Privacy Policy

This page explains how Legacy Training Services collects, uses, stores and protects personal information.

Last updated: 6 June 2026

Who we are

Legacy Training Services is a training provider based in South Wales. We provide classroom, workplace and online training services for individuals, organisations and employers.

Legacy Training Services
Unit 11 Crownford House
Swan Street
Merthyr Tydfil
CF47 8EU

Website: https://legacytrainingservices.co.uk
Email: info@legacytrainingservices.co.uk

Information we may collect

We may collect and process personal information when you use our website, contact us, book training, attend a course, use our customer portal or interact with our services.

This may include:

  • Your name, email address, telephone number and organisation details.
  • Course booking information.
  • Learner names, contact details, attendance records and course outcomes.
  • Information needed to issue certificates and manage training records.
  • Enquiry and communication records.
  • Customer portal account and usage information.
  • Invoice, payment and administration information.
  • Website usage information, such as pages visited, browser type and basic technical information.
  • Information you choose to provide through forms, emails or direct contact.

How we use personal information

We use personal information to:

  • Respond to enquiries.
  • Manage course bookings and training administration.
  • Register learners and manage attendance.
  • Issue certificates and training records.
  • Communicate important information about courses.
  • Provide customer portal access and support.
  • Manage invoices, payments and business records.
  • Improve our services, website and customer experience.
  • Comply with legal, regulatory, accounting and contractual obligations.
  • Protect the security and integrity of our systems.

Lawful basis for using personal information

Depending on the circumstances, we process personal information on one or more of the following lawful bases:

  • Contract: where processing is necessary to provide training services or manage a booking.
  • Legal obligation: where we need to keep records for tax, accounting, regulatory or legal reasons.
  • Legitimate interests: where processing is necessary for the operation, administration and improvement of our business, provided those interests are not overridden by your rights.
  • Consent: where we ask for your permission for a specific use, such as optional marketing communications.

Sharing personal information

We only share personal information where necessary and appropriate. This may include sharing information with:

  • Trainers, tutors or assessors involved in delivering a course.
  • Employers, managers or organisations that book training for learners.
  • Trusted IT, website, email, hosting and administration providers.
  • Accounting, payment and invoicing providers.
  • Accreditation bodies, regulators or public bodies where required.
  • Professional advisers or legal authorities where necessary.

We do not sell personal information.

Use of Google services

Legacy Training Services may use Google services to support business administration, including publishing approved public course information to our Google Business Profile. Where Google account access is authorised, we only use the access granted for the purpose described at the point of authorisation.

We do not sell Google user data, use it for advertising, or share it except where necessary to provide and secure the service or comply with legal obligations. Access to Google integrations is restricted to authorised business and admin users.

Use of other third-party services

We may use trusted third-party systems to operate our services, including Microsoft 365, Google services, Xero, email delivery providers, website hosting, payment providers and other business administration tools. These providers only process data where necessary to support our services and business operations.

How long we keep information

We keep personal information only for as long as necessary for the purposes for which it was collected, including training administration, certification, customer support, legal, accounting and regulatory requirements.

Retention periods may vary depending on the type of record and the reason it is held. When information is no longer needed, we will securely delete it or anonymise it where appropriate.

How we protect information

We take reasonable technical and organisational measures to protect personal information from unauthorised access, loss, misuse or disclosure. Access is limited to authorised persons who need the information for business, training, support or administration purposes.

International transfers

Some of the systems and service providers we use may process data outside the UK. Where this happens, we take reasonable steps to ensure appropriate safeguards are in place.

Cookies and website information

Our website may use cookies or similar technologies to help the website work properly, understand usage and improve the user experience. You can control cookies through your browser settings. Some cookies may be necessary for the website to function correctly.

You can read more on our Cookie information page.

Your rights

Depending on the circumstances, you may have rights under data protection law, including the right to:

  • Request access to your personal information.
  • Ask for inaccurate information to be corrected.
  • Ask for information to be deleted.
  • Ask us to restrict how we use your information.
  • Object to certain uses of your information.
  • Request a copy of information you have provided in a portable format.
  • Withdraw consent where processing is based on consent.

These rights may not apply in every situation. For example, we may need to keep certain records for legal, contractual or regulatory reasons.

Complaints

If you have concerns about how we handle your personal information, please contact us first so we can try to resolve the matter.

You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection.

ICO website: https://ico.org.uk

Contact us

If you have any privacy-related questions or wish to exercise your rights, please contact:

Email: info@legacytrainingservices.co.uk

Legacy Training Services
Unit 11 Crownford House
Swan Street
Merthyr Tydfil
CF47 8EU

Updates to this policy

We may update this Privacy Policy from time to time. The latest version will be published on this page.