1. Who We Are
Life Care Training Ltd is a specialist healthcare training provider delivering face-to-face statutory and mandatory training to care homes across South East England.
For the purposes of UK data protection law, the data controller is:
Life Care Training Ltd
Company number: 17108618
Registered office: The Mount, Woodlands Road, Aigburth, Liverpool L17 0AN
Email: info@lifecaretraining.uk
2. What Personal Data We Collect
We collect different types of personal data depending on how you interact with us:
Website visitors
Your IP address, browser type, device information, pages visited, and referring website. This data is collected through analytics cookies (see our Cookie Policy for details).
Enquiry form submissions
Your name, email address, phone number, job title, organisation name, and any details you include in your message.
Care home clients (managers and booking contacts)
Name, job title, email address, phone number, organisation name, billing address, and correspondence relating to training bookings.
Training delegates
Name, job title, employer name, attendance records, competency assessment results, engagement observations, and feedback form responses. This data is collected on-site during training sessions and through post-training follow-up assessments.
Digital attendance sign-in (training delegates)
When you attend a training session, you sign in on a digital attendance register. We collect:
- Your electronic signature — a signature you draw on screen with your finger when you sign in. This is a Simple Electronic Signature under UK electronic signature law (UK eIDAS). It records that you, the named delegate, signed in to that session. When you sign in, this Privacy Notice is shown to you; signing in confirms it was made available to you at that time. Signing in is how you acknowledge your attendance — it is not your consent to our use of your data. We rely on legitimate interests (see Section 3), not your agreement, to keep your training records. A named trainer is present and confirms each sign-in, and the system keeps an audit trail. The signature is not a check of your identity and is not proof of competence — it simply shows that the named delegate signed in for the session.
- Your sign-in IP address — when you sign in, our system records the internet (IP) address you signed in from. We collect this to protect the integrity of the attendance record: it gives each sign-in an audit trail so the record can be relied on as accurate evidence of who signed in and when. This is processed only for the attendance register and is separate from the website analytics described above.
Feedback and testimonials (training delegates and managers)
After a session you may be asked to complete a short evaluation — ratings, and optional free-text comments about what went well and what could be improved. Completing it is voluntary, and it is anonymous by default unless you choose to link it to your name.
The evaluation also asks three separate, optional permissions, each of which you can give or refuse independently and none of which affects your training record:
- whether we may contact you about your feedback,
- whether we may use your words as a testimonial, which may be published publicly — for example on our website or in our marketing, and
- whether we may send you information about our training.
These three are the only parts of our service that rely on your consent. You can withdraw any of them at any time by contacting us, and if you withdraw a testimonial we delete it outright and remove it from anywhere it has been published. See Section 7.
We do not intentionally collect special category personal data (such as health information, ethnicity, or religious beliefs) through our website or training registration process. If competency assessments reveal information about a delegate's physical capability (for example, during manual handling practical assessments), this data is treated with additional care and processed only for the purpose of evidencing training competency.
3. How and Why We Use Your Data
We only process personal data when we have a lawful basis to do so under UK GDPR Article 6. The information below explains what we do with your data, why, and the legal basis we rely on.
What we do
Respond to enquiries submitted through our website or by phone/email
Why
To provide you with the information or quotation you requested
Lawful basis
Article 6(1)(b) — necessary for pre-contractual steps taken at your request
What we do
Manage bookings, deliver training, and issue invoices
Why
To fulfil our contractual obligations to our care home clients
Lawful basis
Article 6(1)(b) — performance of a contract
What we do
Collect and process delegate training data (attendance — including the digital sign-in record, electronic signature, and sign-in IP address — assessments, competency records, engagement observations)
Why
To deliver the training service, issue certificates, and provide your employer with CQC-ready evidence of staff competency
Lawful basis
Article 6(1)(f) — legitimate interests (see below)
What we do
Collect voluntary evaluation feedback about a session
Why
To understand how our training is received and improve it
Lawful basis
Article 6(1)(f) — legitimate interests (feedback is anonymous by default)
What we do
Contact you about your feedback, publish your words as a testimonial, or send you our training information
Why
Only where you have separately opted in to each
Lawful basis
Article 6(1)(a) — consent, given separately for each purpose and withdrawable at any time
What we do
Send post-training follow-up assessments to delegates
Why
To support spaced retrieval learning and generate competency evidence for CQC compliance
Lawful basis
Article 6(1)(f) — legitimate interests
What we do
Send information about our training courses to care home managers who have enquired or booked with us
Why
To keep existing and prospective clients informed about relevant training services
Lawful basis
Article 6(1)(f) — legitimate interests (with opt-out in every communication)
What we do
Collect website analytics data
Why
To understand how visitors use our website so we can improve it
Lawful basis
PECR statistical purposes exception (Schedule A1, Paragraph 5) — see our Cookie Policy
What we do
Retain financial and contractual records
Why
To meet our legal obligations for tax, accounting, and regulatory purposes
Lawful basis
Article 6(1)(c) — legal obligation
Legitimate interests explanation (delegate data)
Delegates attend our training sessions as employees of our care home clients. They are not party to our contract — their employer is. We rely on legitimate interests as the lawful basis for processing delegate data because: (1) our legitimate interest is delivering and evidencing the training service that their employer has contracted, (2) processing delegate names, attendance (including the on-screen sign-in signature and the sign-in IP address captured to keep the attendance record reliable) and assessment results is necessary to fulfil this purpose, and the sign-in tick is a Privacy Notice acknowledgement, not GDPR consent, and (3) delegates reasonably expect their training provider to record their attendance and results, and this processing does not override their rights. We have conducted and documented a Legitimate Interests Assessment in accordance with ICO guidance.
