Privacy Policy

1. INTRODUCTION

Welcome to MCR First Aid Training. MCR First Aid Training (trading as “Anna’s First Aid Training”) is a sole trader business operated by Anna Kolder. We are committed to protecting and respecting your privacy when you visit our website, make an enquiry via our web forms, or book a training course with us. For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Anna Kolder is the Data Controller of your personal information. We are committed to protecting the privacy, safety, and security of our trainees, ensuring all training—from basic first aid to advanced safety assessments—is conducted to the highest standards of data integrity.

2. THE DATA WE COLLECT AND WHY WE COLLECT IT

To provide accredited training and certification across the UK, we collect specific categories of personal data. In line with the principle of Data Minimisation, we collect only the information strictly necessary for our services[cite: 1, 2].

Standard Personal Data / Identity & Contact Data: This includes your name, contact details (email, phone number), and billing address. We process this data to fulfil our contract with you regarding course bookings (Article 6(1)(b) UK GDPR) and to respond to training enquiries (Article 6(1)(f) - Legitimate Interests).
Training and Certification Data: This includes courses attended, assessment results, and certificate numbers. We process this to manage your training records and issue valid, accredited certifications (Article 6(1)(b) UK GDPR).
Special Category Data (Health Information): Because first aid training involves physical assessments (e.g., CPR), we may collect information regarding medical conditions or disabilities that impact your ability to participate safely. We process this highly sensitive data only upon receiving your explicit consent (Article 9(2)(a) UK GDPR) and to ensure the safety of participants during practical assessments (Article 9(2)(h) UK GDPR).
Marketing and Communication Data: This includes your preferences for receiving renewal reminders or training updates. We process this based on your Consent or via the “Soft Opt-in” for existing clients (Article 6(1)(a) UK GDPR).

While we maintain strict confidentiality regarding your training records, legal and professional obligations limit this privacy. We do not sell your personal data. We may be required to share data with third parties without your prior consent in the following circumstances:

Awarding Bodies: We share data with external organisations that require your details to issue your official accreditation/certificates.
Legal and Safety Obligations: We may disclose information if a UK court of law compels us or if there is a serious risk to the safety of individuals during a training session.
Service Providers (Training & Communication): We use professional systems to manage course enrolments and issue accredited certificates. We also utilise secure email and productivity suites for all training coordination.
Payment Gateways: We use encrypted payment processors to handle session fees. We do not store your full credit card details on our own systems.

International Transfers: To facilitate our accredited services, we use secure, GDPR-compliant third-party processors. Where these providers process data outside the UK/EEA (e.g., using US-based cloud tools), we ensure appropriate safeguards—such as Standard Contractual Clauses (SCCs)—are in place.

4. DATA RETENTION

In line with the principle of Storage Limitation and our obligations to accreditation bodies, we retain data only for as long as necessary:

Training and Certification Records: We retain certification history for 6 years to facilitate renewals, audits, and regulatory compliance.
Marketing Data: We retain contact details until you withdraw consent or after a period of 24 months of inactivity.
Enquiries: Information provided via web forms that does not lead to a booking is deleted after 6 months.

5. YOUR LEGAL RIGHTS

Under the UK GDPR, you have the right to:

Access your data by requesting a copy of the records we hold.
Rectify inaccuracies in your training or contact information.
Erase your data, noting that this does not include training records we are legally or professionally obliged to retain for certification purposes.
Restrict or Object to certain types of processing.
Request Data Portability.

6. CONTACT INFORMATION & COMPLAINTS

If you have any questions regarding this policy or wish to exercise your legal rights, please get in touch with our Data Protection Lead:

Data Protection Lead: Anna Kolder.
Email: mcrfirstaidtraining@gmail.com.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) (www.ico.org.uk) if you believe your data is being mishandled.