What we collect,
and what we do with it

Information you give us

When you use the enquiry form on our contact page, we ask for your name, email address and phone number, what you are contacting us about, your message, and how you would prefer us to reply. It reaches us by email, is stored in our website’s own records, and is passed to our booking system so staff can answer it there. That system is ours, and is covered by its own privacy policy.

If you message us on WhatsApp, we receive whatever you send, along with the phone number you send it from. WhatsApp is run by Meta, not by us, so your message passes through their service under their terms before it reaches us.

If you go on to enrol on a course, we collect the further details needed to register you with the awarding body and to run the course — typically your full name as it should appear on your certificate, your contact details, your employer where a company is paying, and your assessment results.

Information collected automatically

Like most websites, ours records some technical information when you visit: your IP address, your browser and device type, the pages you look at and how you arrived. Cloudflare, which sits in front of our site, sees this as part of delivering the page to you, and also counts page views and load times for us. That counting uses no cookies and cannot identify you. Google Analytics is different: it records nothing unless you have agreed to it — see Cookies below.

Our security software logs IP addresses and failed login attempts, which is how we keep the site from being broken into, and reports the addresses it blocks to its supplier so that other sites are protected from the same attacker.

When you send the enquiry form, your enquiry and the IP address it came from are checked by a spam-filtering service before they reach us.

We do not ask for, and have no use for, special category information such as health data — beyond anything you choose to tell us yourself when arranging access requirements for a course.

• To answer your enquiry and tell you about dates, fees and entry requirements.
• To enrol you on a course, register you with the awarding body and issue your certificate.
• To meet obligations we have as an accredited training provider, including record keeping required by awarding bodies and by SHENA.
• To keep the website working, secure and free of spam.
• To understand which pages people find useful, so we can improve them.

We do not sell your information, and we do not use it for advertising.

We do not share your information publicly. We do share it with the organisations we need to in order to deliver what you have asked for.

Awarding bodies

If you enrol on a qualification, we pass the details needed to register you and to award your certificate to the relevant body — NEBOSH, IOSH, CIEH or PECB. These organisations are based in the United Kingdom and in Canada, which means your information is transferred outside Brunei Darussalam. Each of them holds your data under its own privacy policy as well as ours.

One qualification, the NEBOSH IIRSM Certificate in Managing Risk, is certificated jointly with IIRSM, so your registration reaches them as well, and the course itself is studied on NEBOSH’s own e-learning platform.

Regulators

As an Approved Training Provider we may be required to make training records available to the Safety, Health and Environment National Authority (SHENA).

The services that run our website

• Hostinger — hosts the website and its database.
• Cloudflare — delivers and protects the site; all traffic passes through it, and it counts page views for us without using cookies.
• MXroute — runs our email. Anything you send us, and anything we send you, passes through their servers.
• Google Drive — holds our weekly backup. A backup is a copy of the whole site, so it includes any enquiry you have sent us.
• Maspik — filters out spam. Every enquiry, and the IP address it was sent from, is checked by Maspik’s automated and AI tools before it reaches us.
• Wordfence — protects the site, and receives the IP addresses it blocks.
• Google Analytics — tells us how the site is used, and only if you agree.
• Google Maps — shows the map on our contact page. Opening that page lets Google see your IP address, whether or not you accept analytics.

We may also disclose information where the law requires it.

Cookies are small files a website stores in your browser. Ours uses them for three things:

• Analytics, and only if you agree — the first time you visit, we ask. Until you accept, Google Analytics is switched off and stores nothing at all. If you accept, it sets cookies named _ga and _ga_KX44WM4TLF, which let us work out whether visits come from the same browser. They are set to last about two years, though browsers now shorten that themselves — Chrome keeps them for about thirteen months, and Safari for about a week.
• Making pages load quickly — our caching software stores one cookie, _lscache_vary, so it can serve you the right version of a page. It holds nothing about you, is the same value for every visitor, and lasts two days. It is set whether or not you accept analytics, because without it pages would be served wrongly.
• Security — Cloudflare may set a cookie to tell genuine visitors from automated traffic. This one keeps the site up and safe to use, so it is not part of the choice above.

Cloudflare also counts page views and load times for us. That measurement uses no cookies and cannot identify you, so it is not part of the choice above either.

You can change your mind whenever you like, using the Cookie Preferences button at the bottom of any page. If you decline, we also delete any analytics cookies your browser picked up earlier.

You can block or delete cookies in your browser settings as well. The site will still work; we will simply have less idea which pages are useful.

We keep enquiries, and the learner and assessment records that follow from them, for four years.

Where an awarding body requires a record to be kept for longer, we keep it for as long as it says. Certificates and results in particular need to be retrievable years later, because learners ask us to confirm them.

Analytics data is retained by Google under its own schedule. Security logs and spam-filter records are kept only as long as they are useful for protecting the site.

You can ask us to tell you what information we hold about you, to correct it if it is wrong, or to delete it. Write to [email protected] and tell us what you would like.

Two honest limits. Where a record is one we are required to keep as an accredited provider, we may not be able to delete it, and we will say so rather than quietly ignore the request. And once an awarding body holds your registration, that is their record as well as ours, so you may need to approach them directly too.

You are free to refuse to give us information, though it may mean we cannot enrol you or answer properly.

You can also turn website analytics on or off at any time, using the Cookie Preferences button at the bottom of any page. Cookies explains what that covers.

Other sites

Some sites we mention, such as SHENA and the awarding bodies, are not run by us, and we are not responsible for how they handle your information. Our booking system is ours, but it is a separate system with its own privacy policy, which covers the enquiries passed to it and the booking and payment records it keeps.

Children

Our courses and this website are meant for adults. We do not knowingly collect information from children. If you think a child has sent us their details, email [email protected] and we will delete them.

Changes

If this policy changes we will update this page and the date below. Continuing to use the site means you accept the version published here.