We act as a booking agent for partner training providers: we take your booking and payment, then share the booking and delegate details needed with the training provider delivering your selected course and relevant awarding or certification bodies to arrange your booking, administer attendance, register results and issue certification. The training provider is also responsible for the information they hold for these purposes.

We also use trusted service suppliers to run this website, send email and take card payments. They only handle your information to provide that service to us. We never sell your information.

What you type into the enquiry and booking forms: your name, company, telephone number and email; the course, dates, location and number of people you ask about; and, if you give them, a site address, purchase order number, invoice email and CSCS/CITB number. When you book for other people, we also keep the names, employers and emails of the delegates you add — please make sure they know you are booking them.

• To answer your enquiry, book and confirm the course, take payment or invoice you, and handle transfers, cancellations and refunds — because it is needed to arrange the training you asked for (contract).
• To keep payment and invoice records — because tax and accounting law requires it (legal obligation).
• To email you course offers, deals and new dates — only if you tick the box on the form (consent). The box is unticked until you tick it. You can ask us to stop at any time and we will take you off the list.

Card payments are taken on a secure payment page run by our payment provider, Stripe. KVK Group never sees or stores your full card number. We keep a record of the payment — who paid, what was bought, the amount, the date and the receipt or invoice.

Stripe may process payment information outside the UK; where it does, it uses the legal safeguards UK data protection law requires.

On our public training website, Google Ads measures visits and completed paid training bookings to assess and improve our adverts. In the UK and other regions requiring permission, Google measurement loads only after you accept optional cookies. Rejecting is equally easy and does not affect booking or payment. Where permission is not required, measurement may operate unless you opt out. We honour your browser’s Global Privacy Control.

Google receives browser and device information, ad-click identifiers where available, and a booking reference, paid amount and currency for a completed purchase. We do not send names, email addresses, delegate details or construction site records to Google. Measurement is not installed on the operational portal or public site QR journeys. Google may process data outside the UK; see Google’s business data privacy information.

Cookie settings at the bottom of public training pages lets you change or withdraw your choice. We keep a random browser reference, your choices, their dates, region and the notice shown in your browser as permission evidence, plus the choice reference for a measured booking. These remain until you clear your browser storage. Withdrawal stops future optional measurement; it does not undo earlier reports. Events blocked by a refusal are not replayed when you later accept. Essential basket and payment storage is separate and continues to work.

• Enquiries that do not lead to a booking: removed after 12 months.
• Bookings, payment records, receipts and invoices: kept for 6 years.
• Marketing list: kept until you ask us to stop, then your email is kept only as a note not to contact you again.

You can ask for a copy of the information we hold about you, ask for anything wrong to be corrected, ask for it to be removed, or object to how it is used. Email info@kvkgroup.co.uk and we will respond within one month.

The construction company that inducted you onto the site decides what is collected and why — they are responsible for it (the data controller). KVK Group Ltd runs the system that holds it on their behalf (the data processor), and only uses it to keep the system running.

Your name, employer and trade; a phone number or email so the site can contact you; the cards and certificates you upload, with their numbers and expiry dates; a photograph of you so the site can confirm who you are; your answers to the induction questions, including the health self-certification; your National Insurance number where the site asks for it; an emergency contact; your signature; and the times you sign in and out. If the site has asked for it, your position at the moment you scan the sign-in code is recorded, to confirm you were at the site. If the site has switched it on, a time-stamped photo is taken when you sign in or out as evidence it was you — it is kept private to authorised managers and is never used to identify faces automatically.

To meet health and safety law: to know who is on site, that they are inducted, that they are competent and qualified for the work, and to be able to account for everyone in an emergency or an investigation. Health answers are used only to make sure the work you are given is safe for you.

Only the managers and supervisors at the company that inducted you, and only the parts their job requires. Your National Insurance number, health answers and emergency contact are hidden by default: someone has to ask to see them and give a reason, and every time that happens it is recorded — who looked, at what, when and why.

Site records are never sold, and are not shared outside that company unless the law requires it (for example the Health and Safety Executive after a reportable incident).

• Sign-in and sign-out records: kept as the site's record of who was there.
• Sign-in and sign-out photos: kept for the length of time each site has chosen.
• Positions recorded when you scan a sign-in code: cleared after 6 months.
• Photographs taken when you sign RAMS: removed once the job is finished.
• Induction and training records: kept while you work for the company and afterwards as its safety record.
• National Insurance number, health answers and emergency contact: cleared 3 years after you leave.
• Records of changes and of who looked at personal details: kept for 6 years.

You can ask for a copy of everything held about you, ask for something wrong to be corrected, or ask for your details to be removed. Ask the company that inducted you first — they can do all three from their portal. If you cannot reach them, email info@kvkgroup.co.uk and we will pass it on.

Everything held in a company's portal — including your own account — belongs to that company: they are responsible for it (the data controller) and decide who gets an account and what it can do. KVK Group Ltd runs the system on their behalf.

Your name, work email address and the role and permissions your employer gives you. The portal also keeps a record of what each account does — who approved a document, corrected a timesheet, looked at a personal detail or changed a setting — because safety records must show who did what.

Your account and its records are kept while your employer's account with us is open; audit records of what was done and who did it are kept for 6 years. Your employer removes your account when you leave.

Ask your employer — they manage portal accounts and can correct or remove your details from their portal. If you cannot reach them, email info@kvkgroup.co.uk.

Questions about any part of this notice: info@kvkgroup.co.uk. If you are unhappy with how your information has been handled you can complain to the Information Commissioner's Office at ico.org.uk.

Last updated: 5 November 2026.