Privacy Policy

The Privacy Centre Ltd
Effective Date: July 2026

1. Introduction

The Privacy Centre Ltd is committed to protecting your personal information. This Privacy Notice explains how we collect, use, store and protect your personal data when you:

book or attend our training courses, including SIRO Training;

join or take part in the SIRO Network, including the SIRO Network Hub, Network events and newsletters; contact us or use our website.

Our website cookies are covered in our separate Cookie Policy.

2. Who We Are

The Privacy Centre Ltd is registered in England and Wales (company number 15301998) and is registered with the Information Commissioner's Office as a data controller

The Privacy Centre Ltd is the data controller for the personal information collected in connection with our SIRO training services.

If you have any questions about this Privacy Notice or how we process your personal data, please contact:

The Privacy Centre Ltd
31 Rooksmead, Bedford, MK41 7QX
Email: enquiries@theprivacycentre.co.uk

3. Personal Information We Collect

When you book or attend a training course, we may collect:

Name
Job title
Organisation name
Work email address
Telephone number
Billing and payment information
Dietary or accessibility requirements (where relevant)
Attendance records
Feedback and evaluation responses
CPD and certification information

Website Use and Technical Information

When you visit our website, we may automatically collect limited technical information, including:

IP address;
browser type and device information;
pages visited;
dates and times of access; and
website security and performance information.

We process this information to maintain website security, diagnose technical issues, prevent misuse, and improve website performance.

4. How We Use Your Information

We process your personal information to:

Manage and administer your training booking
Communicate with you about the course
Provide joining instructions and course materials
Record attendance
Issue certificates of completion or attendance
Process payments and invoices
Respond to enquiries and support requests
Improve our training services through feedback and evaluation
Comply with legal, regulatory and contractual obligations

5. Our Lawful Basis for Processing

Special category data

If you tell us about accessibility needs or dietary requirements, this may reveal information about your health or religious beliefs. We use it only to make arrangements for the course or event, rely on your explicit consent to do so, share it only with the trainer or venue where needed, and delete it within [30 days] after the event. You can withdraw your consent at any time.

Where we get your information

Most information comes directly from you. If your organisation books a course or registers you for the Network on your behalf, we receive your name, job title and work contact details from them.

Enquiries, Prospective Members and Business Contacts

We process personal information where individuals enquire about our services, training courses, consultancy support, Network membership or other professional activities.

This may include:

enquiries relating to training and events;
consultations and discovery meetings;
membership applications;
requests for proposals or quotations;
referrals and introductions;
networking activities; and
management of business relationships.

6. Marketing Communications

We may occasionally send information about future training courses, events, resources, or services that may be relevant to you.

Where required by law, we will only do so with your consent. You may withdraw your consent or unsubscribe at any time using the unsubscribe link in our emails or by contacting us directly.

You can opt out of marketing at any time, and we will always respect this. Leaving our marketing list will not end your Network membership; you will still receive essential messages about the Network and any events you have booked.

7. Sharing Your Information

We do not sell your personal information.

We may share your information with trusted service providers who help us deliver our services, including:

Training and webinar platforms
Payment and invoicing providers
Email and communication providers
Certificate and learning management systems

All third parties are required to process personal data securely and only in accordance with our instructions.

8. International Transfers

Some of our providers, including Wix.com and Microsoft, may process personal data outside the UK, including in the United States. Where this happens, we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, where the provider is certified) or the International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses. Contact us for more information about the safeguards used.

9. How Long We Keep Your Information

We will only retain personal information for as long as necessary to fulfil the purposes for which it was collected, including:

Training records and certificates: up to 6 years
Financial and invoicing records: up to 7 years
Marketing preferences: until consent is withdrawn or no longer required

Retention periods may vary where legal or regulatory requirements apply.

10. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, disclosure or destruction.

11. Your Rights

Under UK data protection law, you have the right to:

ask for a copy of your personal information (subject access);

ask us to correct inaccurate or incomplete information;

ask us to delete your information in certain circumstances;

ask us to restrict how we use your information;

object to our use of your information where we rely on legitimate interests;

object at any time to direct marketing, which we will always respect;

withdraw consent at any time, where we rely on consent;

ask us to transfer information you gave us to another organisation, where applicable.

To exercise any of these rights, email enquiries@theprivacycentre.co.uk. We will respond within one month, or tell you within that month if we need longer because your request is complex. We may ask you to confirm your identity, or to clarify your request, before we respond.

How to complain

If you are unhappy with how we have handled your personal data, or with our response to a request about your rights, please tell us first so we can put it right.

You can complain to us in any way that suits you, including by email to enquiries@theprivacycentre.co.uk, by post to The Privacy Centre Ltd, 31 Rooksmead, Bedford, MK41 7QX, or by contacting us through the Hub. You do not need to use a particular form or particular words.

When you complain, we will:

acknowledge your complaint within 30 days of receiving it;

look into it properly and without undue delay;

keep you updated on our progress; and

tell you the outcome, what we have done, and what you can do next if you remain unhappy.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint, or call 0303 123 1113. The ICO usually expects you to raise your complaint with us first.

When providing consultancy, advisory or outsourced Data Protection Officer (DPO) services, we may process personal information on behalf of our clients. In these circumstances, the client organisation will usually remain the data controller and responsible for their own privacy information and legal obligations. We act in accordance with our contractual and professional obligations when supporting our clients.

Suppliers, Associates and Business Partners

We process personal information relating to suppliers, contractors, associates, trainers, speakers, freelancers and business partners for business administration and service delivery purposes.