Last updated: 1 September 2026
[brackets] need real details filled in.
[Maker Safety Training — insert registered company name, company number, and registered address] ("we", "us") operates this platform. For data protection purposes we are the "controller" of consultant account data, and act as both controller and processor for delegate/candidate data as explained below. Contact us about this policy at privacy@makersafety.app [confirm this address].
| Who | What | Why | Lawful basis |
|---|---|---|---|
| Consultants (our customers) | Name, email, professional title, organisation name, signature image, optional Gmail address for sending | To create and run your account, issue invoices, and send training invites on your behalf | Performance of a contract with you |
| Delegates / candidates | Name, email, school/institution, home address (unless your consultant has switched this off for D&TA-accredited courses), and your training checklist responses | To generate and store your course sign-off record, and — for D&TA-accredited courses — to support your accreditation with the Design & Technology Association | Performance of a contract between you and your trainer (your consultant), which we process on their behalf; see "Our role" below |
| Anyone submitting the "Request Access" form | Name, email, and (if ticked) marketing consent | To review and respond to your registration request; to send you product updates if you opted in | Legitimate interest (responding to your request) / consent (marketing) |
For your consultant account, we are the controller — we decide why and how that data is used to run the platform. For delegate data submitted through a consultant's portal, the consultant is the controller (it's their training relationship with the delegate) and we act as their processor, storing and handling the data on their instructions. If you're a delegate with a question about how your data is used, your consultant is usually the right first point of contact, though you're welcome to contact us too.
We don't sell personal data, and we don't share it with anyone else for their own marketing purposes.
Some of the providers above (including Postmark and Railway) may process data outside the UK, including in the United States. Where that happens, we rely on their standard contractual clauses or an equivalent adequacy safeguard recognised under UK GDPR. [Confirm each provider's current data-processing agreement/location before relying on this sentence.]
We keep consultant account data for as long as the account is active, and for a reasonable period afterwards to meet legal and accounting obligations (invoices, tax records). We keep delegate submission records for as long as your consultant needs them as evidence of training completed — typically for the working life of the qualification — after which they can request deletion. Registration requests that are rejected, or that never turn into an account, are deleted after 12 months.
Under UK GDPR you have the right to: access the personal data we hold about you; have inaccurate data corrected; ask us to delete it (subject to legal retention needs); restrict or object to certain processing; and receive your data in a portable format. To exercise any of these, contact us at the address above — if you're a delegate, your consultant/trainer can usually action most of these requests directly, since they hold the underlying record.
You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk/make-a-complaint.
We only send marketing/product-update emails to people who've actively opted in — for example by ticking the (unticked by default) box on the registration form. You can withdraw that consent at any time via the unsubscribe link in any marketing email, or by emailing us. Opting out of marketing doesn't affect the operational emails needed to run your account (invite links, invoices, password resets).
The platform uses only the cookies/local storage strictly necessary to keep you logged in and remember your settings. We don't use third-party advertising or tracking cookies.
We may update this policy from time to time; the "last updated" date at the top will change, and for material changes we'll email consultant accounts directly.