Privacy policy

Last updated 6 October 2026

This policy explains what personal information we collect when you use this website or book the IOSH Approved Setting to Work Safely course, why we collect it, and your rights.

1. Who we are

Organic OSH Ltd, a company registered in England and Wales (company number 16275821), registered office 49 Rampside, Barrow-in-Furness, LA13 0PY. We are the controller of the personal information described here. You can contact us about it at antwy26@live.co.uk.

2. What we collect

When you book: your name and email address, and the payment details our payment provider, Stripe, needs to take payment. We do not see or store your full card number.
When you take the course: the learner's name and email address, their progress through the course, and their assessment results, held on our learning platform, Reach 360.
When you contact us: whatever you choose to send us, such as your name, email, phone number and the details of a team booking.
When you visit the website: our hosting provider keeps standard server logs (such as IP address, browser type and the time of the visit) to keep the site running and secure.

This website does not use analytics, advertising or tracking cookies, and it does not set cookies of its own. Stripe sets its own cookies on its checkout page to process payment securely and prevent fraud.

3. Why we use it

To provide the course you have paid for: taking payment, sending the invitation, giving access, recording assessment results. This is necessary for our contract with you.
To meet our legal obligations: for example, keeping payment and accounting records for HMRC.
To answer your enquiries and keep the website secure: these are our legitimate interests.

We do not sell your information, and we will not send you marketing unless you have agreed to it.

4. Who we share it with

Only the providers we need to run the course, each of which handles your information on our behalf and under contract:

Stripe: takes payment.
Zapier: passes the email address from your payment to our learning platform, so your invitation is sent automatically.
Articulate (Reach 360): our learning platform, which holds learner accounts, progress and results.
20i: hosts this website.
Pattern Systems Ltd: builds and maintains this website and its booking setup.

We may also share information where the law requires it.

5. Information sent outside the UK

Some of these providers are based in, or store information in, the United States or the European Economic Area. Where information leaves the UK, it is protected by the safeguards UK law requires, such as the UK-US data bridge or approved contract terms.

6. How long we keep it

Payment and accounting records: six years, as the law requires.
Learner records and assessment results: for as long as the learner has access to the course, and afterwards for as long as we need them to confirm a completion.
Enquiries: for as long as we need them to deal with your enquiry.

7. Your rights

You have the right to ask for a copy of your information, to have it corrected or deleted, to restrict or object to how we use it, and to have it passed to you or someone else in a usable format. To use any of these rights, email us at antwy26@live.co.uk.

If you are unhappy with how we have handled your information, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to sort it out first.

8. Changes to this policy

If we change this policy, we will update the date at the top of this page.