Legal

Privacy Policy

Last updated: 29 October 2026

About this policy

We are BD Training and Consultancy Ltd, a company registered in England and Wales under number 14621084, whose registered office is at 50 Dale Acre Way, Breadsall, Derby, United Kingdom. In this privacy policy we refer to ourselves as “we”, “us” or “our”. We are the Data Controller of the personal information described in this policy.

You can contact us by emailing [email protected].

We take the privacy and security of the personal information we hold about you seriously. This policy explains what personal information we collect about you, how we collect it, how we use it and what rights you have. Please read it carefully.

We do not have a Data Protection Officer. Paul Doughty is responsible for data protection at our organisation, including any matters in this policy. If you have any questions about this policy, please contact him using the details above.

We may give you other privacy notices from time to time, for example when we collect personal information from you for a specific purpose. This policy supplements those notices and does not override them.

We may update this policy from time to time, for example to reflect changes to our practices or for legal or regulatory reasons. Changes take effect when they are posted on our website. If we make material changes, we will say so at the top of this page, and where appropriate we will tell you directly.

1. Key definitions

Data Controller: the organisation or person responsible for deciding how personal information is collected, stored and used.
Data Processor: an organisation or person that handles personal information on behalf of, and on the written instructions of, a Data Controller, such as a company that hosts our website or sends our emails.
Personal Information: any information from which a living individual can be identified. It does not include information that has been anonymised.
Special Information: very sensitive personal information that needs extra protection under data protection law, including information about health, racial or ethnic origin, political opinions, religious or similar beliefs, trade union membership, sex life or sexual orientation, and genetic or biometric information.
Data Protection Law: the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (“PECR”), as amended or replaced from time to time.

2. Personal information we collect

2.1We collect, use and hold the following types of personal information. Most of the people we deal with are contacting us on behalf of their employer, so much of this information is business contact information.

Identity Information: your name and title, job title or position, and the organisation you work for.
Contact Information: your email address, telephone number and business address.
Enquiry Information: what you tell us when you contact us, for example through the form on our website, by email, by phone or through LinkedIn, including the problem you would like help with.
Client and Engagement Information: details of the consultancy or training we provide to you or your organisation, including proposals, agreements, meeting notes and project records.
Training Information: details of people who attend our Lean Six Sigma training, including attendance, course progress, assessment and project results, and certificates issued.
Account Information: if you use our e-learning, your login details and your activity and progress on the learning platform. We never see your password in plain text.
Payment and Transaction Information: invoices, payments made, amounts, dates and the bank details we need to receive or refund payments. Card payments are handled by our payment provider and we do not see or store your full card details.
Feedback Information: feedback, course evaluations, survey responses and testimonials you give us. We will only publish a testimonial with your permission.
Marketing Information: your preferences about receiving marketing from us, and a record of any consent you have given or withdrawn.
Website, Device and Technical Information: information about how you use our website, including your IP address, browser type and version, operating system, time zone and location settings, and pages visited.

2.2The personal information we hold about you will depend on who you are and our relationship with you. For example, we will hold much less about someone who has only visited our website than about a client we are working with.

2.3Our website and services are intended for adults acting in a business capacity. We do not knowingly collect personal information from anyone under 18.

3. Special information

3.1We do not ask for Special Information and we ask you not to send it to us through our website.

3.2The only exception is when you attend in-person training and tell us about an access requirement or a dietary need, which may reveal information about your health or beliefs. We will only use this to make the arrangements you have asked for, with your explicit consent, and we will delete it once the training has finished.

3.3We do not collect information about criminal convictions or offences.

4. How and why we use personal information

4.1Data Protection Law only allows us to use your personal information where we have a legal reason to do so. In most cases we rely on one or more of the following:

Contract Reason: we need to use your personal information to take steps you have asked for before entering into a contract, or to perform a contract with you.
Legitimate Interests Reason: the use is necessary for our legitimate interests or those of a third party, as long as those interests are not overridden by your rights, freedoms or interests.
Legal Obligation Reason: we need to use your personal information to comply with a legal obligation, such as keeping tax and accounting records.
Consent Reason: you have given us clear consent to use your personal information for a specific purpose.

4.2Where we work with a client organisation, our contract is usually with that organisation rather than with you personally. In that case, we use the personal information of the people we deal with there, and of the employees they send on our training, under the Legitimate Interests Reason (to deliver the services our client has asked for).

4.3The table below sets out what we use your personal information for and the legal reason we rely on. Where we rely on the Legitimate Interests Reason, we explain what that interest is. Some purposes have more than one legal reason, because the reason can differ depending on the circumstances. If you would like to know which reason applies to you, please contact us.

