Privacy Policy - Training Progress

Version 3

Date 22/9/26

1.About this Privacy Notice
2. Who we are and how to contact us
3. When Training-Progress is the data controller
4. What personal data we collect as controller
5. How we use your personal data
6. Where we get personal data from
7. Marketing
8. Who we share personal data with
9. International transfers
10. How we protect personal data
11. How long we keep personal data
12. When Training-Progress is the data processor
13. Sub-processors
14. Your data protection rights
15. Cookies and website analytics
16. Complaints
17. Changes to this notice

1. About this Privacy Notice

Training-Progress Ltd respects your privacy and is committed to protecting your personal data.

This Privacy Notice explains how we collect, use, store and protect personal data.

Depending on the circumstances, Training-Progress may act either as a data controller or as a data processor.

When we are the data controller, we decide why and how your personal data is used. This includes information we collect through our website and in the course of running our business.

When we are the data processor, we process personal data on behalf of one of our customers, such as a veterinary practice using the Training-Progress platform. In these circumstances, our customer is the data controller and determines how and why your personal data is processed.

2. Who we are and how to contact us

If you have any questions about this privacy notice or our privacy practices, please contact us in the following ways:

Training-Progress Ltd

Email address: info@Training-Progress.com
Postal address: Training-Progress Ltd, Milner Mount Farm, Menwith Hill, Harrogate HG3 2RN

Telephone number: 01423 313323

3. When Training-Progress is the data controller

Training-Progress is the data controller when we decide why personal data is collected and how it is used for our own business purposes.

This includes personal data we use to operate and develop our business, provide and support our services, communicate with customers and prospective customers, manage our website, administer payments and accounts, and manage our relationships with suppliers, partners and other professional contacts.

We may act as the data controller when we process personal data relating to:

Prospective customers and business contacts – for example, when you contact us, request information, register your interest in Training-Progress, book a demonstration, attend one of our events or otherwise communicate with us about our services.
Customers and customer contacts – to manage our commercial relationship, provide and support Training-Progress services, arrange onboarding, communicate about accounts and services, and maintain appropriate business records.
Marketing contacts – to send relevant information about Training-Progress, our services, training, events and other activities, where permitted by law and in accordance with your communication preferences.
Event and webinar contacts – where we receive information directly from attendees or from event organisers or other third parties where this information has been provided for business or networking purposes.
People who contact us for support or information – including information provided by email, telephone, website forms or our online chat service.
People who purchase Training-Progress services or training – including information needed to process purchases, manage subscriptions, issue invoices, take payments and provide support.
Suppliers, contractors, advisers and business partners – where we need personal information to manage our business relationships and obtain or provide professional services.
Job applicants and people who work with Training-Progress – including employees, contractors, freelancers and other individuals who work with or apply to work with us.
Website users – where we collect information about the use of our website, including information collected through cookies, analytics and similar technologies, where applicable.

The personal data we process in these circumstances may include names, contact details, business and job information, communications and correspondence, transaction and payment information, technical information and other information relevant to the particular relationship or activity.

Further information about how Training-Progress processes personal data on behalf of our customers is provided in Section 12 – When Training-Progress is the data processor

4. What personal data we collect as controller

The personal data we collect depends on how you interact with Training-Progress and the reason we need your information.

Information you provide when you contact us or enquire about our services

name and title
work or personal email address, where provided
work or personal telephone number, where provided
business name, job role and other professional information
business address or location information
information contained in your communications with us, including enquiries, requests and feedback.

Information about customers and people who use our services

name and contact details
job role and business information
information needed to manage our relationship with you and provide customer support
information about services, training or subscriptions purchased
training or service-related information where this is necessary to provide or administer the service
records of communications and interactions with us.

Information collected through events and marketing activities

name, job role and business details
contact details
information about events you have attended or registered for
marketing preferences and information about your interactions with our marketing communications
information supplied to us by event organisers or other third parties where they are permitted to provide it to us
information obtained from third-party business contact or marketing lists.

Information relating to purchases and payments

details of products, services, training or subscriptions purchased
billing and invoice information
payment information needed to process payments
records of transactions and payments.

We use payment providers to process card and other electronic payments. We do not need to receive or store your full card details ourselves when you pay through these services.

Information about people who work with Training-Progress
If you work for us, apply for a role, or provide services to us as a contractor, freelancer, adviser or other professional contact, we may process information such as:

name and contact details
date of birth, where necessary
employment or contractual information
qualifications and professional information
bank, tax and pension information where needed for payment or employment administration
emergency or next-of-kin information where appropriate
information relating to performance, capability or disciplinary matters
health information where this is necessary for employment or other legitimate business purposes and permitted by law.

