Privacy Policy

Last updated: September 2026 · UK GDPR and Data Protection Act 2018

1. Controller

Vitalform Ltd, Company No. [COMPANY NUMBER], registered office [REGISTERED OFFICE ADDRESS], is the data controller. Privacy contact / DPO: [CONTACT EMAIL].

2. Data we collect

• Identity & contact: name, email, phone, delivery/billing addresses.
• Order data: products, prices, delivery status, support correspondence.
• Payment: processed by Stripe; we never see or store full card numbers.
• Learning data: course progress, assessment results, issued certificates.
• Technical: IP address, device/browser data, essential cookies.

3. Purposes and lawful bases

• Fulfil orders and deliver training — contract.
• Tax and accounting records (kept 6 years) — legal obligation.
• Issue regulated certificates via awarding organisations (e.g. Qualsafe Awards) — contract / legitimate interests.
• Service improvement, fraud prevention — legitimate interests.
• Marketing emails — consent; withdraw anytime via unsubscribe.

4. Sharing

We share data only as needed with: Stripe (payments), awarding organisations (certificates), delivery couriers, our email/hosting providers, and HMRC or regulators where legally required. We do not sell personal data.

5. International transfers

Where providers process data outside the UK, transfers rely on UK adequacy regulations or the UK IDTA / EU SCCs with the UK addendum.

6. Retention

Order and tax records: 6 years. Course progress: access period + 24 months. Marketing data: until consent is withdrawn. Certificates: retained to allow verification, as required by awarding organisations.

7. Your rights

You may request access, rectification, erasure, restriction, portability, or object to processing. Email [CONTACT EMAIL]; we respond within one month. You may complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113.

8. Cookies

We use essential cookies only for basket and checkout operation. Analytics/marketing cookies run only with your consent via the cookie banner.