How we look after
your information

Last updated: June 2026

The Phlebotomy Trainer Ltd ("we", "us", "our") takes your privacy seriously. This Privacy Policy explains how we collect, use and protect the personal data you share with us when you visit our website, enquire about a course, or train with us. It is written to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are (the data controller)

The Phlebotomy Trainer Ltd
Company number: 15397671
Registered office: Office 4694, 58 Peregrine Road, Hainault, Ilford, Essex, IG6 3SZ, United Kingdom
ICO registration number: ZB667682
Contact for data questions: info@thephlebotomytrainer.com

2. What personal data we collect

Depending on how you interact with us, we may collect:

• Contact details: your name, email address, phone number and (where relevant) postal address.
• Course booking information: the courses you have enquired about or booked, dates attended, completion status and assessment outcomes.
• Payment information: invoice and payment confirmation details. We do not store full card numbers on our systems — payments are handled by regulated payment providers.
• Correspondence: messages you send us by email, WhatsApp, phone or contact form, and our replies.
• Website usage data: information about how you use our website, collected via cookies and analytics tools (see Section 6).
• Special category data: in limited circumstances (for example, where Hepatitis B vaccination status is required before a course), we may handle limited health information you provide. We only collect this where it is necessary, with your explicit consent.

3. How we collect your data

We collect data directly from you when you:

• fill out a contact or enquiry form on our website,
• WhatsApp, email, or telephone us about a course,
• book and attend a course with us,
• respond to a feedback request or leave a public review.

We also collect website usage data automatically when you browse our site (see Section 6).

4. Why we use your data and our lawful basis

Under UK GDPR we must have a lawful basis for processing personal data. The bases we rely on are:

Purpose	Lawful basis
Responding to enquiries and providing the courses you book	Contract
Sending course confirmations, reminders, and reference letters	Contract
Keeping records required by tax, accounting and regulatory law	Legal obligation
Sending occasional marketing emails about new courses or dates (only if you have opted in)	Consent
Improving our website and services through analytics	Legitimate interests
Handling Hepatitis B vaccination evidence or other health information you supply	Explicit consent

5. Who we share your data with

We do not sell your personal data. We share it only with trusted third parties who help us run the business, and only as much as they need to carry out their role. These include:

• Hostinger — our website hosting provider.
• Google — for email (Gmail) and analytics (Google Analytics).
• Microsoft — for Microsoft Clarity website analytics.
• Payment providers — to take payment for invoiced courses.
• The host NHS GP practice — only the information needed to confirm your placement (such as your name and competency status), where you have booked a course that includes a work experience placement.
• Professional advisers — accountants, insurers and lawyers, where required to run the business or defend our legal rights.
• Authorities — if we are required by law to share information.

6. Cookies and analytics

Our website uses cookies and similar tools to understand how visitors use the site. This helps us improve content and performance.

• Google Analytics — tracks anonymised, aggregated usage statistics (pages visited, time on site, device type).
• Microsoft Clarity — records anonymised session insights such as scroll depth and click heatmaps to help us improve the layout.

You can disable cookies in your browser settings at any time. Doing so will not prevent you from using the site, but some interactive features may not work as expected.

7. How long we keep your data

We only keep your personal data for as long as we need it for the purposes set out above, or for as long as the law requires. Typical retention periods are:

• Course booking and assessment records: 7 years after the course (to support reference letters and meet accounting obligations).
• Enquiry-only correspondence: up to 2 years from the last contact, then deleted.
• Marketing email lists: until you unsubscribe or ask us to delete your details.
• Analytics data: held for the retention period set in our Google Analytics and Microsoft Clarity accounts (typically 14 months by default).

8. Your rights

Under UK GDPR you have the following rights in relation to your personal data:

• The right to be informed about how we use your data (this policy).
• The right of access — to ask for a copy of the personal data we hold about you.
• The right to rectification — to ask us to correct inaccurate or incomplete data.
• The right to erasure ("right to be forgotten") in certain circumstances.
• The right to restrict processing in certain circumstances.
• The right to data portability — to receive certain data in a portable format.
• The right to object to processing based on legitimate interests or for direct marketing.
• Where processing is based on consent, the right to withdraw consent at any time.

To exercise any of these rights, please email info@thephlebotomytrainer.com. We will respond within one calendar month.

9. Security

We take appropriate technical and organisational measures to keep your personal data secure, including limiting access to authorised personnel and using reputable third-party providers. No system can be 100% secure, but we work to protect your data against unauthorised access, loss or disclosure.

10. International transfers

Some of our service providers (for example, Google and Microsoft) may process data outside the UK. Where this happens, we make sure appropriate safeguards are in place, such as Standard Contractual Clauses or UK Adequacy Decisions, so your data continues to receive an equivalent level of protection.

11. Children

Our courses are aimed at adults. We do not knowingly collect data from anyone under 18 without parental or guardian consent. If you believe a child has provided us with personal data, please contact us so we can delete it.

12. Complaints

If you are unhappy with how we have handled your data, please contact us first at info@thephlebotomytrainer.com so we can investigate.

You also have the right to complain to the UK Information Commissioner's Office (ICO):

Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk

13. Changes to this policy

We may update this Privacy Policy from time to time. The most recent version will always be posted on our website, with the "Last updated" date at the top changed accordingly.