Privacy Policy

Last updated: September 2026 (version 2.0)

Company name: Tigerlily First Aid Training (Tigerlily Training Ltd)

ICO registration number: ZB927182

Contact email: hello@tigerlilytraining.co.uk

We are committed to protecting your privacy and handling your personal data in a transparent and secure manner. This Privacy Policy explains how we collect, use, store, share and delete personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are

We are a regulated first aid training provider and act as the data controller for the personal data described in this policy. Our awarding organisation, CTQ, is regulated by Ofqual; where CTQ receives learner data to certify qualifications, it acts as a data controller in its own right under its own privacy notice.

2. What Personal Data We Collect

Learners

• Name, date of birth, contact details
• Course attendance and assessment records
• Qualification results and certificate details
• Reasonable adjustment information and, where you tell us, allergy or accessibility information needed to run a course safely

Trainers

• Name and contact details
• Qualifications, CPD records, and certification
• Right to Work and identity documents
• DBS status and safeguarding records
• Course delivery, quality assurance, observation and feedback records

Clients / Organisations

• Contact details and booking information
• Training records linked to organisations
• Records of our communications with you, including recorded and transcribed calls (see Section 4)

Staff

• Employment records
• Right to Work checks
• References and training records
• Information from the monitoring of company devices and systems, as described in our Company Devices and Call Recording Policy

We only collect data that is necessary for training delivery, certification, regulatory compliance, safeguarding, quality assurance, customer service and audit purposes.

3. How We Use Personal Data

Personal data is used to:

• Deliver training and assessments
• Issue, replace, and verify certificates
• Meet awarding body and regulatory requirements
• Respond to learner, employer, or insurer enquiries
• Maintain quality assurance and audit records
• Send course confirmations and reminders, including text messages with the course date and location before a course
• Recruit, onboard, support and quality-assure our trainer network
• Contact existing and prospective business customers about our training services
• Record and transcribe telephone calls for the purposes set out in Section 4

4. Telephone Calls, Recording and Transcription

Calls to and from our office telephone system may be recorded. Recordings may be automatically transcribed and summarised using an artificial intelligence service. We do this to:

• Keep an accurate record of bookings, enquiries and instructions
• Train and support our staff and maintain the quality of our service
• Investigate complaints, incidents and disputes
• Meet our regulatory and audit obligations

Our lawful basis is our legitimate interest in running an accurate, well-managed training service. Not all extensions are recorded. Inbound callers hear a short announcement before the call is answered; existing customers and trainers are told through this policy and our written communications.

Recordings and transcripts are stored securely within our telephone system and are accessible only to authorised managers. Transcription is carried out by OpenAI as our data processor, under a written data-processing agreement; OpenAI does not use our data to train its models. Because OpenAI processes data in the United States, this transfer is made under the UK International Data Transfer Addendum. Recordings and transcripts are kept for 90 days and then automatically deleted, unless they are needed for an open complaint, investigation or legal matter, in which case they are kept until that matter is closed.

You may ask for a copy of a recording of a call you took part in, using the contact details in Section 10.

5. Lawful Basis for Processing

We process personal data under the following lawful bases:

• Legal obligation - for example, awarding body, Right to Work and safeguarding requirements
• Performance of a contract - delivering the training you or your employer have booked, and our contracts with trainers
• Legitimate interests - including public safety, certification verification, quality assurance, audit, call recording, and contacting business customers about our services
• Consent - only where we ask for it, for example where you join our optional trainer WhatsApp community

Where we process special category data (for example health information you give us for a reasonable adjustment or allergy) we do so under the employment, or substantial public interest, conditions in the Data Protection Act 2018, supported by our Appropriate Policy Document.

