Privacy Notice
TPB-Group Ltd
Last reviewed: 6 November 2026
TPB-Group Ltd is committed to protecting personal information and respecting the privacy of individuals whose information we collect, receive or process.
We provide health and safety consultancy, HR and people support, ISO management systems consultancy, auditing and professional training services.
In delivering these services, we may process personal information relating to customers, employees, training delegates, suppliers and individuals involved in matters referred to us by our clients.
This Privacy Notice explains how we handle personal information, why we use it, how we protect it and the rights individuals have under UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who We Are
TPB-Group Ltd provides professional health and safety, HR and people support, ISO management systems consultancy, auditing and training services.
Our business address is:
TPB-Group Ltd
Galloways, Howick House
Howick Park Avenue
Penwortham
Preston
PR1 0LS
For enquiries about how we collect, use, store or protect personal information, or to exercise your data protection rights, please contact:
Email: info@tpb-group.co.uk
TPB-Group Ltd acts as a data controller when determining how and why personal information is processed for its own business activities.
When providing services on behalf of customers, we may act as a data processor, handling personal information under their instructions. Our responsibilities depend on the nature of the services and the arrangements agreed with each customer.
2. Personal Information We Collect
The personal information TPB-Group Ltd collects or receives depends on the services we provide and our relationship with the individual concerned.
This may include names, job titles, business and personal contact details, employer information, training attendance records, assessment results, qualifications and certification details.
When providing health and safety, HR and people support, auditing or consultancy services, we may also receive information relating to workplace incidents, investigations, grievances, disciplinary matters, employment records and occupational health concerns.
Some information may be particularly sensitive, including details concerning an individual’s physical or mental health. Where we process special category personal data, we apply the additional protections required by data protection legislation.
We may also collect information submitted through our website contact forms, email correspondence, telephone enquiries and other communications.
We only collect or process personal information where it is necessary for a specified and legitimate purpose. The information we handle will depend on the particular service or activity involved.
3. Why We Use Personal Information
TPB-Group Ltd processes personal information where there is an appropriate lawful basis under UK GDPR. This includes processing necessary to provide our professional services, manage our business activities and meet applicable contractual and legal responsibilities.
These purposes may include responding to enquiries, preparing quotations, managing customer relationships, delivering consultancy and training services, maintaining training and certification records, providing HR and people support, conducting workplace assessments and investigations, and meeting applicable legal and regulatory requirements.
Under UK GDPR, the lawful basis for processing depends on the particular activity and may include:
Performance of a contract: Where processing is necessary to fulfil a contract with an individual or take steps requested by that individual before entering into a contract.
Legal obligation: Where processing is necessary to comply with a legal requirement.
Legitimate interests: Where processing is necessary for our legitimate business interests or those of another party, provided these interests are not overridden by individuals’ rights and freedoms.
Consent: Where consent is the appropriate lawful basis, individuals may withdraw it at any time.
Where we process special category personal information, such as health information, we must also identify an applicable condition under Article 9 of UK GDPR and, where required, the Data Protection Act 2018.
When processing personal information on behalf of a customer acting as the data controller, we follow the customer’s documented instructions and applicable data processing arrangements.
4. How We Share Personal Information
TPB-Group Ltd treats personal information confidentially and only shares it where there is a legitimate and lawful reason to do so.
Depending on the services being provided, personal information may be shared with our customers, authorised training and certification organisations, professional advisers, IT and secure document storage providers, and regulatory or public authorities where required or permitted by law.
When providing HR and people support services, we may prepare investigation reports, disciplinary documentation, grievance records and other confidential employment information for the customer concerned.
Where TPB-Group acts as a data processor, information is handled and disclosed in accordance with the customer’s documented instructions and applicable contractual arrangements.
Where third-party organisations process personal information on our behalf, we take appropriate steps to ensure that suitable contractual, confidentiality and security arrangements are in place, as required by applicable data protection legislation.
We do not sell personal information to third parties.
Personal information will not be disclosed to unauthorised individuals or organisations.
5. How We Store and Protect Personal Information
TPB-Group Ltd takes the security and confidentiality of personal information seriously.
We use electronic systems, including ShareFile, to store and manage business records and confidential customer documentation.
Access to confidential HR and employment records held within our secure document storage systems is restricted to specifically authorised personnel who require access to carry out their responsibilities. Access permissions are controlled and reviewed as appropriate.
We apply access restrictions and other appropriate organisational and technical measures to reduce the risk of unauthorised access, accidental loss, misuse or disclosure of personal information.
