Privacy Policy

What is personal data?

Personal data is any information about a person which identifies them, either directly or indirectly.

What personal data do we collect?

We collect the following types of personal data:

• Identity information — such as name, date of birth, and nationality.
• Contact information — such as email address, telephone number, and postal address.
• Learner and qualification data — such as course enrolment, assessment results, and certificate records, submitted by our partner training institutes.
• Financial data — such as payment details processed when partners pay certification fees.
• Preference information — such as marketing and newsletter subscription preferences.

We do not knowingly collect sensitive data or data relating to children under 16.

How do we collect your personal data?

We collect this data when you interact with us through our website — for example, when you submit a partner application, register learners through our partner portal, subscribe to our newsletter, request certificate verification, or send us correspondence.

How and why do we use your personal data?

In accordance with data protection law, we can only use your personal data if we have a legal basis for doing so. We use personal data for the following reasons:

• To provide our certification, verification, and awarding body services to partner institutes and learners. Our legal basis is the performance of a contract, or to take steps before entering into a contract.
• To issue, record, and verify OSHEM certificates and maintain the integrity of our credential register. Our legal basis is our legitimate interests and the performance of a contract.
• To ensure that the website operates effectively and securely. Our legal basis is our legitimate interests.
• To make and receive payments. Our legal basis is the performance of a contract.
• To send you newsletters and updates where you have requested them. Our legal basis is consent.

Marketing

We will send you promotional communications, such as our HSE newsletter, only if you have requested information or subscribed. You can opt out at any time by following the opt-out links in any communication we send you. If you opt out, you will still receive essential communications relating to services we provide to you.

Do we share your personal data?

We share personal data only where necessary to run our certification services: with the approved partner institute that delivered your training (for registration, results, corrections and certificate release); with service providers acting for us — currently web hosting for this site and the Partner Portal, Airwallex (payment processing), Zoom (viva examinations and remote sessions where used), and transactional email delivery; and with legal or regulatory bodies where the law requires. If you hold a certificate, the minimum details needed to verify it — your name, course, certificate number and validity status — appear in our public verification register, which exists to protect the integrity of your certificate. We will obtain your express consent before sharing your data with any third party for their own marketing purposes.

Where we share your personal data, we do so only where we are satisfied that the third party will take appropriate steps to protect it and that its use is limited to acting on our instructions. We may also share personal data with legal and regulatory bodies where necessary to comply with the law.

International transfers

OSHEM is based in the United Kingdom, and learner data typically reaches us from approved partner institutes located outside the UK — for example, in Saudi Arabia and other Gulf states — which remain responsible for that disclosure under their local data protection law. Where we transfer personal data outside the United Kingdom (for example, returning corrected records to a partner institute), we ensure appropriate safeguards are in place in accordance with UK data protection law, including the UK International Data Transfer Agreement or Addendum where required. Our public certificate verification register is, by design, accessible worldwide and displays only the minimum data needed to verify a certificate.

Third-party links

Our website may include links to third-party websites or content, including live news feeds from external health and safety organisations. We have no control over these, so you should read the privacy policy of any third-party site you visit.

Is your personal data secure?

We take the security of your data seriously and have put in place appropriate measures to protect it. We limit access to your personal data to those who need it for business purposes, and they are subject to confidentiality obligations.

How long do we keep your personal data?

We only keep your personal data for as long as reasonably necessary to fulfil the purposes for which it was collected. Learner registration and assessment records are kept for six years from certificate issue, and financial records for six years, in line with UK legal and accounting requirements. Verification register entries are kept for as long as the certificate remains verifiable, because the register exists to preserve certificate integrity. Routine security backups are retained on a 30-day rolling basis.

Your legal rights

Under data protection law, you have the following rights:

• The right to be provided with a copy of the personal data we hold about you.
• The right to request correction of inaccurate or incomplete data.
• The right to request erasure of your personal data in certain circumstances.
• The right to object to, or request restriction of, our processing of your data.
• The right to data portability.
• The right to withdraw consent at any time where we rely on consent.

To exercise any of these rights, please contact us using the details below. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection, at ico.org.uk.