Privacy policy
Last updated: 31 July 2026
1. Who we are
This policy explains how Signet Solutions Ltd collects and uses personal data through our website, signet-solutions.com (the "Site"), and when you contact us or book training with us.
We are the data controller for the personal data described in this policy. That means we decide how and why it is used, and we are responsible for looking after it.
Signet Solutions Ltd
Registered in England and Wales, company number 03226990
Registered office and training centre: Kelvin House, RTC Business Park, London Road, Derby, DE24 8UP
VAT number: GB 690395311
Email: enquiries@signet-solutions.com
Telephone: +44 (0)1332 343585
We handle personal data in accordance with the UK GDPR and the Data Protection Act 2018, each as amended by the Data (Use and Access) Act 2025.
If you have any question about this policy, or about how we use your information, please contact us using the details above. Questions about data protection specifically can be sent to the same address, marked for the attention of the Managing Director.
2. The personal data we collect
2.1 Information you give us
When you submit an enquiry through our Site, we collect: your full name, your email address, your message, and the type of enquiry you are making. You may also choose to give us your company name, your telephone number, the course you are interested in, and how you heard about us.
Your name, email address, enquiry type and message are required in order to submit the form. If you do not provide them we will not be able to respond to your enquiry. The other fields are optional and leaving them blank will not affect our response.
When you contact us by email or telephone, we collect whatever information you choose to give us in the course of that conversation, together with a record of the correspondence.
When you book or attend a course, we collect the information needed to administer your booking and your training. This typically includes your name and contact details, your employer, your job role, any prior qualifications or prerequisites relevant to the course, your assessment results, and any accessibility or dietary requirements you tell us about so that we can make appropriate arrangements.
2.2 Special category data
We do not routinely collect special category data (such as health information). If you tell us about a disability, medical condition or dietary requirement so that we can make reasonable adjustments for your attendance on a course, we will use that information only for that purpose, and we rely on your explicit consent or, where relevant, our obligations under equality and health and safety law.
2.3 Information we collect automatically
When you visit the Site, our hosting and analytics tools collect technical information including your IP address, the type of browser and device you are using, the pages you visit, how long you spend on them, and the website or search that referred you.
This is collected through cookies and similar technologies. Analytics cookies are only set with your consent. Our Cookie Policy explains this in full.
2.4 What we do not do
We do not carry out credit reference checks on you, we do not buy personal data from third parties, and we do not build advertising profiles about you.
3. How we use your personal data, and our lawful bases
The law requires us to have a valid reason, called a "lawful basis", for each way we use your data. Ours are set out below.
- Responding to your enquiry and providing information about our courses. Data used: contact details, enquiry details. Lawful basis: legitimate interests in responding to someone who has contacted us, or steps prior to entering a contract where you are asking to book.
- Administering course bookings, delivering training, assessing you and issuing certification. Data used: contact details, employer, role, prerequisites, assessment results. Lawful basis: performance of a contract with you, or with your employer where they have arranged your place.
- Making reasonable adjustments for accessibility or dietary needs. Data used: information you choose to give us. Lawful basis: explicit consent, and our obligations under equality and health and safety law.
- Keeping records required by awarding bodies, industry standards or safety obligations. Data used: training and assessment records. Lawful basis: legal obligation, and legitimate interests in maintaining an auditable training record.
- Accounting, invoicing and tax records. Data used: contact and transaction details. Lawful basis: legal obligation.
- Sending you information about our courses and industry updates by email. Data used: name, email address. Lawful basis: consent, or legitimate interests under the soft opt-in where you have previously enquired about or booked similar training. You can opt out at any time.
- Understanding how the Site is used so we can improve it. Data used: technical and analytics data. Lawful basis: consent.
- Keeping the Site secure and preventing spam and abuse. Data used: IP address, technical data. Lawful basis: legitimate interests in protecting our systems.
- Establishing, exercising or defending legal claims. Data used: as relevant. Lawful basis: legitimate interests, or legal obligation.
Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights, and concluded that it is not. You have the right to object, as explained in section 8.
Marketing. We will not send you marketing email unless you have asked for it, or unless you have previously enquired about or booked training with us and we are telling you about similar training. Every marketing message includes an unsubscribe link, and you can also opt out at any time by emailing us. Opting out of marketing does not affect messages we need to send you about a booking you have made.
Change of purpose. If we need to use your data for a purpose not described here, we will tell you first and explain the lawful basis, unless the law allows or requires us to do otherwise.
4. Cookies
The Site uses cookies. Strictly necessary cookies are set automatically; analytics cookies are set only with your consent, which you can give, refuse or withdraw through our cookie banner at any time.
