New courseISO 14001:2026 Internal Auditor Training
ISO 9001:2026 Key Changes Awareness Training
Understanding and Managing Health & Safety Legal Compliance
Understanding and Managing Environmental Legal Compliance
ISO 14001:2026 Key Changes Awareness Training
Waste Duty of Care
Environmental Aspects Training for ISO 14001:2026Last updated: 05/10/2026
The Compliance People is a trading name of Newground CIC, a community interest company registered in England and Wales under company number 02584952. Our registered office is Prospect House, Wharf Street, Blackburn, Lancashire, BB1 1JD. We are registered with the Information Commissioner’s Office (ICO) under registration number ZA103366.
We are the controller of the personal information described in this policy, which means we decide how and why it is used.
If you have any questions about this policy or how we handle your information, contact us at:
This policy explains how we collect, use and share personal information when you visit thecompliancepeople.co.uk or the LUS KnowHow help centre, use our Legislation Update Service (LUS), buy our consultancy or training services, attend our events or webinars, or get in touch with us. The LUS application itself has its own privacy policy, which you can read when you log in.
It does not cover information about our own staff or job applicants, who receive separate privacy information. Where our consultants handle personal information belonging to a client’s own employees in the course of consultancy work, we do so on the client’s instructions and under the client’s own privacy notice.
Depending on how you deal with us, we may collect:
We only ask for information we need to provide our services. Some information is needed to enter into a contract with you, such as your contact and billing details; without it we may not be able to provide the service you have asked for.
Most of the information we hold comes directly from you, for example when you fill in a form on our website, sign up for a free trial, book a course, or speak to us.
We also receive information from:
UK data protection law requires us to have a lawful basis for each way we use your information. The table below sets out what we do and the basis we rely on. Where we rely on legitimate interests, we have considered whether our interests are outweighed by your rights, and we describe the interest in the table.
| What we use your information for | Information used | Lawful basis |
|---|---|---|
| Setting you up as a client or LUS user, including free trials, and managing your account | Contact details, account details | Performance of a contract with you, or with your employer where they have taken out the service for you (our legitimate interest in delivering the service your employer has bought) |
| Providing our services: LUS updates, consultancy, training and CPD certificates | Contact details, account details, training records | Performance of a contract |
| Invoicing, taking payment and recovering money owed to us | Contact details, transaction and financial details | Performance of a contract; our legitimate interest in recovering debts; our legal obligation to keep accounting records |
| Responding to your enquiries and correspondence | Contact details, enquiries and correspondence | Our legitimate interest in responding to people who contact us; performance of a contract where you are already a client |
| Managing our relationship with you, including telling you about changes to our terms or this policy, and asking for feedback or reviews | Contact details, marketing preferences, survey responses | Performance of a contract; our legal obligations; our legitimate interest in understanding how our services are used and improving them |
| Sending you our newsletter and information about our services (see “Marketing” below) | Contact details, marketing preferences | Consent, where you have subscribed; otherwise our legitimate interest in telling existing clients about similar services, with an opt-out every time |
| Running, securing and improving our website and systems, including troubleshooting, testing, backups and fraud prevention | Contact details, technical and usage information | Our legitimate interest in running our business securely; our legal obligations |
| Understanding how visitors use our website, using analytics tools and session recordings | Technical and usage information | Consent, given through our cookie banner |
| Showing you relevant advertising on other platforms, such as Google and LinkedIn, and measuring whether our advertising works | Technical and usage information | Consent, given through our cookie banner |
| Making adjustments to meet accessibility or support needs you have told us about | Accessibility and support needs | Our legitimate interest in making our services accessible; explicit consent if you give us any health information |
| Dealing with legal claims, regulatory requests and our own audits, including certification audits for our ISO management systems | Any of the above, as relevant | Our legal obligations; our legitimate interest in defending claims and maintaining our certifications |
| In the event of a business reorganisation, restructuring or transfer | Any of the above, as relevant | Our legitimate interest in running and developing our business |
We do not make decisions about you based solely on automated processing that would have a legal or similarly significant effect on you.
If you are a client, or you have asked about our services, we may email you about similar services we think will interest you. We do this on the basis of our legitimate interests. You can opt out when we first collect your details and in every email we send.
If you have subscribed to our newsletter or downloaded a free resource, we email you because you have asked us to. You can withdraw that consent at any time.
To stop marketing emails, use the unsubscribe link in any email or contact us using the details above. We will keep a minimal record of your email address on a suppression list so that we do not contact you again by mistake.
Opting out of marketing does not stop us sending you service messages, such as LUS updates, invoices or notices about your account.