4. Who We Share Your Data With
We do not sell your personal data to anyone. We do not share your data with third parties for their marketing purposes.
We may share your data with:
Your employer (for delegates)
Training attendance records, competency assessment results, engagement profiles, and certificates are shared with the care home that booked the training. This is the core purpose of the training service.
Service providers acting on our behalf
- Website hosting (Vercel Inc. — website served from European edge locations)
- Analytics (Google Analytics — acting as our data processor, not using data for its own purposes — see Cookie Policy)
- Email communications (Google Workspace)
- Automation tools (n8n, self-hosted in the UK)
- Database hosting for the digital attendance register (Supabase Pte. Ltd — a company incorporated in Singapore. Our attendance register data, including delegate sign-in records and electronic signatures, is stored in a PostgreSQL database hosted in the United Kingdom (London region). Supabase acts as our data processor under a UK-GDPR-compliant Data Processing Addendum and uses its own approved sub-processors to run the service; these include Supabase, Inc. in the United States, which provides support services. Because Supabase is based outside the UK and some of its sub-processors are also based outside the UK, see Section 5 for how international access is protected.)
The public (testimonials only, and only with your consent)
If — and only if — you have separately agreed to it, we may publish your words as a testimonial, for example on our website or in our marketing. We show a general description rather than your full details (for example "Care Manager, a Manchester home"). You can withdraw at any time and we will delete the testimonial and remove it from anywhere it has been published.
Professional advisers
Accountants, legal advisers, and insurers where necessary for business operations.
Law enforcement or regulators
Where we are required to do so by law, or to protect our legal rights.
5. International Data Transfers
Our website is hosted by Vercel, which serves content from European edge locations. We use Google Analytics, and analytics data is processed by Google LLC in the United States. This transfer is protected by appropriate safeguards under Google's published data processing terms, as required by UK GDPR: where Google has adopted an approved data protection framework for such transfers it applies that framework, and otherwise the Standard Contractual Clauses apply.
Our digital attendance register is stored in a database hosted by Supabase Pte. Ltd in the United Kingdom (London region). Supabase Pte. Ltd is incorporated in Singapore and uses sub-processors that may be based outside the UK (for example for hosting, support, operation, or monitoring of the service); these include Supabase, Inc. in the United States. Because of this, your data may be accessed from outside the UK by Supabase or its sub-processors. Where that happens, it is treated as an international data transfer and is protected by an approved safeguard — the UK Addendum to the EU Standard Contractual Clauses — under our Data Processing Addendum with Supabase, as required by UK GDPR. Supabase's current list of sub-processors is published at supabase.com/legal/customer-resources/subprocessor-list and may change over time.
Other than the transfers and access described in this section (our use of Google Analytics, and access to our attendance-register database by Supabase and its sub-processors), we do not transfer personal data outside the United Kingdom. Where any such transfer or access takes place, it is protected by an approved safeguard under our data processing agreement with the relevant provider, as required by UK GDPR.
6. How Long We Keep Your Data
We retain personal data only as long as necessary for the purpose it was collected, or as required by law. Our retention periods are aligned with the NHS Records Management Code of Practice 2021 and relevant legal requirements:
Statutory and mandatory training records
(certificates, attendance — including the digital sign-in record, electronic signature, and sign-in IP address — and assessment results for safeguarding, infection prevention, fire safety, etc.)
