Privacy Policy

At a glance

This policy explains how we handle personal information when someone visits our website, books a demo, contacts us, buys from our shop, uses the Tili Safe platform, receives support or takes part in a content-production project.

Important distinction For most website, sales and account-administration information, Tili Safe is the controller. Where an organisation uses the Tili Safe platform to manage its workforce or contractors, that organisation will normally be the controller and Tili Safe will process the information on its instructions under a separate data processing agreement.

1. Who we are

Tili Safe Training Ltd (“Tili Safe”, “we”, “us” or “our”) is a company registered in England and Wales under company number 12938781. Our registered office is Holme House, 12 Bar Road North, Beckingham, Doncaster, England, DN10 4NN. Our trading address is Retford Enterprise Centre, Randall Way, Retford, DN22 7GR.

For questions about this policy or to exercise a data protection right, email support@tilisafe.com or write to our trading address marked “Data Protection”.

2. Who this policy applies to

This policy applies to website visitors, prospective customers, customer contacts, shop buyers, authorised platform users, learners and contractors whose information is managed through the platform, suppliers, project participants and people who contact or receive communications from us.

Customer organisations should also give their employees, contractors and other learners their own privacy information explaining how they use training and competence records.

3. Information we collect

Identity and contact details, such as name, work email address, telephone number, employer, role and business address.
Enquiry and demo details, including number of sites, primary need, messages, meeting notes and correspondence.
Shop and transaction details, including products, subscriptions, billing and delivery information, order history and payment status. Payment card details are handled by the payment provider and are not intended to be stored by Tili Safe.
Platform account details, such as username, organisation, site, role, permissions and authentication information.
Training and operational records, such as course assignments, attempts, progress, completion, assessment or practical sign-off, certificates, expiry dates, renewals, contractor bookings and audit records.
Content-production information, which may include names, roles, likeness, image, voice, approved scripts, permissions and footage captured during filming.
Support and service information, including requests, correspondence, troubleshooting information and actions taken.
Technical information, such as IP address, device and browser information, approximate location derived from IP, pages viewed, timestamps, security events and diagnostic logs.
Marketing preferences and records of consent, objections, opt-outs and engagement with our communications.
Information received from a customer organisation, an authorised manager, a colleague, a supplier, a public business source or another person who has authority to provide it.

4. How and why we use personal information

To respond to enquiries, arrange and tailor demonstrations, prepare proposals and take steps requested before entering a contract.
To process orders, deliver workstations, activate subscriptions, administer accounts, provide training services and fulfil contracts.
To operate the platform, record learning activity, produce certificates and reports, support practical sign-off and maintain audit trails on a customer organisation’s instructions.
To plan, film, edit, approve and deliver site-specific training and other content-production work.
To provide onboarding, customer service, technical support, maintenance and security.
To manage billing, accounting, tax, debt recovery, complaints, disputes and business records.
To improve our website, platform, products, accessibility and service performance using proportionate usage information and feedback.
To protect users, customers, our systems and our rights; prevent misuse and fraud; investigate incidents; and meet legal or regulatory obligations.
To send relevant business communications where permitted, and to honour marketing preferences and objections.

5. Our lawful bases

We only use personal information where we have a lawful basis. The basis depends on the purpose and circumstances.

Contract: where processing is necessary to take requested pre-contract steps or perform a contract with an individual.
Legitimate interests: to operate and improve a business-to-business service, respond to business enquiries, manage customer and supplier relationships, secure our systems, establish or defend claims and send proportionate business communications. We consider the impact on individuals before relying on this basis.
Legal obligation: where we must keep records or disclose information to comply with law, regulation, tax, accounting or lawful authority requirements.
Consent: where consent is required, including for optional non-essential cookies, certain electronic marketing or the agreed use of a person’s image or voice. Consent can be withdrawn at any time, without affecting earlier lawful processing.

6. When we act for customer organisations

A customer organisation normally decides why and how learner, workforce and contractor information is used in the Tili Safe platform. In that situation, the customer is the controller and Tili Safe acts as its processor. Requests about those records should usually be made to the relevant employer or customer organisation first.

We handle processor information only on documented instructions, apply appropriate security, restrict access, assist the customer with rights and compliance duties, and return or delete information as agreed in the contract and data processing agreement. We may use limited account, security and service-management information as a controller where necessary to run and protect our own service.

We may share personal information only where necessary with the following categories of recipient:

Hosting, cloud infrastructure, database, email, communications, customer-support, analytics and security service providers.
Payment, banking, accounting, tax, fulfilment, delivery, installation and professional service providers.
A customer organisation and its authorised managers, assessors or administrators, according to configured permissions.
Filming, editing or production partners working under appropriate confidentiality and data protection terms.
Professional advisers, insurers, auditors, regulators, courts, law enforcement or public authorities where required or appropriate.
A buyer, investor or successor in connection with a proposed or completed corporate transaction, subject to appropriate safeguards.