Information collected when you use our website
Depending on how you use our website, we may collect:

information submitted through website forms
information provided through our online support chat
technical information such as IP address and information about how our website is used
information collected through cookies and similar technologies.

We explain our use of cookies and website analytics in Section 15.

People working for our customers: We may hold contact details for individual employees or other team members of our customers where they provide those details directly to us, for example when contacting us for support, booking a meeting or using our website chat. We do not routinely extract contact details from the Training-Progress platform to use them for our own marketing.

5. How we use your personal data

We use personal data for the following purposes:

Providing and supporting our services

To set up and manage accounts and subscriptions.
To provide customer support and respond to enquiries.
To arrange and manage meetings, demonstrations, onboarding and other communications.
To maintain appropriate records of our customer and business relationships.

Managing our business relationships

To communicate with customers, prospects, suppliers, professional contacts and business partners.
To manage contracts and other business arrangements.
To understand and improve our relationships and services.

Purchases and payments

To process orders, subscriptions, invoices and payments.
To maintain financial and transaction records.
To manage credit control and related administration.

Marketing and communications

To send information about Training-Progress, our services, training, events and related activities where permitted by law.
To follow up with people who have expressed an interest in our services.
To understand how people respond to our marketing and improve our communications.
To manage marketing preferences and requests not to receive marketing.

Improving and developing our services

To understand how our services and website are used.
To gather feedback and improve our products, training and customer experience.
To analyse our business, events and marketing activity and plan future development.

Website, systems and security

To respond to website enquiries and support requests.
To maintain the security and proper operation of our websites, systems and services.
To prevent and investigate fraud, misuse, security incidents and other unauthorised activity.
To monitor and improve system performance where permitted.

Legal and regulatory purposes

To comply with legal, regulatory and professional obligations.
To keep records where required by law.
To respond to lawful requests from regulators, authorities or law-enforcement bodies.
To establish, exercise or defend our legal rights and manage disputes.

People working for Training-Progress

To recruit and manage employees, contractors and other people working with us.
To manage contracts, payroll, tax, pensions, qualifications, performance and capability.
To meet our health and safety and other employment-related obligations.

Our lawful bases for using personal data

Depending on the purpose and circumstances, we rely on one or more of the following lawful bases under UK data protection law:

Contract: where we need to use personal data to enter into or perform a contract with you, such as providing our services, managing an account or processing a purchase.
Legal obligation: where we need to use personal data to comply with a legal or regulatory requirement, such as certain financial, tax, employment or regulatory obligations.
Legitimate interests: where using personal data is necessary for our legitimate interests, and those interests are not overridden by the individual’s rights and interests.
Consent: where we have asked for and obtained your consent to use personal data for a particular purpose. Where we rely on consent, you can withdraw it at any time.

Our legitimate interests may include managing and developing our business, maintaining relationships with customers and professional contacts, providing and improving our services, communicating with relevant business contacts, protecting our systems and information, preventing fraud and misuse, and establishing or defending legal claims.

Where we rely on legitimate interests, we consider whether the use of personal data is necessary and proportionate and balance our interests against the individual’s rights and freedoms.

For direct marketing, we will only rely on consent or legitimate interests where this is permitted by applicable data protection and electronic marketing laws. You have an absolute right to object to direct marketing, as explained in Section 14 – Your data protection rights.

Where we process special category data, such as health information, we will only do so where we have both a lawful basis under Article 6 and an appropriate additional condition under Article 9 of the UK GDPR and any other applicable law.

6. Where we get personal data from

We may collect personal data directly from you, or receive it from other sources depending on how you interact with Training-Progress.

We may obtain personal data from:

You directly

when you contact us by email, telephone, website form or online chat
when you request information, book a demonstration or meeting, or ask for support
when you purchase a service or training
when you register for or attend an event, webinar or other activity organised by us
when you communicate with us about your account, subscription or services
when you provide feedback or complete a survey
when you apply for a job or work with us as an employee, contractor or other professional.

Events and event organisers
We may receive contact details from organisations that organise conferences, exhibitions, webinars or other professional events that we attend or participate in. This may include information about attendees or people who have expressed an interest in the event.

Business and marketing information providers
From time to time, we may obtain business contact information from third-party providers of business or marketing data. Where we do this, we expect the provider to have obtained and supplied the information lawfully and to provide information about its source and permitted use where required.

Our customers and other organisations
We may receive contact details from organisations we work with, for example where a customer provides contact details for an individual who needs support, training, onboarding or other assistance.

