Registered name: Stewart Hill Associates Limited
Trading name: Guardian Angels Training
Registered office: 272 Bath Street, Glasgow, G2 4JR
Telephone: 0141 483 4076
Email: hello@guardianangelstraining.co.uk
Website: www.guardianangelstraining.co.uk
Guardian Angels Training is the Data Controller for the personal information we process. This Privacy Notice explains how we collect, use, store, and protect your information, and outlines your rights under UK data protection law.
1. Information We Collect and Why
We collect, use, and store personal information for the following purposes:
a) To provide our training and consultancy services:
- Names, contact details, and addresses
- Date of birth (for certification or ID verification)
- Payment and transaction information
- Employment and role details (for workplace training)
- Learning progress, course completion, and assessment records
- Health information (only where necessary, e.g. allergies, access needs, or safeguarding)
b) To manage customer accounts, payments, and communication:
- Account login details and billing information
- Purchase history and course bookings
- Correspondence, call records, or enquiry details
c) For legal, safeguarding, and compliance purposes:
- Disclosure and Barring Service (DBS), Access NI, or Disclosure Scotland data (where applicable)
- Health and safety or incident records
- Evidence required by regulators, funders, or awarding bodies
d) For marketing and service updates (optional):
- Names and contact details
- Marketing preferences and communication history
- IP addresses, website usage, and cookies (see our separate Cookies Policy)
We will always limit the information we collect to what is necessary and relevant for these purposes.
2. Lawful Bases for Processing
We rely on one or more of the following lawful bases under Article 6 of the UK GDPR:
- Contract: To perform our contract with you or take steps before entering into one.
- Legal Obligation: To comply with our legal duties (e.g. accounting, safeguarding, or certification).
- Legitimate Interests: To provide training, maintain records, ensure safety, and improve our services. We only use this basis when our interests are not overridden by your rights.
- Consent: For marketing, photography, or optional communications, we will always ask for your explicit consent, which you can withdraw at any time.
For health or DBS-related data (special category or criminal conviction data), we process under Articles 9(2)(b), (g), or (h) of the UK GDPR and Schedule 1, Part 2 of the Data Protection Act 2018, as necessary for employment, education, or safeguarding purposes.
3. Data Controller and Processor Roles
Guardian Angels Training (Stewart Hill Associates Ltd) processes all personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
For the avoidance of doubt, Guardian Angels Training acts as a Data Controller for all personal data it collects and processes in connection with the delivery of training, assessment, consultancy, and related administrative activities. Where we process data on behalf of another organisation, we act as a Data Processor and only in accordance with that organisation’s documented instructions and a written Data Processing Agreement (DPA). All staff, contractors, and partners are bound by confidentiality agreements and must complete annual data protection and information security training.
4. Where We Obtain Personal Information
We collect information from:
- You directly (via registration forms, e-learning platforms, phone, or email)
- Your employer or organisation (for workplace or commissioned training)
- Referring institutions such as the NHS, local authorities, or education providers
- Publicly available sources (e.g. professional registers)
- Background or verification checks (e.g. DBS or Disclosure Scotland)
5. Sharing Personal Information
We only share personal data where it is necessary, lawful, and proportionate. This may include sharing with:
- Awarding or accreditation bodies (e.g. Skills for Health, City & Guilds)
- Employers, placement providers, or regulators (as part of training or audit)
- Professional or legal advisers
- Auditors, funding bodies, and quality assurance inspectors
- Health or emergency services (for safeguarding or incident response)
- Service providers such as IT hosts, payment processors, or e-learning platforms operating under confidentiality agreements
We do not sell, rent, or trade personal information.
6. International Data Transfers
We store and process data primarily within the United Kingdom.
If any personal data is transferred outside the UK (for example, via cloud storage or secure software platforms), we ensure protection through:
- A UK Government adequacy decision confirming equivalent data protection laws, or
- ICO-approved Standard Contractual Clauses (SCCs) that safeguard your data internationally.
7. Data Retention
We retain personal data only as long as necessary for the purpose it was collected, or to meet legal and regulatory obligations.
Typical retention periods include:
- Learner and certification records – 7 years after course completion
- Financial and invoicing records – 7 years (HMRC requirement)
- Health and safety records – 3 years, or longer where required
- DBS or safeguarding information – 6 months after decision (unless statutory guidance extends this)
- Marketing consent records – retained until consent is withdrawn
After these periods, data is securely deleted or anonymised.
8. Data Security
We maintain robust technical and organisational security measures, including:
- Secure servers, encrypted backups, and restricted access controls
- Password protection and two-factor authentication
- Staff confidentiality agreements and annual training
- Regular audits and testing of data protection procedures
If a personal data breach occurs that may risk individuals’ rights or freedoms, we will notify the Information Commissioner’s Office (ICO) and affected individuals where required by law.
9. Your Rights
Under UK data protection law, you have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate or incomplete information
- Request erasure of data (“right to be forgotten”)
- Restrict or object to specific types of processing
- Request data portability (transfer of your data to another provider)
- Withdraw consent at any time, where processing is based on consent
Requests can be submitted by emailing hello@guardianangelstraining.co.uk.
We will respond within one calendar month.
10. Automated Decision-Making
We do not perform automated decision-making or profiling that produces legal or significant effects on individuals.
11. Complaints
If you are unhappy with how we handle your personal data, please contact us first using the contact details above.
If you remain dissatisfied, you have the right to contact the Information Commissioner’s Office (ICO):
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: www.ico.org.uk/make-a-complaint
12. Updates to This Notice
We may update this Privacy Notice periodically to reflect changes in law, best practice, or our operations.
The latest version will always be available at:
www.guardianangelstraining.co.uk/privacy
Last updated: 9th October 2025