Privacy policy
Last updated 12 November 2026
Obsidra Training & Solutions is a UK business. We are the controller of the personal data described here. Contact: [email protected].
What we collect and why
| Data | Why | Lawful basis (UK GDPR) | Kept for |
|---|---|---|---|
| Name, organisation, email and anything you write when you email us or use the enquiry form (the form only opens an email in your own mail app; nothing is stored on this site) | To reply, quote and send invoices | Legitimate interests / steps before a contract | 2 years after last contact |
| Order details: name, email, organisation, what you bought, invoice and PO numbers | To deliver courses, certificates and toolkits, and for tax records | Contract; legal obligation (HMRC) | 6 years (tax law) |
| Learner names, emails and course completion (for certificates). If your employer enrols you, they give you this notice when enrolling you | To issue certificates and confirm training to the employer who booked | Contract / legitimate interests of the employer | 3 years, so certificates can be re-issued |
| Business contact details from public sources (organisation name, role, work email) | To send occasional business-to-business emails about training or kits relevant to your organisation | Legitimate interests (B2B marketing, with an opt-out in every email) | Until you opt out; opt-outs kept on a suppression list so we never email you again |
We do not sell your data, use it for advertising profiles or make automated decisions with legal effects about you.
Where we get business contacts
We find work contact details from public sources such as organisation websites, the Charity Commission register, Companies House and professional directories. We tell you this in our first email, which links to this notice.
Who processes it for us
- Payhip runs our shop and course delivery; payments are handled by Stripe or PayPal. We never see your card details. See Payhip's privacy policy.
- Google (Gmail, Google Drive) for email and secure file storage.
- Cloudflare hosts this website and keeps short-lived server logs (such as IP address) for security.
- GitHub stores our private business records and code.
Some of these providers are based in the US. Transfers to Google, Cloudflare, GitHub, Payhip, Stripe and PayPal rely on the UK Extension to the EU–US Data Privacy Framework or the UK International Data Transfer Addendum.
Your rights
You can ask to see, correct, delete or limit the use of your data, object to it being used (including all marketing, at any time), or ask for a copy to move elsewhere. Email [email protected]. We reply within one month.
If you're unhappy with how we've handled your data you can complain to the Information Commissioner's Office: ico.org.uk or 0303 123 1113. We'd appreciate the chance to sort it first.
Server logs
Cloudflare, which serves this site, keeps basic access logs (IP address, browser, pages visited) for a short period for security. We don't use them to identify you.
Cookies and analytics
This site sets no cookies. To count visits we use Cloudflare Web Analytics, a privacy-first visitor counter. It sets no cookies, stores nothing on your device, doesn't fingerprint you and doesn't follow you across sites. It only gives us anonymous totals (page views, which pages, which site sent you). Ad blockers that block it are fine with us. See our cookie policy.
Changes
We'll show the date at the top and, for big changes, email active customers.