Publicly available sources
We may use information that has been made publicly available, such as professional information published on company websites or other business-related sources, where appropriate for our business activities.

Service providers and other third parties
We may receive or generate information through the systems and services we use to operate our business, such as our CRM, website, scheduling, payment, accounting, email and support systems.

Where we receive personal data from another organisation, we will use it only where we have a lawful basis to do so and will provide the information required by data protection law about how we use it, unless an exception applies.

If you provide us with personal data about someone else, you should make sure you are authorised to do so and that they have been given any information they need about how their data will be used.

7. Marketing

We may use your personal data to send you information about Training-Progress, our services, training, events and other activities that we think may be relevant to you.

Our marketing may include email, telephone calls and, where appropriate, other forms of communication.

How we decide whether to contact you

Where you have asked us to contact you, expressed an interest in Training-Progress, attended one of our events or otherwise have an existing relationship with us, we may contact you about relevant products, services or activities where permitted by law.

For other business contacts, we may rely on legitimate interests where this is an appropriate lawful basis. Before doing so, we consider whether the marketing is reasonably expected, whether it is relevant to the person’s business role or relationship with us, and whether the individual’s interests or rights are likely to override our interests.

Different rules can apply depending on whether we are contacting a company or another type of organisation, or an individual such as a sole trader. We will follow the applicable rules for the type of contact and communication we are using.

Marketing from third-party sources

We may receive business contact information from event organisers or third-party marketing or business-data providers. Where we use information obtained in this way for marketing, we will take appropriate steps to ensure that the information can lawfully be used for that purpose and that any required privacy information is provided.

Telephone marketing

Where we make live marketing calls, we will check the applicable telephone preference services and our own records of people who have asked us not to call, where required.

Your right to opt out

You have an absolute right to object to direct marketing and can ask us to stop sending you marketing communications at any time.

Our marketing emails include an unsubscribe or opt-out facility. You can also contact us directly if you no longer wish to receive marketing communications from us.

If you opt out of marketing, we will retain enough information to record your request and ensure that we respect it. You may still receive non-marketing communications that we need to send to you, such as messages about a service you have purchased, your account, payments or customer support.

Keeping your preferences up to date

We will make reasonable efforts to keep our marketing records accurate and to respect your communication preferences. If your contact details or preferences change, please let us know.

8. Who we share personal data with

We only share personal data where we have a valid reason to do so, such as providing our services, running our business, processing payments, complying with legal obligations or using specialist service providers.

Depending on why we are processing your information, we may share personal data with:

Service providers who support our business
We use trusted suppliers to help us operate Training-Progress. This may include providers of:

customer relationship management (CRM) and communication systems
website hosting, support chat and website services
email and scheduling services
payment processing and direct debit services
accounting, invoicing and payroll services
IT, security and technical services
survey, event and marketing services.

Where a supplier processes personal data on our behalf, we put appropriate contractual and security arrangements in place. Some of these suppliers may act as our data processors, while others may process personal data for their own purposes. Where they process data on our behalf, they are only permitted to use it in accordance with our instructions and applicable data protection requirements.

Professional advisers and business partners
We may share relevant information with professional advisers such as accountants, auditors, lawyers, insurers and other advisers where necessary to provide their services to us or to protect our legal and business interests.

We may also share relevant contact information with business partners or event organisers where this is appropriate to manage an event, partnership or other business activity and where we have a lawful basis for doing so.

Payment and financial service providers
Where you make a payment, relevant information may be shared with payment and financial service providers so that the payment can be processed and recorded. For example, we use specialist providers for card payments and direct debit payments. We do not need to receive or store your full card details when you pay through these services.

HMRC, regulators and other authorities
We may disclose personal data where required by law or where necessary to respond to a lawful request from a regulator, government body, court or law enforcement authority.

Other organisations where necessary to protect our interests
We may share information where necessary to establish, exercise or defend legal claims, prevent fraud or misuse, protect the security of our systems, or protect the rights, property or safety of Training-Progress, our customers or others.

Customer data processed through Training-Progress

When a customer uses the Training-Progress platform to store and manage information about its employees, contractors or other individuals, the customer will generally be the data controller and Training-Progress will act as the data processor.

In these circumstances, we process that personal data on the customer’s instructions and do not use it for our own marketing or other independent purposes. More information about this role is provided in Section 12 – When Training-Progress is the data processor.

We do not sell personal data

We do not sell personal data to third parties.

9. International transfers

Some of the organisations we use to provide our services may process personal data outside the UK. This may include service providers such as Microsoft, Jotform, SurveyMonkey, Xero, Stripe and Tawk.to.