Our Cookie Policy sets out exactly which cookies are used, by whom, and for how long.
5. Who we share your personal data with
We do not sell your personal data, and we do not share it with third parties for their own marketing purposes.
We share it with the following, all of whom are required to keep it secure and to use it only as we instruct:
Our website and IT providers. Our Site is built and hosted on Webflow, which also processes enquiry form submissions. Our site is delivered through Cloudflare, whose Turnstile service checks that form submissions come from a person rather than an automated system. Our email and business systems are provided by Google Workspace.
Analytics. With your consent, Google Analytics receives technical information about your visit. It does not receive the contents of your enquiry.
Awarding and industry bodies. Where a course leads to a qualification or a recorded competence, we share the information necessary to register you and confirm your result.
Your employer or sponsor. Where your employer has arranged and paid for your place, we will confirm your attendance and, where relevant, your assessment outcome to them.
Professional advisers, such as our accountants and legal advisers, where necessary.
Regulators, HMRC, Companies House, and law enforcement, where we are legally required to disclose information.
A buyer, if we sell or reorganise our business. Your data would transfer as part of that, and would remain subject to this policy or an equivalent one.
6. International transfers
Some of the providers above are based outside the United Kingdom, principally in the United States. In particular, Webflow, which hosts our Site and receives enquiry form submissions, operates from US infrastructure, and Google may process analytics data in the US.
Where personal data is transferred outside the UK, we make sure it is protected by an appropriate safeguard recognised under UK law. In practice this means the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or UK adequacy regulations covering the receiving country.
If you would like more detail about the safeguards in place for a particular transfer, please contact us.
7. How long we keep your personal data
We keep personal data only as long as we need it, then delete or securely destroy it.
- Enquiries that do not lead to a booking: 24 months from your last contact with us.
- Course booking and delegate records: 7 years from the end of the course, or longer where an awarding body or industry standard requires it.
- Assessment results and certification records: for as long as the certification remains relevant, and as required by the relevant awarding body.
- Accounting and tax records: 6 years from the end of the financial year they relate to, as required by HMRC.
- Marketing contact details: until you unsubscribe, and reviewed periodically.
- Website analytics data: in line with the retention setting on our Google Analytics property.
- Correspondence relating to a complaint or claim: 6 years from resolution.
Where we no longer need to identify you, we may keep anonymised information indefinitely for statistical purposes.
8. Your rights
Under data protection law you have the following rights. Exercising them is free.
- The right to be informed: to know how we use your data, which is what this policy is for.
- The right of access: to receive a copy of the personal data we hold about you.
- The right to rectification: to have inaccurate data corrected, or incomplete data completed.
- The right to erasure: to ask us to delete your data, where there is no good reason for us to keep it.
- The right to restrict processing: to ask us to pause our use of your data while a concern is resolved.
- The right to data portability: to receive certain data in a portable format, or have it sent to another organisation.
- The right to object: to object to processing based on legitimate interests. Where you object to direct marketing, we will always stop.
- The right to withdraw consent: where we rely on consent, you can withdraw it at any time, without affecting anything done beforehand.
To exercise any of these, email enquiries@signet-solutions.com or write to us at the address in section 1.
We will respond within one month. If your request is particularly complex, or you have made several requests, we may extend this by up to two further months, and we will tell you within the first month if that happens. We may ask you for proof of identity so that we do not disclose your data to the wrong person.
We will not charge a fee. If a request is manifestly unfounded, excessive or repetitive, we may charge a reasonable fee or refuse to act on it, and we will explain why.
9. Security
We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration and disclosure. These include encrypted connections to our Site, access controls limiting who within our team can see personal data, secure backups, and anti-virus and email filtering.
We require the same standards from any provider that processes personal data on our behalf.
No transmission over the internet can be guaranteed completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office, and you where required, without undue delay.
10. Children
Our Site and our training are aimed at adults working in, or seeking to enter, the railway industry. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.
11. Third-party websites
The Site contains links to other websites, including those of industry bodies and partner organisations. We are not responsible for their content or their privacy practices, and this policy does not apply to them. Please read their privacy policies before providing them with any personal data.
12. Changes to this policy, and your duty to inform us
We may update this policy from time to time. The date at the top shows when it was last revised. Where a change is significant we will draw it to your attention. Previous versions are available on request.
Please tell us if your personal data changes during your relationship with us, so that our records remain accurate.
13. How to complain
If you are unhappy with how we have handled your personal data, please tell us first at enquiries@signet-solutions.com so that we have the opportunity to put it right.
You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator:
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113
ICO Complaints Page
We would be grateful for the chance to address your concerns before you approach the ICO.