Privacy & Cookies Policy

Under certain circumstances, by law you have the right to:

• Request access to your personal data (commonly known as a data subject access request). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

• Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.

• Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing (see below).

• Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal data for direct marketing purposes.
• Request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you, for example if you want us to establish its accuracy or the reason for processing it.
• Request the transfer of your personal data to another party.

If you want to exercise one of the above rights, please contact our COO in writing at the details above.

No fee usually required

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in these circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is to ensure that personal data is not disclosed to any person who has no right to receive it.

Right to withdraw consent

Where you may have provided your consent to the processing of your personal data for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact our COO. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

We collect and process personal data that is provided by you or your organisation to us. This could be (but is not exclusive to) via our website, online and/or paper forms, social media, letter, email or phone when enquiring about our products and services, during correspondence, entering into an agreement with us as a client or supplier, setting up your account, placing and sending orders or collected during a training course.

The individuals we, or our approved consultant suppliers such as trainers and bookkeepers, collect personal data on include learners, client trainers, approved suppliers and client contacts (decision-makers, administrators and invoicing contacts).

In the case of learners and client trainers, we obtain information from your employer  and, where required, from yourselves directly on the day of training. We only collect personal data that is necessary to provide the services and to comply with our legal obligations.

When providing individuals’ personal data to Maybo it is your responsibility to ensure that you do so lawfully including, where applicable, having obtained consent from the individuals for Maybo to collect and process their personal data.

Examples of information provided to Maybo could include:

• Employers sharing learners’ details with Maybo to enable them to provide the training
• Learners' information when requesting certificates (see Certificate Verification and Certificate Replacements sections below)
• A colleague's or third party's name and email/delivery address when placing orders
• Notifying us of an incident by completing an incident report
• Client trainers' information when booking them on a course

Learners/client trainers

For learners including client trainers, we process information relevant to the training and records required. This includes their name, signature, contact information, gender, employer, courses completed/level of training and pass mark. At their option, learners can provide their date of birth and employee number to assist with future verification of their certificate by Maybo.

In addition, for client trainers, we process details relating to their assessment by Maybo. We also process the first and last name of the learners that they train within their organisation for the purpose of providing certificates.

For learners/client trainers participating in training that involves the teaching of physical skills, we process information relating to pre-existing injuries/health conditions as necessary to provide the services and to comply with our legal obligations. In the rare event that any injuries or physical discomfort is experienced on the course, we will also process this information in order to investigate the matter and notify our insurers. This is special category data.

The lawful bases and conditions we rely on to process this personal data are set out in How do we use your Personal Data section.

Client/supplier contacts

For client/supplier contacts the data collected can include name, title, job role, company name, telephone/mobile number, email address, address.

Learners/client trainers

We use the personal data to:

• organise and provide the training, assess the learner/client trainer, record the learners’/client trainers’ achievement, confirm it to their employer and issue certificates
• provide certificates for learners trained by client trainers
• verify the training received (such as when learners move to a new employer or where a member of the public requests verification) and issue replacement or copies of certificates (see Certificate Verification and Certificate Replacement sections below)
• where training involves the teaching of physical skills, confirm the employer’s declaration that the learners are fit and able to receive the training and record and investigate any incidents that occur.

We rely on the lawful basis of legitimate interests for this processing (it is in our legitimate interests to provide the services we are contracted to provide and it is in your legitimate interests to receive the training and certification, and in the case of physical skills, to confirm your fitness to receive the training). The details of injuries and health conditions are special category data so we also rely on explicit consent to process this or on the exemption under article 9(2)(f) of the UK GDPR.

Client/supplier contacts

We use the personal data to administer the contract.

We rely on the lawful basis of contract to process this information.

There are instances where certificate verification can be provided:

• Where a Learner does not have their original Maybo certificate, members of the public can request verification of a Learner’s certification date and level/s certified. This information can only be provided if the full name and date of birth of the Learner provided by the requesting party matches details held by Maybo
• Members of the public can check that a certificate presented to them is valid and has been produced by Maybo. Upon provision of the details contained in the certificate we will check our records and confirm or not confirm if the certificate is valid and accurate
• To request verification of certificates please email info@maybo.com providing the first and last name, date of birth and level of training certificates with scans of certificate where available

There are instances where copies of Learners certificates can be provided:

• Centres who provided the Learners training can request certificate replacements via Maybo Online
• Individuals can request copies of their certificates
• Third-party requests for Learner certificate replacements will only be considered with the express permission of the Learner
• Please email requests for eCertificate copies to info@maybo.com supplying first and last name, date of birth and the level of the training certified. Please also note there is a charge of £5 plus VAT for this service

We keep your personal data for as long as necessary to fulfil the purposes for which it was collected, including for the purpose of satisfying any legal, accounting or reporting requirements. Learner and client trainer related information is kept for up to 10 years for the purpose of enabling certification and verification and to investigate and respond to legal claims.

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. Additionally, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality. 

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

We only share your personal data where it is necessary to do so to provide the services,  to comply with a legal obligation or where we have another legitimate interest to do so. 

We require third parties to respect the security of your information and to treat it in accordance with the law.

We share your personal data with the following service providers in order to provide the services:

• Freelance trainers that deliver the training on Maybo’s behalf
• Salesforce.com Customer Relationship Management system (CRM) - A dedicated web database sited on a secure server
• Google Drive and Gmail
• FormAssembly (A web form solution for enterprises looking for the highest level security, compliance and integration with Salesforce) Employees, users, customers, clients, consultants use forms to enter and process data for export to Salesforce
• LearnUpon.com eLearning Learning Management System (LMS)
• Xero.com (Cloud access to Xero finance package)
• Maybo Online (resources and forms accessed via website logins)
• VRM MLP (client records and stock ordering, closure due August 2018)

The service providers are data processors and we have contracts in place with them  which ensure that they cannot do anything with your personal data unless we have instructed them to do it. They will not share your personal information with any organisation apart from us. They will hold it securely and retain it for the period we instruct. 

We may share your personal data with other third parties, for example in the context of the possible sale or restructuring of the business. In this situation we will, so far as possible, share anonymised data with the other parties before the transaction completes. Once the transaction is completed, we will share your personal data with the other parties if and to the extent required under the terms of the transaction.

We may also need to share your personal data with a regulator or to otherwise comply with the law. This may include making returns to HMRC and disclosures to shareholders such as directors' remuneration reporting requirements.

We process your personal data within the UK. However, in operating our services, it may become necessary to transfer the data that we collect from you to third parties and business partners who are located outside of the UK and outside the European Economic Area (EEA), for support, processing or maintenance of the purposes. Any such transfer of information will only be in connection with the services that Maybo provides and for a purpose that is stated in this privacy policy. Maybo will ensure that the personal data is protected to a level which meets the requirements of the Data Protection Act 2018 and the UK GDPR.

A cookie is a small file which asks permission to be placed on your computer's hard drive. Once you agree, the file is added and the cookie helps analyse web traffic or lets you know when you visit a particular site. Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences.

We use Google Analytics traffic log cookies to identify which pages of our website are being used. This helps us analyse data about web page traffic and improve our website in order to tailor it to customer needs. The cookie collects information about your device type, operating system and browser type but it does not collect any personal data. We only use the information collected for statistical analysis purposes and then the data is removed from the system.

Overall, cookies help us provide you with a better website, by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer and, as noted above, the cookies we use do not collect your personal data.

You can choose to accept or decline cookies the first time you visit our website. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the website.

Our website may contain links to other websites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over that other website.

Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question.