Where personal data is transferred outside the UK, we will ensure that the transfer is made in accordance with applicable data protection law and is covered by an appropriate transfer mechanism.

Depending on the circumstances, this may include:

a country or organisation being covered by UK adequacy regulations;
appropriate safeguards such as the UK International Data Transfer Agreement (IDTA) or UK Addendum to approved standard contractual clauses; or
another lawful transfer mechanism where permitted by law.

Where appropriate safeguards are used, we will take the steps required by applicable law to ensure that the personal data continues to receive an appropriate level of protection.

Further information about the safeguards used for specific international transfers, including copies of relevant contractual safeguards where appropriate, is available on request.

The organisations we use and their processing arrangements may change from time to time. We review our suppliers and international transfer arrangements to ensure that appropriate safeguards remain in place.

10. How we protect personal data

We take the security of your personal data seriously and use appropriate technical and organisational measures to protect it from being lost, misused, accessed without authorisation, altered or disclosed.

Our security measures include, where appropriate:

access controls so that personal data is only available to people who need it for their role;
multi-factor authentication and other account security measures;
encryption and secure transmission of data where appropriate;
secure systems and services provided by trusted technology suppliers;
regular software, system and security updates;
measures to protect our systems against malware, unauthorised access and other security threats;
staff awareness and training in data protection and information security; and
procedures for identifying, responding to and managing data security incidents.

We regularly review our security arrangements and take reasonable steps to ensure that the systems and services we use continue to provide an appropriate level of protection.

No method of transmitting or storing information can be guaranteed to be completely secure. If we become aware of a personal data breach that is likely to result in a risk to individuals’ rights and freedoms, we will take appropriate action in accordance with our legal obligations, including notifying the Information Commissioner’s Office and affected individuals where required.

11. How long we keep personal data

We keep personal data only for as long as we need it for the purpose for which it was collected, unless we need to keep it for longer to meet a legal, regulatory, accounting or other business requirement.

The length of time we keep information depends on the type of information and why we hold it. We regularly review our records and, when personal data is no longer needed, we securely delete it or anonymise it where appropriate.

Our retention periods are set out in our internal Data Retention Policy. These periods vary depending on the type of record. For example, some contracts, financial records and business correspondence are retained for up to six years, while certain employment and regulatory records have different retention periods.
We may retain information for longer where this is necessary to deal with a complaint, legal claim, dispute or other legal or regulatory matter.

Where personal data is securely deleted, we take reasonable steps to ensure that it is permanently erased from the systems and records in which it is held. Where appropriate, information may instead be anonymised so that it can no longer be linked to an identifiable individual.

Data held on behalf of our customers

Where Training-Progress processes personal data on behalf of a customer, we retain that data in accordance with the customer’s instructions and our contractual arrangements with them. This is explained further in Section 12 – When Training-Progress is the data processor.

12. When Training-Progress is the data processor

When a customer uses Training-Progress to manage training, processes, documents or other information about its employees, contractors or other individuals, the customer will generally be the data controller and Training-Progress will act as the data processor.

This means that the customer decides why the personal data is collected and how it should be used, while Training-Progress processes that data on the customer’s behalf in accordance with the customer’s instructions and our contractual arrangements.

What this means in practice

The customer is responsible for:

deciding what personal data is collected and how it is used;
ensuring that it has a lawful basis for processing the data;
providing appropriate privacy information to its employees, contractors and other individuals whose data it puts into Training-Progress;
responding to requests from individuals exercising their data protection rights, where appropriate; and
ensuring that its use of Training-Progress complies with applicable data protection requirements.

Training-Progress is responsible for:

processing personal data only in accordance with the customer’s documented instructions and our agreement;
maintaining appropriate technical and organisational security measures;
ensuring that people authorised to process the data are subject to appropriate confidentiality obligations;
using approved sub-processors where necessary to provide the Training-Progress service;
assisting the customer with its data protection obligations where required under our agreement; and
securely returning or deleting personal data when required by the customer or when the contractual relationship ends, subject to any legal requirement to retain it.

The personal data processed on behalf of a customer may include information such as names, contact details, job roles, training records, assessment results, completion records and other information that the customer chooses to store in Training-Progress.

Some information may include special category data, for example information about health or disability, where a customer chooses to include this in its records. Customers are responsible for ensuring that they have the appropriate legal basis and any additional condition required to process this information.

Requests about personal data held on behalf of a customer

If you are an employee, contractor or other individual whose personal data is held in Training-Progress on behalf of one of our customers, you should normally contact the organisation that collected your information in the first instance.