Retention period
10 years after training delivered
Reason
NHS Records Management Code 2021; CQC Regulation 17 evidence requirements
Other training records and competency assessments
Retention period
6 years after training delivered
Reason
NHS Records Management Code 2021
Client contractual records
(bookings, invoices, correspondence)
Retention period
6 years after contract ends
Reason
Limitation Act 1980
Financial and tax records
Retention period
6 years plus current year
Reason
HMRC requirements
Website enquiry data
(where no booking follows)
Retention period
12 months after enquiry
Reason
Data minimisation — no ongoing purpose
Marketing contact data
Retention period
Until you opt out or 2 years of inactivity
Reason
Legitimate interests balanced against your right to object
Website analytics data
Retention period
2 months (GA4 setting)
Reason
DUAA statistical exception — minimum retention
Delegate feedback form responses
Retention period
10 years (retained with training records)
Reason
Evidence of training quality for CQC and quality assurance
Why our retention periods are longer than typical
Care homes rely on our training records as evidence during CQC inspections. A care home may be inspected at any point, and inspectors expect to see evidence of staff training. If we deleted records after a short period, care homes could fail inspections because they cannot evidence staff competency. Our retention periods reflect this sector-specific need.
7. Your Rights
Under UK data protection law, you have the right to:
Access your data
Request a copy of the personal data we hold about you.
Correct your data
Ask us to correct any inaccurate or incomplete personal data.
Delete your data
Ask us to delete your personal data. We will do so unless we have a legal obligation or legitimate reason to retain it (for example, training records required for CQC evidence — see retention schedule above).
Object to processing
Object to our processing of your data where we rely on legitimate interests. We will stop processing unless we can demonstrate compelling legitimate grounds.
Restrict processing
Ask us to restrict how we use your data in certain circumstances.
Data portability
Request your data in a structured, commonly used format.
Withdraw consent
Where we rely on consent, you can withdraw it at any time by clicking the unsubscribe link or contacting us.
There are three things we do only with your consent, and you can withdraw any of them separately at any time: contacting you about your feedback, publishing your words as a testimonial, and sending you information about our training. If you withdraw a testimonial we delete it outright and remove it from anywhere it has been published.
Your training records — including your digital sign-in, electronic signature, sign-in IP address, attendance and assessment results — are different. We keep those under legitimate interests, not consent, so there is no consent to withdraw. The right that applies to them is the right to object (above), and because your employer relies on those records as evidence for CQC inspection, an objection will usually be outweighed — we will consider each case and give you our reasons in writing.
To exercise any of these rights, contact us at info@lifecaretraining.uk. We will respond within one calendar month. If we need to verify your identity before responding, the verification period does not count towards the one-month deadline (as amended by the Data (Use and Access) Act 2025).
If you are a delegate whose data we hold, please note that your training records are shared with your employer as part of the training service. If you request deletion of your training records, we will inform your employer, as this may affect their CQC compliance evidence.
8. Cookies and Analytics
Our website uses a small number of cookies for analytics purposes. We rely on the statistical purposes exception under the Privacy and Electronic Communications Regulations (as amended by the Data (Use and Access) Act 2025) for our use of analytics cookies. This means we do not require your consent to set these cookies, but you can opt out at any time.
For full details of the cookies we use and how to opt out, see our Cookie Policy.
9. How We Keep Your Data Safe
We take appropriate technical and organisational measures to protect your personal data, including:
- Secure, encrypted website (HTTPS)
- Access controls — only authorised individuals can access personal data
- Secure cloud-based tools with appropriate data processing agreements
- Regular review of data handling practices
No method of transmission or storage is completely secure. If you have concerns about data security, please contact us.
10. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in law, our services, or how we handle your data. Changes will be posted on this page with an updated "Last updated" date. We encourage you to review this page periodically.
When you sign in to a training session, the version of this Privacy Notice shown to you is a fixed, dated snapshot (recorded with your sign-in), not the live page — so the exact wording you acknowledged is always preserved, even if this page is later updated.
11. Complaints
If you are unhappy with how we have handled your personal data, please contact us first so we can try to resolve the issue.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO):
- Website: www.ico.org.uk
- Phone: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
This Privacy Policy applies to Life Care Training Ltd and the lifecaretraining.uk website.
Have questions? Contact us at info@lifecaretraining.uk