permission, and the CQC directory is not an email mailing list.

Please avoid including information about care recipients, medical conditions or other sensitive personal matters in general enquiries. If we need additional information for a particular training service, we will explain its use at that point.

3. Why we use information and our lawful bases

Answering enquiries and arranging or delivering bookings

We use necessary details to take steps you request before entering a contract and to perform a contract with you. Where an employer or another organisation is the customer, we rely on our legitimate interests in managing that relationship and arranging training for its attendees.

Relevant training marketing and managing business relationships

We may rely on legitimate interests in offering relevant training to organisations and people responsible for staff development, where this is proportionate and does not override your interests or rights. Where consent is required for email marketing, we rely on consent. The additional rules for email marketing are explained below.

Keeping the website and communications reliable and secure

We rely on legitimate interests in preventing misuse, resolving faults and checking email delivery. This includes limited technical logs and records of delivery tests.

Accounts, rights requests and other legal responsibilities

We use necessary records to meet legal obligations, including applicable accounting, tax and data protection requirements. We may retain relevant evidence for our legitimate interests in establishing, exercising or defending legal claims.

You do not have to provide information for marketing. If you do not provide the contact and attendee details needed for an enquiry or booking, we may be unable to respond or arrange the requested service.

4. Training marketing and personalisation

We send emails promoting PRISM training. A message may be personally addressed and written around your service's needs, but it is still marketing.

For corporate subscribers, such as limited companies, we may send relevant business emails without prior consent where the applicable email rules allow it. When we use an identifiable person's information, we also need a lawful basis under data protection law. We assess relevance, necessity, reasonable expectations and the effect on the individual before relying on legitimate interests.

For individuals, sole traders and partnerships treated as individual subscribers, we require consent unless the existing-customer "soft opt-in" lawfully applies. That exception requires us to have obtained the details during a sale or negotiations for a sale of our own similar services, with an opportunity to opt out when the details were collected and in every marketing email. Finding an address online or in CQC information does not qualify.

We may select courses using service type, location, role, previous enquiries and interests you have shared. Staff review campaigns before sending. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.

Our provider marketing tool does not use invisible email-open tracking pixels or individual marketing-link click tracking. It keeps sending and available delivery-status records. Using an unsubscribe link records your preference. QR links have the aggregate reporting described below.

Where information comes from another source, we provide privacy information within the applicable deadline: normally no later than one month after collection, and earlier if we first contact you or disclose your information before then. You can ask us which source we used for your details.

Opting out of marketing does not prevent necessary messages about a booking or enquiry you have made.

5. Who receives information

Access is limited to people who need the information for their work. Relevant recipients include:

• PRISM staff and trainers involved in enquiries, bookings and course delivery;
• our website hosting, backup and technical support providers;
• Microsoft 365 for business email, including messages sent through our connected PRISM mailbox;
• Stripe when you choose card payment, and our bank when you pay by bank transfer;
• professional advisers, regulators or public authorities where necessary for legal responsibilities or claims.

We do not sell our contact list. Using CQC information does not mean that CQC endorses PRISM or receives our marketing contact notes. Displaying a partner's logo does not by itself involve sharing your details with that partner.

Some suppliers act on our instructions; others, such as payment providers for parts of their service, have their own responsibilities for information they collect. Further information is available in the Microsoft privacy statement and Stripe privacy policy.

6. International processing

Providers such as Microsoft and Stripe operate internationally, so information may be processed outside the United Kingdom, including in the European Economic Area and the United States.

Where we arrange a transfer subject to UK data protection transfer rules, it must be covered by UK adequacy regulations or appropriate safeguards, such as approved contractual terms with the UK International Data Transfer Addendum or International Data Transfer Agreement. The applicable arrangement depends on the recipient and service. Contact us for details of the arrangements relevant to your information and how to obtain a copy of the safeguards.

7. How long we keep information

We keep personal information only while there is a continuing need for the purpose for which we hold it. The criteria depend on the record:

• Enquiries: while the enquiry and relevant follow-up are being dealt with, and afterwards only where needed for an ongoing relationship, complaint or claim.
• Bookings and payment records: for administration of the booking and the period required by applicable accounting and tax obligations or a relevant legal claim.
• Marketing contacts: while the role and contact details remain current and relevant to our training, taking account of the source, permission evidence, last meaningful contact and any objection. We review whether continued contact remains justified and remove or update information that is no longer needed.
• Sending, delivery and technical records: while needed to investigate delivery or security issues, manage contact frequency, or demonstrate how a particular message or request was handled.
• Opt-out records: we retain the minimum contact identifier and preference for as long as necessary to avoid contacting you again, including if your details are later imported from another source.

When information is no longer needed, it is deleted or anonymised. Backup copies are removed through the relevant backup replacement cycle; they are not used as an active marketing list. You can contact us about the retention of a particular record.

8. Website technology and QR codes

The website's administration area uses session cookies to support secure sign-in. The public website code does not include advertising cookies or an analytics tracking script. Hosting services may maintain access and security logs. Card payment takes place on Stripe's service, where its own cookie and privacy information applies.

Our pages load fonts from Google Fonts. Your browser contacts Google to request them, which discloses technical connection details such as your IP address. External services and websites you choose to visit have their own privacy notices.

When you use a PRISM QR code, our QR tool records counts by code, date and broad device category, such as mobile or desktop. It does not store IP addresses, full browser identifiers or a unique visitor profile in those statistics, and it does not set tracking cookies. The destination website and the hosting server may process their own technical information separately.

9. Your rights and complaints

Depending on the circumstances and lawful basis, you can ask to access your personal information, correct inaccurate details, have information erased, restrict its use, or receive or transfer certain information in a portable form. You can also object to processing based on legitimate interests.

Your right to object to direct marketing is absolute. Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of earlier use.

Contact info@prismstartraining.co.uk or write to the address above. We may need proportionate information to confirm your identity before releasing personal records. Requests are normally free, and we normally respond within one month. If the law permits an extension or an exception applies, we will explain this.

You can raise a concern with us or complain directly to the UK Information Commissioner's Office. You do not have to complain to us first. Visit ico.org.uk/make-a-complaint for current contact details and guidance.

We update this notice when our use of information changes. The date at the top identifies the current version; material changes will be brought to your attention where appropriate.