Where confidential information is shared with customers or other authorised recipients, we take reasonable steps to ensure that it is sent to the correct recipient using an appropriate method.
We review our information security arrangements periodically and seek to improve them where necessary.
Although no electronic system can guarantee absolute security, we aim to maintain safeguards appropriate to the nature and sensitivity of the information being processed.
6. How Long We Keep Personal Information
TPB-Group Ltd recognises that personal information should not be retained for longer than is necessary for the purposes for which it was collected or processed.
The appropriate retention period depends on the nature of the information, the purpose for which it is held, applicable legal requirements, contractual obligations and the potential need to establish, exercise or defend legal claims.
Where we process personal information on behalf of a customer acting as the data controller, we follow applicable contractual arrangements and documented instructions concerning the retention, return or deletion of that information.
Some historical consultancy and HR records have been retained electronically for extended periods. We are reviewing these arrangements and developing a formal retention and disposal schedule to ensure that records are retained only where there is an appropriate justification.
Where information is no longer required and there is no lawful reason to retain it, appropriate arrangements will be made for its secure deletion or disposal.
Individuals may contact us using the details provided in this notice if they have questions about how long their personal information is retained.
7. Your Data Protection Rights
Under UK data protection legislation, individuals have certain rights concerning their personal information. These rights depend on the circumstances and the lawful basis for processing.
These may include the right to request access to personal information held about them, ask for inaccurate information to be corrected, request erasure where applicable, and request that processing be restricted.
Individuals may also have the right to object to certain processing activities and, in some circumstances, receive their personal information in a portable format.
Where processing relies on consent, individuals have the right to withdraw that consent at any time.
To exercise these rights or raise a question about personal information, please contact us at info@tpb-group.co.uk.
We will consider requests in accordance with applicable data protection legislation.Where TPB-Group Ltd is the data controller, we will respond to requests without undue delay and within the timescales required by applicable data protection legislation, including any permitted extensions.
Where we process information on behalf of a customer acting as the data controller, we will assist the customer in responding to requests as required by our contractual and legal obligations.
We do not normally charge a fee for exercising data protection rights, although legislation permits fees or refusal in certain limited circumstances.
8. Complaints and Concerns
TPB-Group Ltd takes concerns about the handling of personal information seriously.
If you have a question, concern or complaint about how we collect, use, store or share personal information, please contact us at info@tpb-group.co.uk.
We will acknowledge data protection complaints within the timescales required by applicable legislation, investigate them as appropriate and provide a response without undue delay. We will maintain appropriate records of complaints received and the actions taken.
You also have the right to raise a complaint with the Information Commissioner’s Office (ICO), the UK’s independent regulator for data protection.
Information Commissioner’s Office
Website: https://ico.org.uk
Telephone: 0303 123 1113
You do not have to raise your concern with TPB-Group Ltd before contacting the ICO, although we welcome the opportunity to resolve concerns directly.
9. Website Cookies and Security Monitoring
Our website uses cookies and security technologies to support its operation and help protect against unauthorised access, malicious activity and automated attacks.
Cookies are small pieces of information stored on a visitor’s device when accessing a website.
Our website uses WP Cerber Security to monitor website traffic and identify potentially suspicious activity. Information processed for website security may include IP addresses, requested pages, dates and times of access, and technical information associated with website requests.
We periodically review the cookies and similar technologies used by our website to establish their purpose, whether they are necessary for its operation and whether visitor consent is required. Where cookies requiring consent are identified, we will take appropriate steps to ensure that they are not used without the necessary consent.
Cookies that are strictly necessary to provide a service requested by a visitor, or to enable communications, may be used without prior consent where the applicable legal exemption applies.
Where cookies or similar technologies require consent under applicable legislation, we will seek that consent before using them.
Visitors may also manage or delete cookies through their browser settings.
For questions about cookies or website privacy, please contact info@tpb-group.co.uk.
10. Review and Updates to This Privacy Notice
TPB-Group Ltd will review this Privacy Notice periodically and update it when necessary to reflect changes in our services, working practices, technology or applicable data protection legislation.
Where significant changes are made to how we process personal information, we will take appropriate steps to inform affected individuals.
The latest version of this Privacy Notice will be available on our website.
Last reviewed: 6 November 2026
Next scheduled review: November 2027
For further information about this notice or how TPB-Group Ltd handles personal information, please contact info@tpb-group.co.uk.