Responding to your enquiry: Legitimate Interests Reason (to answer people who contact us about our services) and Contract Reason (where you ask us to prepare a proposal).
Preparing proposals and agreeing an engagement: Contract Reason and Legitimate Interests Reason (to win and set up new work).
Delivering consultancy and training: Contract Reason and Legitimate Interests Reason (to provide the services our client has asked for, including running workshops and improvement projects).
Running training, assessments and certification: Contract Reason and Legitimate Interests Reason (to record attendance and results, issue certificates and confirm a certificate is genuine if asked).
Providing e-learning and managing your Account: Contract Reason.
Invoicing, taking payment and recovering money owed: Contract Reason, Legal Obligation Reason and Legitimate Interests Reason (to recover money owed to us).
Keeping accounting, tax and business records: Legal Obligation Reason.
Managing our relationship with you and telling you about changes to our terms or this policy: Contract Reason, Legal Obligation Reason and Legitimate Interests Reason (to keep our records up to date).
Making first contact with business professionals, for example on LinkedIn: Legitimate Interests Reason (to introduce our services to senior people in pharmaceutical and life sciences businesses who are likely to find them relevant). See section 5.2.
Sending marketing emails: Consent Reason, or the Legitimate Interests Reason where Data Protection Law allows us to email a business address. See section 11.
Improving our services, courses and website, including through feedback: Legitimate Interests Reason (to improve what we offer and grow our business).
Keeping our website running correctly and securely: Legitimate Interests Reason (to make sure our website works and is protected).
Understanding how visitors use our website: Consent Reason, where this uses non-essential cookies. See our Cookies Policy.
Handling legal claims and complaints: Legitimate Interests Reason (to protect our business and defend legal claims) and Legal Obligation Reason.

4.4We need certain personal information to provide our services. If you do not provide it, we may not be able to provide them.

4.5Please keep your personal information up to date. If anything changes, for example your email address or job, please let us know.

4.6Where we rely on consent, you can withdraw it at any time by contacting us or, for emails, by clicking the unsubscribe link. We will then stop using your personal information for that purpose, unless we have another legal reason to continue, in which case we will tell you what it is.

4.7We may anonymise personal information so that you can no longer be identified, or combine it with other people’s information to produce statistics, for example about course results. Because you cannot be identified from this information, we may use it for our own purposes.

4.8We will only use your personal information for the purposes we have told you about, or for a new purpose that is compatible with them. If we want to use it for an unrelated purpose, we will contact you first and explain the legal reason that allows us to do so.

5. How we collect personal information

5.1We collect most personal information directly from you, for example when you fill in the form on our website, email or call us, message us on LinkedIn, book a call, sign up for training or e-learning, give feedback, or work with us on an engagement.

5.2We may also collect personal information from other sources:

Your employer or organisation, when it books training for you or asks us to work with you on a project. This may include your name, job title, work email and the course you are attending.
Publicly available sources, such as LinkedIn profiles, company websites and Companies House. We use these to identify senior professionals in pharmaceutical and life sciences who may be interested in our services, and we only use business-related information. If we contact you this way, we will tell you how we found your details, and you can ask us to stop at any time.
Our service providers, such as our payment provider, booking and calendar tools and our website and CRM platform, which pass us information about bookings and payments you make.
Analytics providers, such as Google, which give us Website, Device and Technical Information about how our website is used.

5.3We also collect Website, Device and Technical Information automatically through cookies and similar technologies. To find out more, please see our Cookies Policy.

6. Who we share personal information with

6.1We may share your personal information with the following:

Service providers who support our business, acting as our Data Processors. These include our website, form and CRM platform (HighLevel), email and office software, video-calling tools such as Microsoft Teams and Zoom, our e-learning platform, payment providers, cloud storage and IT support.
Your organisation, where it has engaged us. For example, we may share training attendance, progress and results with the person at your organisation who booked the training.
Certification or accreditation bodies, if a course is accredited and we need to register you or confirm your result. We will tell you before the course if this applies.
Professional advisers, such as our accountants, lawyers and insurers.
Our bank, to process payments.
Government and regulatory bodies, such as HM Revenue & Customs, where we are required to by law.
A buyer of our business, if we sell or transfer all or part of our business, in which case the buyer may receive personal information as part of that sale.

6.2Where we share personal information with a Data Processor, we have a contract in place that sets out their obligations, including keeping it secure and only using it on our instructions.

6.3We do not sell, rent or trade your personal information.

7. Transfers outside the UK

7.1Some of our service providers are based outside the UK, or store information on servers outside the UK, including in the European Economic Area and the United States. For example, our website and CRM platform and some of our software providers are based in the United States.

7.2Where we transfer personal information outside the UK, we make sure it is protected by one of the safeguards required by Data Protection Law. These include transferring only to countries the UK Government has confirmed provide adequate protection (including the EEA, and US organisations certified under the UK Extension to the EU-US Data Privacy Framework), or using the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

7.3If you would like more information about the safeguards we use, please contact us.

