Privacy policy

Who we are

QOSH (Quality Occupational Safety & Health) is an independent awarding body for occupational safety & health. QOSH is the data controller for the personal data processed through qosh.org and our certification systems. This policy explains what we collect about learners, Approved Training Centres, and visitors, why, and how it is handled under the UK GDPR and the Data Protection Act 2018. To contact us about your data, use our contact page.

What we collect

• Learner records — provided by Approved Training Centres when a learner is enrolled: full name, date of birth, email, and (optionally) phone number.
• Certification records — each certificate stores an immutable snapshot of the learner's name, the course title, credit hours, completion and issue dates, the authorised signatory, and the delivering Approved Training Centre.
• Approved Training Centre data — organisation and primary-contact details and declarations from the application. The contact email also serves as the login username for the partner portal; the chosen portal password is stored only as a secure hash, never in plain text.
• Payment records — card payments are taken in GBP through our payment provider, Ziina. We store the payment amount, status, and Ziina reference. We do not store card details — these are handled by Ziina.
• Website analytics — Google Analytics 4, only where you have consented, with IP anonymisation enabled.

Our lawful bases

We rely on the following lawful bases under Article 6 of the UK GDPR:

• Performance of a contract — issuing, verifying, revoking and reinstating certificates; managing Approved Training Centre licensing; processing payments.
• Legitimate interests — operating the awarding body and keeping certificate verification trustworthy and resistant to fraud.
• Consent — analytics cookies, and contacting Approved Training Centre applicants about their application.
• Legal obligation — meeting our accounting and record-keeping duties.

How we use it

We use personal data to issue, verify, revoke and reinstate certificates; to manage Approved Training Centre licensing and payments; to respond to enquiries; and to understand how the site is used. We never sell or rent personal data.

Who we share it with

We share data only as needed to run the service: with the relevant Approved Training Centre (their own learners); with Ziina (to process payments); and with vetted hosting and email providers acting on our instructions under contract. We may disclose data where required by law. We do not share personal data with any other third parties.

International transfers

Ziina processes and settles payments outside the UK (in the UAE, converted to AED). Where personal data is transferred outside the UK, we rely on appropriate safeguards — such as the UK International Data Transfer Agreement, standard contractual clauses, or an adequacy decision, as applicable.

How long we keep it

Certificate snapshots are retained for the life of the credential so that past verifications remain trustworthy — revocation, not deletion, is how a credential is invalidated. Approved Training Centre and account data is kept for the duration of the relationship plus any legal retention period, then deleted.

Verification

Certificates can be verified publicly by certificate ID. The public verification page shows only the name, course title, credit hours, completion date, issue date, and signatory for that certificate — no other personal data is exposed.

Your rights

Under the UK GDPR you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, and the right to data portability; you may also withdraw consent at any time. Erasure is subject to the certificate-integrity point above. To exercise any of these rights, contact us via our contact page. If you are not satisfied with our response, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk.

Cookies

See our Cookie policy for the cookies we use and how to control them.

Changes to this policy

We may update this policy as our practices evolve; we will revise the “last updated” date above when we do.