Privacy Policy

Retrain operates the website retrain.org.uk. Retrain is a trading name of SDM Works Limited, a company registered in England and Wales (company number 14752075). Registered office: Parkhill Studio, Walton Road, Wetherby, LS22 5DZ, United Kingdom. We are a UK-based service designed to help adults find government-funded tech training courses.

For the purposes of UK GDPR, SDM Works Limited is the data controller responsible for your personal data.

If you have any questions about this policy or how we handle your data, contact us or email hello@retrain.org.uk.

When you complete our eligibility check, we collect:

• Your name
• Email address
• Phone number
• Postcode
• Employment status
• Age confirmation (whether you are 19 or over)
• Residency or visa status
• Course interests
• If you are employed or self-employed, whether you earn more than a set amount (yes, no or not sure). We do not ask for your exact salary.

We also record:

• The local council area your postcode is in, so we can check where funding is available
• A record of the consent you gave, including the exact wording you agreed to and the date

We also collect standard technical data when you visit the site, including your IP address, browser type and pages visited. This is collected automatically via cookies and analytics tools.

We collect your personal data to check which funded courses you may be eligible for and, with your agreement, to connect you with a suitable course provider.

Our legal basis for processing your personal data is consent. Depending on your answers, the consent checkbox in our form will ask for one of two things:

• If you are matched with a provider: your agreement for us to pass your details to that provider, who is named when you give consent, so they can contact you about eligible courses by phone, email and text message.
• If you are not matched yet: your agreement for us to keep your details so we can match you with course providers and let you know by email or text message when funded places become available. Your details are not shared with any provider.

How matching works: your answers are checked automatically against each provider's funding criteria, such as your age, where you live, your residency status and, if you are in work, your income. This decides whether we can match you with a provider. If you think the outcome is wrong, contact us and we will review it.

You can withdraw your consent at any time by contacting us. Withdrawing consent does not affect the lawfulness of any processing that took place before you withdrew it.

If you are matched: we share your name, email address, phone number, postcode and course interest with the approved, UK-based course provider you are matched with. The provider is named in the form at the point you give consent. They will contact you directly to discuss your options and confirm your eligibility. Once shared, the provider is responsible for your data under their own privacy policy.

If you are not matched: we do not share your details with any provider. We keep them securely while we look for suitable openings. If a suitable provider becomes available later, we will ask for your consent before sharing your details with them.

Commercial Matching: Retrain operates as a commercial matching service. If we match you with a training provider, that provider pays us a fee for the introduction. We will only ever share your data with these specific, approved educational providers for the purpose of finding you a course. We will never sell, rent, or share your personal details with unrelated third parties, marketing agencies, or data brokers.

We also use trusted service providers who process data on our behalf, under contract and only on our instructions:

• Supabase — secure database where your enquiry details are stored (hosted in the EU)
• Vercel — website hosting
• Google — website analytics (Google Analytics via Google Tag Manager), using limited technical data

We keep your enquiry details for up to 12 months from the date you submit them, after which they are securely deleted.

Two things are kept for longer:

• Records of the consent you gave, including the date and the wording you agreed to, and a record of which provider we passed your details to and when. We keep these for up to 6 years so we can show we handled your data lawfully if it is ever questioned.
• If you ask us to stop contacting you, we keep a minimal record of that request indefinitely. This is the only way we can be sure you are not contacted again by mistake.

If you ask us to delete your data before the 12 months are up, we will do so within 30 days, other than the suppression record described above.

Our website uses cookies. Some are essential for the site to function. Others are used for analytics purposes to help us understand how people use the site and improve it over time.

We use Google Tag Manager to manage tracking tags, which may include Google Analytics. Analytics cookies are only set with your consent via our cookie banner.

You can withdraw consent for non-essential cookies at any time by adjusting your browser settings.

We take reasonable technical and organisational measures to protect your personal data from unauthorised access, loss or misuse. All data is transmitted over encrypted connections (HTTPS/TLS).

No method of transmission over the internet is 100% secure, but we take our responsibilities seriously and follow current best practices.

Some of the third-party services we use (including Google Analytics and Vercel) may process data outside the UK. Where this occurs, we rely on standard contractual clauses or adequacy decisions to ensure your data remains protected to the same standard required under UK GDPR.

Under UK GDPR, you have the following rights regarding your personal data:

• Right of access — you can request a copy of the personal data we hold about you
• Right to rectification — you can ask us to correct inaccurate data
• Right to erasure — you can ask us to delete your data
• Right to restrict processing — you can ask us to limit how we use your data
• Right to data portability — you can request your data in a structured, machine-readable format
• Right to object — you can object to us processing your data
• Right to withdraw consent — you can withdraw consent at any time

If we have passed your details to a course provider, you can also contact that provider directly. Withdrawing your consent with us does not automatically withdraw it with them, but if you ask us, we will pass your request on to them.

To exercise any of these rights, get in touch and we will respond within 30 days. If you are not satisfied with our response, you also have the right to contact the Information Commissioner's Office.

We may update this policy from time to time. When we do, we will update the date at the top of the page. If we make significant changes, we will take reasonable steps to let you know.

Continued use of retrain.org.uk after changes are posted constitutes your acceptance of the updated policy.