6. Who We Share Personal Data With

We share personal data only where necessary, with:

• CTQ, our awarding organisation, to register learners and certify qualifications
• Our trainers, who receive the learner details needed to deliver and assess a course
• Service providers who process data on our behalf under written agreements: our training database and learner portal, Microsoft 365, our telephone system provider, OpenAI (call transcription), our text-message provider, our out-of-hours call-answering service, and our accounting and payment providers
• Regulators and authorities such as Ofqual, the ICO, the Home Office (Right to Work) and the Disclosure and Barring Service, where required
• Professional advisers and insurers, where necessary to deal with a claim or dispute

We do not sell personal data, and we do not share it with third parties for their own marketing.

7. Data Storage, Security and International Transfers

• Data is stored in secure systems based in the UK or the European Economic Area, except as set out below
• Access is restricted to authorised personnel only, using role-based permissions
• Appropriate technical and organisational security measures are in place, including encryption in transit and at rest and remote-wipe of company mobile devices
• Paper records (where used) are securely stored with restricted access

Some of our service providers process data outside the UK — in particular OpenAI (United States) for call transcription and Meta (WhatsApp Business) for our trainer community channel. Where this happens we rely on the UK International Data Transfer Addendum or the UK adequacy regulations, and we carry out a transfer risk assessment.

8. How Long We Keep Personal Data

Learner and Qualification Records

Learner and certification data is retained for a minimum of four (4) years to cover the qualification period.

Due to the regulated nature of first aid training, data may be retained for up to six (6) years where required to:

• Respond to certificate replacement or verification requests
• Support awarding body audits
• Address potential civil claims relating to first aid provision

Other Records

• Call recordings and transcripts: 90 days, unless needed for an open matter
• Text-message logs and WhatsApp messages: 12 months
• Staff and trainer records are retained in line with employment and safeguarding requirements
• Financial records are retained in accordance with HMRC requirements

9. How We Delete Personal Data

When data is no longer required:

• Data is securely deleted or anonymised
• Deletion may be partial or full
• Records may be deleted individually or in batches
• Secure deletion methods are used to prevent recovery
• Certificates of destruction are obtained where third-party services are used

10. Your Rights and How to Contact Us

You have rights under UK GDPR, including:

• Right of access
• Right to rectification
• Right to erasure (where legally permitted)
• Right to restrict or object to processing, including the right to object to marketing contact at any time
• Right to data portability

Some rights may be limited where data must be retained for legal or regulatory reasons.

For privacy enquiries or data requests, please contact us at hello@tigerlilytraining.co.uk or in writing to Tigerlily Training Ltd at our registered office. We will respond within one month.

If you are not satisfied with how we have handled your data, you have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Learner Privacy Notice

This notice explains how we use learner data when delivering regulated first aid training.

What data we collect

• Name, date of birth, contact details
• Course attendance and assessment outcomes
• Qualification and certificate information
• Reasonable adjustment, allergy or accessibility information you choose to give us

Why we collect it

• To deliver training and assessments
• To issue and verify certificates
• To meet awarding body and regulatory requirements
• To send you course confirmations and reminders by email and text message

Who sees it

Your trainer, our office team, and CTQ, our awarding organisation, which certifies your qualification. If you telephone us, the call may be recorded and transcribed as described in Section 4 of our Privacy Policy.

How long we keep it

Learner records are retained for a minimum of four (4) years and up to six (6) years where required for verification, audit, or legal purposes.

Your rights

You have rights under UK GDPR, including access and correction of your data. Some rights may be restricted where we are required to retain records. You can contact us at hello@tigerlilytraining.co.uk.

Cookie Policy

Our website uses cookies to ensure it functions correctly and to improve user experience.

What are cookies?

Cookies are small text files stored on your device when you visit a website.

Cookies we use

• Essential cookies: Required for website functionality
• Performance cookies: Help us understand how visitors use the site (where enabled)

We do not use cookies to collect unnecessary personal data.

Managing cookies

You can control or disable cookies through your browser settings. Please note that disabling essential cookies may affect website functionality.

Click here to download this privacy policy