This notice explains how BookCourse collects and uses your personal information when you use our website, contact us or book a course. Last updated: 18 October 2026.
Who we are
BookCourse books security, construction and first aid training at partner training centres. We are the data controller for the personal data described here, and we follow UK data protection law, including the UK GDPR and the Data Protection Act 2018.
When you book a course
- Your name, email address and mobile number
- Your answers to any questions the course needs (for example, whether you have passed the CITB HS&E test in the last two years)
- Whether you would like marketing emails
- Your payment, which Stripe processes. We never see or store your full card details
- A record of the deposit terms and booking terms you accepted
At the training centre you will also show photo ID, and proof of address for SIA licence-linked courses. The centre and the awarding body handle those documents; we don't store them on our website.
When a company books for its staff
- The company name and address, the contact's name and email address, and any purchase order number
- Each attendee's name, email address and mobile number
- Your name, email address, phone number, the course you're interested in and your message
When you leave a review
- The name you choose to show, your rating and your comments, linked to your booking so we know the review is genuine
When you use our free mock tests
- Your answers and score, without your name or contact details, so we can see which questions people find hardest
- A coded version of your IP address, explained under Technical information below, so automated programs can't flood the results
- A coded version of your IP address when you book, send an enquiry or finish a mock test. We never store the address itself. It is coded with a secret key and used only to stop spam, repeated booking attempts and other abuse. We delete it after 30 days
- Anonymous visitor statistics, explained under Cookies and analytics below, which you can turn off
- To book your place, take your payment and send your confirmation, joining instructions and reminders
- To tell the training centre who is booked on each date
- To answer your questions and deal with complaints
- To invoice companies and record payments
- To ask for a review after your course
- To keep our website secure and prevent fraud
- To send updates and offers, only if you have asked for them. You can opt out at any time
- To meet our legal and accounting obligations
Our legal basis
- Contract: to book and arrange the course you have paid for
- Legal obligation: to keep financial records and meet regulatory requirements
- Legitimate interests: to run, improve and protect our business, for example preventing fraud, asking for reviews and understanding how our website is used
- Consent: for marketing emails. You can withdraw consent at any time
Who we share it with
- Training centres that deliver your course, which need your name and contact details to register you
- Awarding organisations, through the training centre, to register, assess and certify you
- Your employer, if they booked or paid for your place
- Police or other authorities, where the law requires it
We also use trusted service providers who handle data on our behalf and only as we instruct:
- Stripe: online payments and company invoices
- Resend: sending our emails, such as booking confirmations
- Neon: our booking database, hosted in London
- Vercel: hosting our website, bot protection and anonymous visitor statistics
- Google Workspace: our email inbox
Some of these providers are based in, or use staff in, the United States. Where personal data is transferred outside the UK, it is protected by UK adequacy regulations or by the ICO's approved international data transfer agreement or addendum.
We never sell your personal data.
How long we keep it
- Bookings, payments and invoices: six years after the end of the financial year they relate to, as required for tax and accounting
- Enquiries from our contact form: two years
- Coded IP addresses: deleted from bookings, enquiries, mock test results and staff sign-in records after 30 days
- Reviews: while they are shown on our website, and you can ask us to remove yours at any time
- Mock test results: kept without names or contact details, for statistics
- Marketing preferences: until you unsubscribe, and then only a record that you opted out
Cookies and analytics
We don't use advertising cookies or tracking cookies, and we don't follow you around the web. The only cookies we set are for security, for our staff to sign in, or to remember that you turned off visitor statistics, which is why we don't ask you to accept cookies.
- Visitor statistics: we use Vercel Web Analytics and Speed Insights to count page views, see which pages people visit, where visits come from (such as a search engine or a link in one of our emails), and check how fast the site loads. They read basic details your browser shares, such as the page address, browser, device type and rough location, and only report totals. They do not use cookies or store anything on your device, they do not identify you, and Vercel only uses the data to provide these statistics to us. We use them only to improve our website. You can turn them off below
- Booking and enquiry counts: when you start or complete a booking or send an enquiry, our server sends a count to Vercel Web Analytics with the course and, for bookings, the amount. When you tap a phone number or finish a mock test, your browser sends a similar count with the page, or the test and whether you passed. These counts never include your name, email address or phone number, and turning off visitor statistics stops them. The one exception is a count of completed bookings sent when Stripe confirms a payment, which contains nothing about you or your device
- Security on our forms: when you book or send an enquiry, Vercel's bot protection may set short-lived security cookies to check that a person, not an automated program, is using the form. They are used only for security
- Staff sign-in: our own staff have a cookie that keeps them signed in to the booking admin. It is never set for visitors
- Your statistics choice: if you turn visitor statistics off, we save a cookie called bc_stats_off for a year to remember it. If your browser sends a Global Privacy Control signal, we treat statistics as off without saving anything
- Payments: when you pay, you move to Stripe's secure checkout page, which uses its own cookies to prevent fraud under Stripe's privacy policy
How we protect your data
Our website and database use encrypted connections, staff sign in with one-time email links, every change in the booking admin is logged, and only people who need your data to arrange your course can see it.
Your rights
You have the right to:
- Ask for a copy of the personal data we hold about you (usually free of charge)
- Ask us to correct inaccurate data
- Ask us to delete your data or restrict how we use it
- Object to processing based on our legitimate interests
- Ask for your data to be transferred to another organisation
- Opt out of marketing at any time
- Withdraw consent where we rely on it
To make a request, email info@bookcourse.co.uk. We will reply within one month.
Complaints
If you have a concern about how we use your data, please contact us first on 020 8050 4108 or at info@bookcourse.co.uk.
You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.
Changes to this notice
We may update this notice from time to time. The latest version will always be on this page, with the date it was last updated at the top.