As the data controller, that organisation is responsible for deciding how your personal data is used and for handling your data protection rights. Training-Progress will assist our customers with these requests where required under our contractual arrangements.

Training-Progress does not use personal data held on behalf of a customer for its own marketing or other independent business purposes.

Our contractual arrangements with customers set out the processing requirements, security measures, confidentiality obligations, sub-processor arrangements, international transfers, retention and deletion requirements that apply when we act as a processor.

13. Sub-processors

When Training-Progress acts as a data processor for one of our customers, we may use other trusted organisations to help us provide our services. Where these organisations process personal data on our customer’s behalf, they are sub-processors.

We only appoint sub-processors in accordance with our agreement with the relevant customer and applicable data-protection law. Where required, we obtain the customer’s written authorisation before appointing a sub-processor.

Our agreements with sub-processors require them to provide an appropriate level of protection for personal data and to meet the relevant data-protection and security requirements.

Where we have general authorisation from a customer to use sub-processors, we will inform the customer of any proposed changes and provide them with an opportunity to object, in accordance with the terms of our agreement.

Where a sub-processor processes personal data outside the UK, we will ensure that the appropriate safeguards and international transfer requirements are in place.

Our use of sub-processors does not change the customer’s role as the data controller or Training-Progress’s obligations as their processor. Details of the processing carried out on a customer’s behalf, including the use of sub-processors, are governed by the relevant agreement and Data Processing Agreement.

14. Your data protection rights

When Training-Progress is acting as a data controller, you have rights over the personal information we hold about you. These rights include:

The right to be informed – to understand how we collect and use your personal information. This Privacy Notice provides this information.
The right of access – to ask for a copy of the personal information we hold about you and information about how we use it.
The right to rectification – to ask us to correct personal information that is inaccurate or incomplete.
The right to erasure – in certain circumstances, to ask us to delete your personal information.
The right to restrict processing – in certain circumstances, to ask us to stop or limit how we use your personal information.
The right to data portability – in certain circumstances, to ask for personal information you have provided to us in a structured, commonly used and machine-readable format, or to ask us to transfer it to another organisation.
The right to object – in certain circumstances, to object to our use of your personal information, including where we use it for direct marketing.

Some of these rights only apply in certain circumstances and there may be legal reasons why we cannot comply with a request in full.

If we rely on your consent to process your personal information, you have the right to withdraw your consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.

You also have rights in relation to certain types of automated decision-making and profiling. Training-Progress does not currently make solely automated decisions about individuals that have legal or similarly significant effects.

If you would like to exercise any of your rights, please contact us using the details in Section 2 – How to contact us. We may need to ask you for information to confirm your identity before dealing with your request.

Where Training-Progress is acting as a data processor on behalf of one of our customers, please see Section 12 – When Training-Progress is the data processor. In that situation, the relevant customer is responsible for responding to requests relating to the personal information they control.

15. Cookies and website analytics

Our website uses cookies and similar technologies to provide essential website functionality and, where permitted, to understand how visitors use our website and improve our services.

Some cookies are necessary for the website to function and cannot be switched off. Where we use non-essential cookies or similar technologies, we will ask for your consent where required.

For more information about the cookies and similar technologies we use, what they are used for, how long they remain on your device and how you can manage your preferences, please see our Cookie Notice.

Our use of cookies and website analytics may involve the processing of personal data. Where this is the case, we will handle that information in accordance with applicable data protection law and this Privacy Notice.

16. Complaints

We take concerns about the way we handle personal information seriously.

If you have any questions or concerns about how Training-Progress has collected, used, stored or otherwise handled your personal information, please contact us using the details in Section 2 – How to contact us. We will investigate your concern and work with you to resolve it.

If you are not satisfied with our response, or you believe that we have not handled your personal information in accordance with data protection law, you have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent supervisory authority for data protection.

You can find information about how to make a complaint on the ICO’s website:

Make a data protection complaint to the ICO

You do not have to wait for us to complete our complaints process before contacting the ICO, although the ICO recommends giving us the opportunity to resolve your concern first.

17. Changes to this notice

We keep this Privacy Notice under regular review to make sure it remains accurate and reflects how Training-Progress uses personal information.

We may update this Privacy Notice when our services, systems, legal requirements or the way we process personal information changes.

Where a change is significant, we will take appropriate steps to bring it to your attention before the change takes effect, where required.

The date at the beginning of this Privacy Notice shows when it was last updated. We recommend checking this page from time to time for the latest version.