Last updated: 8 October 2026
This policy explains what personal information Vital Signs First collects, why we collect it, how long we keep it and what your rights are. We’ve tried to keep it plain and simple. If anything isn’t clear, just get in touch.
Who we are
Vital Signs First is a first aid and workplace safety training business run by Stewart Hansen and based in Milton Keynes. For the purposes of UK data protection law we are the “controller” of the personal information described here.
Vital Signs First is the trading name of Stewart Hansen, a sole trader.
Email: [email protected]
Phone: 0300 303 0724
We’re registered with the Information Commissioner’s Office (ICO) under registration number ZC268292.
What we collect and why
When you send us an enquiry. If you use the form on our website, email or call us, we collect your name, email address, phone number, the course you’re interested in, how many people need training, the town or postcode where you’d like it held, your preferred dates and anything else you choose to tell us. We use this to reply to you, give you a quote and arrange your training. Our lawful basis is taking steps at your request before entering into a contract, or our legitimate interest in responding to business enquiries.
When you or your staff attend a course. To run the course and issue certificates we need each learner’s name and contact details, and in some cases their date of birth, along with attendance and assessment results. If a learner tells us about a medical condition, injury or pregnancy that could affect the practical parts of the course (for example kneeling to give CPR), we use that only to make reasonable adjustments and keep them safe on the day. Our lawful bases are performing our contract with you or your employer, our legal obligations, and, for health information, the learner’s explicit consent or our obligations in the field of employment and health and safety.
Business and accounting records. We keep invoices, payment records and correspondence with the organisations we train for, because we’re required to by tax law.
When you visit our website. Our website uses a small number of cookies. Some are essential to make the site work; others, such as Google Maps and embedded social media content, only load if you agree to them through our cookie banner. If you accept statistics cookies, we also use Google Analytics to see how many people visit the site and which pages they look at, which helps us improve it. Google Analytics stays switched off unless you accept it. You can change your choice at any time. Full details are in our Cookie Policy. Our contact form is protected by Google reCAPTCHA to stop spam, which means Google receives some technical information about your device and how you use the page.
We don’t sell your information, and we don’t use it for advertising.
Who we share it with
We only share personal information where we need to, with:
- ProTrainings, the awarding organisation we deliver courses through, so they can register learners and issue certificates. If you buy one of our online courses you do so directly through ProTrainings, and their own privacy policy applies to that purchase.
- Other training companies, where we are delivering a course on their behalf. In that case they will usually be the controller of your information and their privacy policy will apply.
- Our website host, IONOS, which stores our website and the enquiries sent through it on servers in the EU.
- Google, for reCAPTCHA spam protection and, if you agree to them, embedded maps and Google Analytics.
- LinkedIn and Instagram, only if you agree to embedded social media content through our cookie banner.
- Our accountant and HMRC, for tax and accounting purposes.
- Anyone we are required to share information with by law.
Some of these providers may process data outside the UK, including in the United States. Where that happens, we rely on the safeguards recognised under UK law, such as the UK–US Data Bridge or standard contractual clauses.
How long we keep it
- Enquiries that don’t lead to a booking: up to 12 months, then deleted.
- Training and certificate records: for the life of the certificate plus one year (usually four years in total), so we can confirm qualifications and deal with any queries.
- Health information shared for a course: only for as long as it’s needed for that course, unless an incident or injury occurs, when we keep the record for as long as the law requires.
- Invoices and accounting records: six years from the end of the financial year they relate to, as required by HMRC.
Keeping it safe
We keep personal information on password-protected devices and accounts, limit who can see it and only use reputable providers. No system is completely secure, but we take reasonable steps to protect your information and will tell you and the Information Commissioner’s Office if something goes wrong where the law requires it.
Your rights
Under UK data protection law you have the right to:
- ask for a copy of the information we hold about you
- ask us to correct anything that’s wrong or incomplete
- ask us to delete your information, where we no longer have a good reason to keep it
- ask us to restrict or stop using your information, or object to how we use it
- ask for your information in a format you can take elsewhere
- withdraw your consent at any time, where we rely on it
To use any of these rights, email [email protected]. There’s no charge, and we’ll respond within one month.
Complaints
If you’re unhappy with how we’ve handled your information, please talk to us first and we’ll do our best to put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
Changes to this policy
We review this policy from time to time and will post any changes on this page, with the date it was last updated at the top.