Privacy Policy

Who we are

Food Hygiene Hub runs this website and is the controller of your personal data. That means we decide how and why it is used.

• Email: support@foodhygienehub.co.uk

You can contact us about your data through our contact page or by email at support@foodhygienehub.co.uk.

This policy follows the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025. Our service is not meant for children under 16.

The data we collect

We only collect what we need to run the service:

• Order details: your full name, your email address, what you bought, the amount, your order reference, and when you accepted our terms and asked for immediate supply.
• Payment details: Stripe takes your payment. We receive the payment status and reference. We never see your full card number.
• Assessment results: the questions you were given, your answers, your score, whether you passed, and the date.
• Certificate data: your name and email address, the course, your score, the issue date, the certificate code and its status.
• Review text: your display name, your rating, what you wrote, the date and, if you choose to give it, your UK nation.
• Contact messages: your name, email address, the topic and your message.
• Security and IP logs: your IP address, browser details, the page you asked for and the time.

Progress and saved details kept in your own browser are explained in our Cookie Policy.

We do not ask for health details or other sensitive information. Please leave them out of reviews and messages.

Why we use it and our lawful bases

UK law says we need a lawful basis for each use of your data. Ours are:

• Contract: to mark your assessment, process your order, issue your certificate, send it to you and resend it when you ask.
• Legal obligation: to keep order and tax records, and to handle cancellations, refunds and consumer complaints as the law requires.
• Legitimate interests: to let people check a certificate, because verification is what makes a certificate useful and helps to prevent fraud.
• Legitimate interests: to publish reviews you send us, because honest feedback helps other customers.
• Legitimate interests: to answer your messages. Where a message is about your order, this is also part of our contract with you.
• Legitimate interests: to keep the site secure, limit abuse and detect fraud.

Where we rely on legitimate interests, you can object at any time. We do not sell your personal data, and we do not use it for advertising or marketing emails. The emails we send are about your order, your certificates or your message.

Assessment attempts and automatic marking

An assessment attempt carries no identity. We store it against a random reference, not your name or email address. It is only linked to you if you buy a certificate for it, or sit it as part of a bundle you have paid for.

Assessments are marked automatically. A fail has no effect beyond letting you study and try again. If you think a result is wrong, contact us and a person will check it.

Who can see your certificate details

Anyone holding a certificate code can see the holder's name, the course, the issue date, whether the certificate is valid or revoked, and its suggested refresher date. That is how employers check a certificate, so the code works as a key: only share it with people you want to see those details.

We do not publish a list of certificates, and we ask search engines not to index verification results.

Reviews are public

If you leave a review, your display name, rating, review text and date are published on this website for anyone to read, along with your UK nation if you chose to give it. Use a first name or initials if you prefer. Our Review Policy explains how reviews work.

Who we share it with

We use these companies to run the service. Each one receives only what it needs:

• Cloudflare hosts the website, our database and certificate files, and provides security and rate limiting.
• Stripe takes payments. It acts for us as a processor, and as an independent controller for its own fraud prevention and legal duties. See Stripe's privacy policy.
• Resend delivers our emails, including your certificate.

We may also share data where the law requires it, for example with HMRC, the police or a court.

International transfers

These companies work internationally, so your data may be processed outside the UK, including in the European Economic Area and the United States. When it is, we make sure it stays protected in one of these ways:

• UK adequacy regulations, including the UK-US data bridge where the recipient has joined it
• The ICO's International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses

Contact us if you would like more detail on these safeguards.

How long we keep it

• Orders and certificates: 6 years. We must keep financial records, and this keeps your certificate checkable. After that a certificate can no longer be verified.
• Contact messages: 12 months.
• Assessment attempts: these carry no identity unless they are linked to an order, and then we keep them with that order. Attempts not linked to an order are deleted after 90 days, so a pass that was never paid for has to be taken again after that.
• Orders that were never paid: 30 days.
• Reviews: for as long as the review is published and we hold the certificate it belongs to.
• Security logs: a short period set by our hosting provider, then deleted automatically. Rate-limiting counters clear within minutes. A hashed network identifier kept with a test attempt, used to slow repeated failed attempts, is cleared after 2 days.

Your rights

You have the right to:

• Ask for a copy of your personal data
• Have inaccurate data corrected
• Have your data erased
• Restrict how we use your data
• Object to how we use your data
• Receive data you gave us in a portable format
• Ask for a person to review a decision made only by automated means, if it has a legal or similarly significant effect on you

To use any of these rights, contact us through our contact page or by email at support@foodhygienehub.co.uk. It is free, and we normally reply within one month. Some rights have limits. For example, we cannot erase order records that the law says we must keep.

Complaints

If you are unhappy with how we have used your data, you have the right to complain to us. Please do so through our contact page or by email at support@foodhygienehub.co.uk. We will acknowledge your complaint within 30 days, look into it, keep you updated and tell you the outcome without undue delay.

You also have the right to complain to the UK data protection regulator, the Information Commission, which is still known as the ICO. You can do this at ico.org.uk/make-a-complaint.

Changes to this policy

If we change this policy, we will update this page and the date at the top.