We do not sell personal information.

8. International transfers

Some service providers may store or access information outside the United Kingdom. Where personal information is transferred internationally, we use a lawful transfer mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another permitted safeguard. Information about the relevant safeguard can be requested from support@tilisafe.com.

9. How long we keep information

We keep personal information only for as long as needed for the purpose collected, including contractual, security, legal, accounting and dispute-resolution needs. Our usual periods are:

Demo enquiries and general sales correspondence: up to 24 months after the last meaningful contact.
Customer contracts, orders, invoices and core transaction records: generally seven years after the end of the relevant financial year or relationship.
Platform learner and contractor information: for the customer’s subscription term and then deleted or returned within 90 days, unless the customer agreement, a legal requirement or an active dispute requires otherwise. Residual encrypted backups are overwritten on the normal backup cycle.
Support tickets and routine service correspondence: up to 24 months after closure; longer where needed for a continuing account, security issue or claim.
Security and diagnostic logs: normally up to 12 months, unless needed for an investigation or agreed otherwise.
Filming permissions, project files and approved course materials: for the project and any agreed period of use, archive or revision under the relevant scope of work.
Marketing records: until consent is withdrawn or an objection is made, and suppression records for as long as needed to ensure we respect that choice.

10. Cookies and similar technologies

Our website may use strictly necessary technologies to provide navigation, basket or session functionality and protect the site. Optional analytics, preference or marketing technologies will only be used where permitted and, where required, after a visitor has made a choice through the cookie controls.

A separate Cookie Notice should identify each cookie or similar technology, its provider, purpose and duration. Visitors should be able to reject optional cookies as easily as accepting them and change their choice later. Browser settings can also restrict cookies, although essential functions may then be affected.

11. Direct marketing

We may send relevant business-to-business communications where permitted by law. Where consent is required, we will ask for it. Every electronic marketing message will provide a clear way to opt out. An individual can object at any time by using the unsubscribe method provided or emailing support@tilisafe.com.

We will not use demo enquiry details for a mailing list where the form states that there is no mailing-list signup, unless the person later makes a separate marketing choice.

Your right to object You have the right to object at any time to the use of your personal information for direct marketing. You may also object to processing based on legitimate interests; we will consider the circumstances and stop unless we have compelling lawful grounds or need the information for legal claims.

12. Security

We use appropriate technical and organisational measures designed to protect personal information against accidental or unlawful loss, alteration, disclosure, access or destruction. Measures include access controls, role-based permissions, authentication, encryption where appropriate, logging, backups, supplier controls and procedures for handling incidents.

No internet service is completely secure. Users must protect their credentials, use authorised devices and tell us promptly if they suspect unauthorised access.

13. Your data protection rights

Depending on the circumstances, individuals may have the right to:

Ask for access to their personal information and information about its use.
Ask for inaccurate information to be corrected and incomplete information completed.
Ask for information to be erased in certain circumstances.
Ask us to restrict how information is used in certain circumstances.
Object to processing based on legitimate interests and object at any time to direct marketing.
Receive certain information in a structured, commonly used and machine-readable format, or ask for it to be sent to another controller, where portability applies.
Withdraw consent at any time where processing relies on consent.
Ask not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, where that right applies.

To exercise a right, email support@tilisafe.com. We may ask for proportionate information to verify identity and authority. There is normally no charge, and we normally respond within one month. Where Tili Safe is acting as a processor, we may refer the request to the relevant customer organisation.

14. Automated decisions

Tili Safe does not currently use website or platform personal information to make decisions based solely on automated processing that produce legal or similarly significant effects on individuals. Training status, reminders and reports may be generated automatically from configured rules, but employment, access or competence decisions remain the responsibility of the customer organisation and its authorised people.

15. Children

Our website, shop and business services are not directed at children. Customer organisations are responsible for ensuring they have an appropriate lawful basis, transparency information and any necessary safeguards before assigning platform training to a person under 18.

16. Complaints

Please contact us first at support@tilisafe.com so we can try to resolve a concern. Individuals also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, through ico.org.uk/make-a-complaint or by calling 0303 123 1113.

17. Links to other websites

Our website may link to services operated by other organisations. Their privacy practices are governed by their own notices, and we are not responsible for those external services.

18. Changes to this policy

We may update this policy when our services, suppliers or legal obligations change. The current version will be published on the website with its last-updated date. Where a change materially affects how we use personal information, we will take reasonable steps to bring it to the attention of affected people before the new use begins.