Privacy
Last updated 3 October 2026.
Who looks after your information
The controller is PHW Services.
PHW Services, Adrian Whetton, 4 Woburn House, Vernon Gate, Derby DE1 1UL
Email [email protected] with any question about your information.
What we keep
- The buyer's email address, from the card payment page or from the basket, and the amount paid.
- The name each learner types, which goes on their certificate.
- A learner's email address, only if they choose to give one.
- Which lessons a learner has finished, and their test attempts: the questions asked, the answers given and the marks.
- Each certificate: its number, the name, the course and the date.
- Qualifications from other providers that the buyer types in on the order page: the person's name, the qualification, the provider, the date and the certificate number. The buyer's own record; we do not check it.
- A scrambled version of your connection address, kept for a short while, usually about a day, so that we can stop one person flooding the site.
We do not keep card numbers. The card payment is taken on Stripe's own page, and Stripe tells us only that it has been paid.
What we use it for, and why we may
We use it to give you what you bought: your order page, your places, your lessons, your test result and your certificate. We use email addresses to send the order link, a certificate link to a learner who gave an email, and the links you ask for on the "Lost my link" page.
To give the buyer what they paid for, we rely on the contract with the buyer. For learners, and for the public check page, we rely on our legitimate interest in letting an employer or an inspector confirm that a certificate is real. A learner whose employer bought the place has no contract with us, which is why that is the basis for them.
Who can see your name
Anyone who has a certificate number can open the check page and see the name, the course, the date and the number. That is the point of it: an employer, an inspector or a customer can confirm a certificate is real. The check page shows nothing else.
The certificate page itself shows the name, the date, what the course covered and, for hands-on courses, the practical sign-off sheet, to anyone who has the certificate number.
The order page shows the person who bought the places the learners on the order, their progress and their certificate links. It also shows the email address a learner gave, and the order page can be downloaded as a spreadsheet with names, emails, progress and certificate numbers. Anyone who has the order page address can see all of that, and any qualifications from other providers the buyer has typed in. A learner's personal link shows that person's progress and certificate to anyone who has it. Keep these links to yourself and the people who need them.
How long we keep it
We keep order and learner records for six years after anyone last used a place on the order, or after the order date if no place was used. We delete them, or remove the personal details from them, when that period ends. We keep certificate records for nine years from the date on the certificate, so an employer can still check one. After that the check page will no longer find the certificate.
Who else handles it
- Stripe takes card payments. Its privacy notice is at stripe.com/gb/privacy.
- Cloudflare hosts this site and its database.
- Resend sends our emails. Its privacy notice is at resend.com/legal/privacy-policy.
Stripe, Resend and Cloudflare may handle information outside the UK. Each of them says what safeguard it uses for data that leaves the UK. Stripe: the EU standard contractual clauses with the UK International Data Transfer Addendum, and the UK extension to the EU-US Data Privacy Framework. Resend: the same clauses with the UK Addendum, and the same UK extension. Cloudflare: the UK extension, with the same clauses and the UK Addendum if that lapses. Email us for a copy of these safeguards.
We do not sell your information and we do not use it for advertising.
Cookies and tracking
This site sets no cookies, runs no analytics and loads nothing from other companies. Your browser keeps your basket and your personal course link on your own device, so the site can bring you back to where you were. That stays on your device. Stripe's own payment page may set its own cookies.
Your rights
You can ask to see what we hold about you, to have it corrected, or to have it removed. Email us. Certificate records stay while the check page needs them to work, so a request to remove a certificate record will be looked at case by case. If you are not happy with how we have handled your information, you can complain to the Information Commissioner's Office at ico.org.uk.