8. Keeping your information secure

8.1We use appropriate technical and organisational measures to protect your personal information from being lost, misused, or accessed, changed or disclosed without permission. These include password-protected and encrypted devices and accounts, two-factor authentication where available, and limiting access to the people who need it.

8.2If we discover a personal data breach that is likely to put your rights at risk, we will tell you and the Information Commissioner’s Office where we are required to.

8.3Sending information over the internet is never completely secure. Please do not send confidential or commercially sensitive information through our website form. If an engagement goes ahead, we will agree a secure way to share it.

9. How long we keep personal information

9.1We only keep personal information for as long as we need it for the purposes we collected it for, including meeting any legal, accounting or reporting requirements and dealing with any legal claims. We then delete it securely or anonymise it.

9.2Our usual retention periods are:

Enquiries that do not lead to work: 2 years from our last contact with you.
Client, engagement and financial records: 6 years from the end of the financial year in which the engagement ended, to meet tax and accounting rules and in case of legal claims.
Training and certification records: 6 years from the end of the course, so we can confirm a certificate is genuine if asked.
E-learning Accounts: while your Account is active, and for up to 2 years after your last log-in, unless you ask us to close it sooner. Records of purchases are kept as client and financial records.
Access and dietary information: deleted once the relevant training has finished.
Marketing contacts: until you unsubscribe or ask us to stop. We keep a minimal record that you have opted out so we do not contact you again.
Website and analytics information: up to 26 months, or as set out in our Cookies Policy.

10. Automated decision making

10.1“Automated decision making” is where a decision is made about you by automated means, without any human involvement. It includes “profiling”, which is using personal information to evaluate or predict things about a person, such as their interests or behaviour.

10.2We do not carry out automated decision making, including profiling, that has a legal or similarly significant effect on you. If this changes, we will tell you and explain the legal reason that allows us to do it.

11. Marketing

11.1We may send you marketing about our consultancy and training services by email where:

you have given us your consent, for example by ticking the marketing box on our website form; or
you are a client or have asked us about our services, and the marketing is about similar services. You can opt out when we first collect your details and in every message we send; or
we are contacting you at your work email address about services relevant to your role, which Data Protection Law allows under our Legitimate Interests Reason. You can opt out at any time.

11.2Booking a call or sending us an enquiry does not, on its own, sign you up for marketing.

11.3Every marketing email we send includes a link to unsubscribe. If you have an e-learning Account, you can also manage your preferences there. You can ask us to stop marketing to you at any time by contacting us. It may take up to 14 days for your request to take effect.

11.4If you ask us to stop marketing to you, we will still send you messages that are not marketing, for example about a course you are booked on or an engagement we are working on.

11.5We do not pass your personal information to third parties for their own marketing.

12. Your rights

12.1Under Data Protection Law, you have the following rights in relation to your personal information:

Right of access: to ask for a copy of the personal information we hold about you, and for other information about how we use it. This is often called a “subject access request”.
Right to rectification: to ask us to correct personal information that is wrong or complete information that is incomplete.
Right to erasure: to ask us to delete your personal information in certain circumstances. This is often called the “right to be forgotten”.
Right to restrict processing: to ask us to limit how we use your personal information in certain circumstances.
Right to data portability: to ask us to give you, or another organisation, a copy of personal information you have provided to us in a commonly used electronic format, where we use it based on your consent or a contract.
Right to object: to object at any time to us using your personal information for direct marketing. You can also object where we rely on the Legitimate Interests Reason and there is something about your situation that makes you want to object.
Right to withdraw consent: where we rely on your consent, to withdraw it at any time. See section 4.6.

12.2To exercise any of these rights, please contact us using the details at the top of this policy. Please note:

we may need to ask for information to confirm your identity before we respond;
we do not charge a fee, unless a request is clearly unfounded or excessive;
we may refuse a request that is clearly unfounded or excessive, and will explain why; and
we will respond within one month, which we may extend by up to two further months for complex requests, in which case we will tell you.

13. Complaints

13.1If you are unhappy with how we have handled your personal information, please contact us first so we have the chance to put it right.

13.2You also have the right to complain to the UK’s data protection regulator, the Information Commissioner’s Office (ICO), at ico.org.uk/make-a-complaint or by calling 0303 123 1113.

14. Third-party websites

Our website contains links to other websites, such as LinkedIn. If you follow those links, the other website may collect personal information about you. We are not responsible for how those websites use your information, so please read their privacy policies.

15. Contact us

For more information about how we handle personal information, to exercise your rights or to make a complaint, please contact us:

Email: [email protected]
Post: BD Training and Consultancy Ltd, 50 Dale Acre Way, Breadsall, Derby, United Kingdom