Privacy & Cookie Policy

This website is operated by Green Horizon Strategies Ltd, a company registered in England and Wales, trading as Green Horizon. We provide business, compliance, HSEQ, site support, and training consultancy to businesses in the forestry, arboriculture, construction, highways, and defence sectors.

For the purposes of UK data protection law, Green Horizon Strategies Ltd is the data controller for the personal information described in this policy. That means we are responsible for deciding how your information is used and for keeping it safe.

We only collect what we need in order to respond to you and deliver the work you have asked for.

Information you give us directly

• •Your name, email address, and telephone number when you complete an enquiry form, email us, or call us
• •Your business name, sector, size, and a description of the support you are looking for
• •Information about your business operations that you share with us during a review, consultation, or project: for example existing policies, risk assessments, RAMS, training records, and contracts
• •Training and assessment records where we deliver training, including candidate names, course details, results, and certification data
• •Booking and billing details needed to raise an invoice and keep proper accounting records

Information collected automatically

This website is a static site served through a content delivery network. Our hosting provider keeps standard technical server logs, which may include IP addresses, browser type, the pages requested, and the date and time of the request. These logs are used to keep the site available and secure, and to diagnose faults. We do not use them to build profiles of individual visitors.

Special category data

We do not ask for special category data such as health information as a routine part of our service. If you choose to tell us about an access requirement, a health condition, or a reasonable adjustment you need, we will use that information only to adjust how we work with you, and we will not share it without your agreement.

• •To respond to your enquiry and answer your questions
• •To prepare quotations, proposals, and scopes of work
• •To deliver the services, reviews, documents, and training you have engaged us for
• •To administer bookings, invoices, payments, and our own accounting obligations
• •To keep records we are required to keep, including training and assessment records
• •To provide ongoing support under a Service Level Agreement, including quarterly reviews
• •To send you service updates relating to work we are doing for you
• •To improve how we deliver our services and keep this website working properly

We do not sell your personal information to anyone, and we do not share it with third parties for their own marketing purposes.

Marketing

If we send you marketing emails about our services, it will be because you asked us to or because you are an existing client and the content is relevant to the work we do for you. You can tell us to stop at any time, either by using the unsubscribe option in the email or by emailing us directly. We will action it promptly and it will not affect any work we are doing for you.

Under UK GDPR we must have a lawful basis for using your personal information. We rely on the following.

• •Contract: where we need your information to agree, quote for, or deliver work for you
• •Legitimate interests: to respond to enquiries, run our business properly, keep sensible records, and protect our own legal position. We balance this against your rights and only rely on it where we reasonably expect you would not object
• •Legal obligation: where we are required to keep records, for example accounting records, training and assessment records, and health and safety documentation
• •Consent: for optional marketing communications, and for anything where we have specifically asked for your agreement. Where we rely on consent you can withdraw it at any time

We work with a small number of trusted suppliers who process information on our behalf. They are only permitted to use it to provide their service to us, and they are bound by their own data protection obligations.

• •Our website hosting and content delivery provider, which serves this website and keeps technical server logs
• •Our enquiry handling and business support platform, which receives the details you submit through forms on this website and passes them to our business inbox
• •Microsoft 365, which we use for email, documents, and secure client file storage through SharePoint
• •Google (Google Analytics), which provides website analytics, but only if you accept analytics cookies. See section 10 for details
• •Payhip, which processes payments where you buy a document pack or book a paid review. Payment details are entered on Payhip's own checkout and are not handled or stored by us
• •Xero, our accounting software, for invoicing and financial records
• •Awarding and certification bodies, where you have booked training that leads to a formal qualification or certificate and your details must be registered with them
• •Associates and subject matter experts working under our instruction, where their input is needed to deliver your work. They are bound by confidentiality
• •Professional advisers, insurers, regulators, or law enforcement, where we are legally required to disclose information or need to protect our legal rights

We aim to keep personal information within the UK or European Economic Area wherever possible. Some of our suppliers operate globally and may process information outside the UK. Where that happens, we expect appropriate safeguards to be in place, such as an adequacy decision covering the destination country or standard contractual clauses approved for use in the UK.

Client project files and documents are held in a dedicated, access controlled area of our Microsoft 365 SharePoint environment.

We keep information only as long as we have a reason to, then we delete or securely destroy it.

