Privacy Policy

Home » About MTD » MTD Privacy Policy

Version 1 · September 2026 · Replaces the privacy content of GDPR Policy v4

This notice explains what personal data we collect about you, why we use it, who we share it with, how long we keep it and what rights you have. It applies to visitors to our website, people who enquire about our services, clients, and delegates who attend our training.

Separately, we hold an internal Data Protection Policy setting out how we control personal data within the business. Clients carrying out supplier due diligence can request a copy.

1. Who we are and how to contact us

Management Training & Development Limited, trading as MTD Training, is the controller of your personal data.

Field	Detail
Company number	4345673
Registered office	5 Orchard Court, Binley Business Park, Coventry, CV3 2TQ
ICO registration	Z1722401
Data protection contact	dataprotection@mtdtraining.com
Post	Data Protection Lead, Management Training & Development Ltd, 5 Orchard Court, Binley Business Park, Coventry, CV3 2TQ
Telephone	0333 320 2883

MTD Training is part of a group of companies owned by MCP Holdings. Skillshub Ltd is a separate limited company in that group — a sister company to MTD Training, not part of it. Skillshub operates its own privacy notice covering anything it does with your data once you are enrolled.

2. The personal data we collect

Category	What it includes
Identity data	First name, last name, job role, company name
Contact data	Email address, telephone number, billing and postal address
Transaction data	Details of services purchased, payments to and from you
Financial data	We do not store or process your card details. They are encrypted in your browser and passed securely to our contracted payment provider.
Technical data	IP address, browser type and version, time zone, operating system, device and platform information
Profile data	Your username and password, login records, purchases, interests, preferences, feedback and survey responses
Usage data	How you use our website, products and services — pages viewed, time spent, clickstream, page interactions
Training data	Attendance, assessment results, coaching notes, DISC profiles, 360 and 180 degree feedback
Marketing data	Your marketing and communication preferences
Special category data	Only where you tell us — dietary requirements, accessibility needs and reasonable adjustment requests. See section 6.

3. Where we get your data from

Directly from you

When you complete a form on our website, complete a survey, correspond with us by phone, email or in writing, report a problem, sign up to our communications, create an account, enter into a contract with us, follow us on social media, subscribe to a free trial, or complete one of our free assessments or questionnaires.

From your employer

Where your employer books training for you, they give us the details we need to enrol you — normally your name, work email address and job role. That is all we ask them for.

If your details reached us this way, you did not give them to us yourself, so we tell you directly. The first email you receive from us identifies who we are, says that your employer provided your details, and links to this notice. You do not have to do anything in response — it is there so you know who holds your data and why.

Automatically when you use our website

Technical and usage data collected through cookies and similar technologies. See section 8.

From third parties

Payment providers, confirming a payment and passing us the related transaction details
Booking agents and venues, in connection with a programme you are attending
Awarding bodies, in connection with certification
Professional advisers such as our lawyers, accountants and insurers

4. Why we use your data, and our lawful basis

We must have a lawful basis for everything we do with your personal data. Where we rely on legitimate interests, we have assessed that our interest does not override your rights, and you can object at any time — see section 13.

What we use it for	Lawful basis	Our legitimate interest, where relied on
Delivering the training, coaching or assessment you or your employer booked	Contract, or legitimate interests where your employer is our customer	Delivering the service our client has contracted for
Managing your account and identifying you	Contract or legitimate interests	Administering our relationship with you
Taking payment and keeping financial records	Contract and legal obligation	—
Responding to enquiries and preparing proposals	Legitimate interests	Responding to people who contact us about our services
Issuing certificates and sharing data with awarding bodies	Contract or legitimate interests	Enabling you to receive the qualification you have worked towards
Giving you Skillshub access where it is part of what was purchased	Legitimate interests	Delivering the after-support our client has paid for
Sending you Email Tips and other marketing	Legitimate interests, or consent where the law requires it	Promoting services relevant to your work. You can opt out at any time.
Improving our services, research and statistical analysis	Legitimate interests	Understanding how our services are used so we can improve them
Understanding your preferences and tailoring what we show you	Legitimate interests	Making our communications and website relevant rather than generic
Detecting and preventing fraud, and keeping our systems secure	Legitimate interests	Protecting our business, our clients and you
Recording calls for quality assurance, training and compliance	Legitimate interests	Maintaining and improving the quality of our service
Meeting legal, regulatory and audit obligations	Legal obligation	—
Responding to law enforcement or regulators	Legal obligation, or a recognised legitimate interest	—

If we need to use your data for a new purpose, we will tell you and explain the lawful basis before we do.

5. Profiling and automated decisions

Some of our tools involve profiling — DISC profiling, 360 and 180 degree feedback, and analysis of how you use our website and what you have purchased.

Results from our profiling and feedback tools are interpreted and delivered by a person, not generated and applied automatically. We do not make decisions about you that produce legal or similarly significant effects using automated means alone.

If that changes, we will tell you, and you will have the right to ask for human involvement, express your point of view and contest the decision.

Where your employer commissions a profile or feedback report about you, they decide how the results are used within their organisation. Questions about that use should be directed to them.

6. Dietary, accessibility and adjustment information

When you attend a programme we may ask about dietary requirements, accessibility needs or reasonable adjustments. This can reveal information about your health or your religious beliefs, which the law treats as special category data and protects more strictly.

We ask for it only where it is needed to deliver the training properly, we ask for it in an optional field, and we rely on your explicit consent. We share only what the recipient needs to know — a venue needs to know about an allergy, not your medical history.

We delete this information shortly after your programme ends unless it relates to an ongoing arrangement. You can withdraw your consent at any time, though we may then be unable to make the adjustment.

Where an awarding body needs this information for a reasonable adjustment, an investigation or an appeal, we will ask for your explicit consent before sharing it.

7. Emails you receive from us, and your choices

There are two different kinds of email we may send you, and you have different choices about each.

7.1 Emails about your training

If you are booked onto a programme, we send you what you need in order to take part — joining instructions, course materials, your Skillshub access and login, and your certificate.

Where Skillshub access is included in what your employer purchased, these emails are how we deliver it. They are part of the service, not marketing, so they do not carry an unsubscribe link. If you do not want to take part, please speak to whoever arranged the training for you.

Your employer can tell us at the outset not to contact you directly, in which case they will pass everything on themselves.

7.2 Email Tips and other marketing

We also send Email Tips — sales and management insights — along with information about our services, free training, reports and offers. These are marketing. They come from MTD Training and are separate from your training emails.

You can unsubscribe from these at any time, free of charge. There is an unsubscribe link in every message, or you can email dataprotection@mtdtraining.com. Unsubscribing from Email Tips will not affect your Skillshub access or any of your training emails — the two are kept entirely separate.

We rely on our legitimate interest in promoting services relevant to your work. Where the law requires your consent instead, we ask for it separately at the point we take your details.

7.3 Skillshub

Skillshub is an e-learning platform run by Skillshub Ltd, a separate company in our group. Where it is included in your training, we enrol you so you can use it.

Skillshub runs the platform on our instructions. It does not use your data for its own purposes and it will not email you in its own name. We remain responsible for your data throughout, so any question or request about it should come to us at dataprotection@mtdtraining.com — including if you want your platform account and usage history deleted.

7.4 Your right to object

You can object to direct marketing at any time and we will always stop. This is your decision, not your employer’s — you can opt out of our marketing even if your employer agreed to it on your behalf.

8. Cookies

A cookie is a small text file placed on your device when you use our website. UK cookie rules changed on 5 February 2026.

Strictly necessary cookies make the site work. They do not require your consent and cannot be switched off.
Analytics cookies tell us how the site is used — how many people visit, which pages they read, where errors occur. Where this information is used only by us, these do not require your consent, but you can opt out free of charge at any time using the controls on our cookie banner.
Appearance and functionality cookies remember your preferences, such as accessibility and display settings. These also do not require consent, and you can opt out in the same way.
Advertising and third-party tracking cookies share information with other organisations. We will only set these with your consent.

You can also set your browser to refuse cookies, though some features of the site may then not work. Our Website Cookie Policy lists the cookies we use. For general information on cookies, see www.aboutcookies.org.

9. Who we share your data with

Recipient	Why
Skillshub Ltd, our sister company	To give you access to the Skillshub e-learning platform where that forms part of your training. Skillshub is a separate limited company under the same parent, MCP Holdings, and holds your name and work email for that purpose.
Other companies in our group	Internal administration. Marketing from another group company only where you have opted in to that company separately.
Suppliers who help deliver your training	Booking agents, venues, associate trainers and writers. They receive only what they need and are bound by contract to protect it.
Awarding bodies	CPD, ILM, ISM, ISP and CMI, for learning, assessment and certification. Each is an independent controller with its own learner privacy notice, which we will direct you to.
Technology and service providers	IT, CRM, e-learning, email, hosting and payment providers, acting on our instructions under written contracts.
Professional advisers	Lawyers, accountants and insurers, to manage risk and legal claims.
Law enforcement, regulators and courts	Where we are legally required, or where disclosure is necessary to establish, exercise or defend legal rights.
A buyer or successor	If we sell or reorganise the business, your data may transfer as part of it. You will be told if that happens.

We do not sell your personal data.

10. Sending data outside the UK

Some of our service providers are based outside the United Kingdom. Where we transfer your personal data outside the UK, we make sure one of the following applies:

The country is covered by UK adequacy regulations, meaning the UK government has decided it provides an adequate level of protection. This includes countries in the European Economic Area.
We have put in place the ICO’s International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, together with an assessment of the risks in that country.
A specific exception in the law applies. We use these only rarely.

If you are in the European Economic Area, your data reaching us in the UK is covered by the European Commission’s adequacy decisions for the UK, renewed on 19 December 2025 and valid until 27 December 2031.

You can ask us for details of the safeguards we use by contacting us.

11. How long we keep your data

We keep personal data only as long as we need it. Where there is a contract between us, we keep your data for the duration of the contract and for a period afterwards to meet our legal, financial, audit and regulatory obligations.

Type of data	How long	Why
Training and attendance records	12 months following completion	Contractual and awarding body requirements
Certification records	6 months following completion	Awarding body requirements
Contracts and related correspondence	6 years after the contract ends	Legal claims can be brought within this period
Financial records	6 years after the end of the financial year	HMRC requirement
Enquiries that did not become a booking	12 months	Following up on your enquiry
Marketing preferences	Until you opt out; we then keep a record of your opt-out	So we do not contact you again by mistake
Dietary and accessibility information	Shortly after your programme ends	We no longer need it
Call recordings	3 months	Quality assurance and training

When we no longer need your data we delete it securely or anonymise it so you can no longer be identified.

12. How we protect your data

We use technical and organisational measures to keep your personal data safe. These include access controlled by a username and password unique to you, storage on secure servers, encryption of data in transit using TLS, access limited to staff who need it, written contracts with every supplier who handles your data, and staff training.

Where you have a password for our services, you are responsible for keeping it confidential. Please do not share it.

Transmitting information over the internet is never completely secure. We will do our best to protect your data, but we cannot guarantee the security of data sent to our website. Once we receive it, we apply strict procedures and security features to prevent unauthorised access.

We have procedures in place to deal with any suspected breach and will notify you and the Information Commissioner’s Office where the law requires us to.

13. Your rights

You have the following rights. To use any of them, email dataprotection@mtdtraining.com or use the other contact details in section 1. There is normally no charge.

Right	What it means
Access	Ask for a copy of the personal data we hold about you.
Rectification	Ask us to correct data that is inaccurate or incomplete.
Erasure	Ask us to delete your data where we no longer need it, where you withdraw consent and we have no other basis, or where we have processed it unlawfully.
Restriction	Ask us to pause our use of your data, for example while we check its accuracy or consider an objection.
Portability	Ask us to give you, or another organisation, the data you provided to us in a commonly used machine-readable format. This applies where we process it by automated means on the basis of consent or a contract.
Objection	Object to processing based on legitimate interests. You can object to direct marketing at any time and we will always stop.
Withdraw consent	Where we rely on your consent, withdraw it at any time. This does not affect anything we did before you withdrew it.
Automated decisions	Ask for human involvement in, and contest, any decision made about you by automated means alone that has a legal or similarly significant effect.
Complain	Complain to us, and to the Information Commissioner’s Office. See section 14.

13.1 How long we take

We will respond within one calendar month. If your request is complex, or if you have made several requests, we may extend this by up to two further months — we will tell you within the first month if we need to, and why.

If we genuinely need more information from you to find what you are asking for, we may ask you to clarify your request. The one-month period pauses until you reply. We will only do this where we really need the clarification, and we will explain why.

There are exceptions to these rights. We may not be able to give you everything if doing so would reveal personal data about someone else, if the law prevents us, or if a request is clearly unfounded or excessive. If we cannot meet your request in full we will explain why and tell you how to complain.

14. How to complain to us

If you are unhappy with how we have handled your personal data, please tell us. You do not need to be a client or a delegate to complain, and you do not need to use any particular form of words.

Stage	What happens
Contact us	Email dataprotection@mtdtraining.com, or write or telephone using the details in section 1. Please tell us what happened and what you would like us to do.
Acknowledgement	We will acknowledge your complaint within 30 days, and aim to do so within 5 working days.
Investigation	We will look into it without undue delay and keep you updated on progress.
Outcome	We will explain what we found, what we have done or will do, and what you can do if you are still unhappy.

14.1 Complaining to the Information Commissioner

You can also complain to the Information Commissioner’s Office, the UK regulator for data protection. The ICO would normally expect you to raise your concern with us first and give us a chance to put it right.

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Helpline 0303 123 1113. Website ico.org.uk/concerns.

You also have the right to seek a remedy through the courts.

15. Keeping your own information safe

For independent guidance on protecting yourself online against fraud, identity theft and other risks, visit www.getsafeonline.org, which is supported by HM Government and leading businesses.

16. Changes to this notice

We may update this notice from time to time. The version and date at the top tell you when it was last changed. Where a change materially affects how we use your data, we will tell you directly.

Version 1, September 2026. Replaces the privacy content of GDPR Policy v4. Next review: September 2027.