We use a customer relationship management system that records which of our emails you open and which links you click, and uses that to help us judge what you are interested in. You can object to this at any time (see “Your rights”).
Our website uses cookies and similar technologies. Some are essential to make the site work. Others, for analytics and advertising, are only set if you consent to them through our cookie banner. You can change your choices at any time using the “Revisit consent” button on our site.
Our website does not currently respond to “Do Not Track” browser signals, as there is no agreed industry standard for how to interpret them. We rely on the consent you give through our cookie banner instead.
For full details of the cookies we use and how long they last, see our Cookie Policy.
Access to your information within Newground CIC is limited to the staff who need it to do their jobs. We share information with other organisations only where we need to, as set out below.
Service providers who process information on our behalf. These organisations act on our instructions under written contracts and may not use your information for their own purposes. They include:
Where you have consented to advertising cookies, Google and LinkedIn also use information about your visit for their own purposes, including to show you our adverts on other sites and to measure their advertising. Their use of that information is governed by their own privacy policies.
Professional advisers and auditors, including our accountants, solicitors, insurers and the certification bodies that audit our ISO 9001, ISO 14001 and ISO 45001 management systems.
Together Housing Group, which provides our finance function. Its finance team processes our invoices, payments and accounting records, and sees contact and billing details for that purpose only.
Public authorities, regulators and courts, where we are required to do so by law, for example HM Revenue & Customs, the ICO, or in connection with legal proceedings.
A buyer or successor, if our business or part of it is sold, merged or reorganised, in which case they will be bound by this policy.
We do not sell your personal information.
We store your information in the United Kingdom and the European Economic Area.
Some of the service providers listed above are based in, or process information in, the United States. Where that happens, the transfer is protected by one of the safeguards recognised under UK law:
You can ask us for more information about these safeguards using the contact details above.
We keep your information only for as long as we need it for the purposes above, including to meet legal, accounting and reporting requirements. The periods we apply are:
| Information | How long we keep it |
|---|---|
| Contracts, invoices and accounting records | 6 years from the end of the financial year they relate to, as required by company and tax law |
| LUS user accounts | For as long as the account is active, then removed within 12 months of the account closing |
| Consultancy and training records, including CPD certificates issued | 6 years from the end of the engagement or the course date |
| Enquiries and prospective client details where no relationship follows | 24 months from our last meaningful contact with you |
| Newsletter and marketing subscriptions | Until you unsubscribe, after which we keep your email address on a suppression list only |
| Accessibility and support needs | For the duration of our relationship with you, then deleted |
| Website analytics and session recordings | 14 months for website analytics and 12 months for session recordings, as set in those tools |
| Cookie consent records | 5 years, as evidence of the choices you made |
When information is no longer needed we delete it securely or anonymise it. Where information is held in backups, it is removed when those backups expire.
We use technical and organisational measures appropriate to the risk, including access controls, encryption of data in transit, secure hosting and staff training. We operate certified ISO 9001, ISO 14001 and ISO 45001 management systems. No system is completely secure, but we take reasonable steps to protect your information, and we would tell you and the ICO if a breach affected you in a way the law requires.
You have the following rights over your personal information. They do not apply in every situation, and we will explain if we cannot comply with a request.
How to make a request. You can make a request verbally or in writing using the contact details above. We may ask you to confirm your identity before we act. If someone is making a request on your behalf, we will need evidence that they are authorised to act for you.
We will respond without undue delay and within one month of receiving your request. If your request is complex, or you have made several requests, we may extend this by up to two further months; we will tell you within the first month if so and explain why. If we need to confirm your identity or ask you to clarify your request, the time limit runs from when we receive your reply. We do not normally charge a fee. Where we have shared information with others, we will tell them about any correction or deletion unless that proves impossible or involves disproportionate effort.
If you are unhappy with how we have handled your personal information, please tell us first using the contact details above. We will acknowledge your complaint within 30 days, look into it, and let you know the outcome.
You also have the right to complain to the Information Commissioner’s Office, the UK’s data protection regulator:
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
0303 123 1113
ico.org.uk/make-a-complaint
Some of our clients are in the Republic of Ireland and elsewhere in the EU. For them, the EU General Data Protection Regulation also applies, and we have appointed a representative in the EU under Article 27 of that Regulation:
EU Rep (BizLegal Ltd trading as EU Rep), 27 Cork Road, Midleton, Co. Cork, Ireland. Company number 635921.
EU data subjects and data protection authorities can contact our representative through the form at eurep.ie.
We review this policy regularly and will update it when our practices or the law change. We will post the updated version on this page with a new “last updated” date, and where a change significantly affects you we will draw it to your attention, for example by email or a notice on the site.