• •Enquiries that do not become work: normally up to 12 months, in case you come back to us
• •Client records, contracts, and project files: for the duration of our relationship and then normally 6 years, which reflects standard limitation periods and lets us answer questions about work we have done
• •Accounting and tax records: at least 6 years, as required by HMRC
• •Training and assessment records: for the period required by the relevant awarding body or applicable health and safety requirements, which can be longer than 6 years
• •Marketing contact details: until you ask us to stop, after which we keep a minimal suppression record so we do not contact you again by mistake

We take practical, proportionate steps to protect your information. That includes access controlled storage, multi factor authentication on our business accounts, keeping client files in a structured and permissioned environment rather than loose on devices, and limiting access to the people who genuinely need it.

No system is completely secure, and we cannot guarantee the security of information sent to us over the internet. If you need to send us something particularly sensitive, contact us first and we will agree a secure way to do it. If a personal data breach occurs that is likely to present a risk to you, we will notify the Information Commissioner's Office and, where required, you.

Under UK data protection law you have the following rights over your personal information.

• •To be informed about how your information is used, which is what this policy is for
• •To access a copy of the personal information we hold about you
• •To have inaccurate or incomplete information corrected
• •To ask us to delete your information, where we have no continuing lawful reason to keep it
• •To ask us to restrict how we use your information while a query is resolved
• •To object to us using your information where we rely on legitimate interests, and to object to direct marketing at any time
• •To ask us to transfer your information to you or another provider in a portable format, where that right applies
• •To withdraw consent at any time, where we relied on consent

To exercise any of these, email [email protected]. We will respond within one month. If your request is complex we may need longer, and we will tell you if that is the case. We may need to confirm your identity before we act, to make sure we are not disclosing your information to someone else. There is normally no charge.

A cookie is a small text file stored on your device by a website. Some are needed for a site to work, and others are used to track behaviour across sites.

Strictly necessary

Our hosting provider may use strictly necessary technical measures to deliver the site securely and reliably. These are exempt from consent requirements because the site cannot function without them. We also store your cookie choice in your browser's local storage (under the name gh_cookie_consent) so that we can remember it. This is not used for tracking.

Analytics (only with your consent)

If you click Accept, we load Google Analytics (measurement ID G-3VG7TMX9ZN), a service provided by Google. It sets cookies on your device and sends information about your visit to Google, such as the pages you view, how you arrived, and technical details about your browser and device. We use this to see which pages are useful and to improve the site. Google acts as a processor for this analytics data and may process it outside the UK; see Google's own privacy information for details. Our lawful basis is your consent.

Changing your choice

You can accept, reject, or change your preference at any time using the Cookie preferences link in the footer of every page. Rejecting analytics stops Google Analytics collecting data straight away, including on the page you are viewing, and we then remove the Google Analytics cookies we can access for this site. If any remain, you can delete them through your browser settings.

Apart from Google Analytics (with your consent), this site does not use advertising pixels, social media tracking tags, or similar technologies.

Third party pages you may be sent to

If you click through to buy a document pack or book a paid review, you will be taken to Payhip, which operates its own checkout and sets its own cookies. If you click one of our social media icons, you will be taken to LinkedIn or Facebook, which set their own cookies. Those cookies are controlled by those companies and are governed by their own policies, not this one. We do not embed their tracking code on our pages.

Managing cookies yourself

You can block or delete cookies through your browser settings at any time, and you can set your browser to tell you when a cookie is being set. Blocking cookies may affect how other websites work, though it will not stop this site working.

This website contains links to other websites, including Payhip, LinkedIn, Facebook, awarding bodies, and official guidance from bodies such as the Health and Safety Executive. We are not responsible for the content or privacy practices of those websites. If you follow a link away from here, we would encourage you to read the privacy policy of the site you land on.

Our services are aimed at businesses, and this website is not directed at children. We do not knowingly collect personal information from anyone under 16. Where we deliver training to a learner under 18, we will agree the arrangements, including consent, with their employer, parent, or guardian as appropriate.

We review this policy periodically and will update it when our services, suppliers, or legal obligations change. The date at the top of the page shows when it was last updated. If we make a significant change that affects how we use information we already hold about you, we will take reasonable steps to tell you directly.

If you are unhappy with how we have handled your personal information, please tell us first. We would much rather hear about it and put it right. Email [email protected] or call 01392 703113.

You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection.