Privacy policy
and cookie notice

The contact form

When you send a message through the form, we receive exactly what you typed into it: your name, your email address, optionally a company name, the topic you picked, and the message itself. Nothing else — we don’t enrich your inquiry with data from anywhere else.

We use it to answer your question and work out whether and how we can help. The legal grounds are Article 6(1)(b) UK GDPR — steps taken at your request before entering into a contract — and Article 6(1)(f), our legitimate interest in corresponding with people who get in touch.

Giving us your details is voluntary, though without an email address we have no way to reply. There is no profiling and no automated decision-making here: a person reads what you send.

We send one automatic acknowledgement to that address confirming your message arrived. It does not quote your enquiry back to you, and we use the address for nothing else — it goes on no mailing list.

Technical data and form protection

The form is shielded from bots in four ways: a hidden trap field, a check on how quickly it was filled in, a cap on submissions from one IP address, and a computational puzzle your browser works out in the background before you send the message. That means we also process technical data when you submit — your IP address and basic request headers.

The puzzle is solved entirely on your device and checked on our own server. No third party takes part in it, we load no outside scripts for it, and we collect no behavioural data along the way — no mouse movement, no typing patterns, nothing of that kind.

The IP address does one job: counting submissions from a single source inside a ten-minute window. We store the address nowhere — not in our application logs, and never in the message that reaches us. The counter holds only a cryptographic digest of it, computed with a secret key known to our application alone. That digest lets us recognise repeat submissions from one source, but it is not an address: getting back to the address requires the key. We still treat it as personal data and describe it here on the same footing as everything else. The legal ground is Article 6(1)(f) UK GDPR — keeping the service secure.

Separately from that, our hosting provider (Microsoft) keeps its own server logs, on the terms set out in its documentation.

Training certificates

Anyone who completes one of our courses receives a named certificate. At that point the register records: full name, course code and title, training date, date of issue, delivery mode and location (there is no location for online courses), language of instruction, certificate number and verification code. It holds no email address, no score, no grade and no note about how the session went. The details come from the attendance list — from you, or from whoever commissioned the training, usually an employer.

The register exists so that the certificate can be checked: a recruiter or an employer you show it to can confirm the document is genuine. A certificate nobody is able to verify means very little. The legal grounds are Article 6(1)(b) UK GDPR — performance of the training agreement — and Article 6(1)(f), a legitimate interest we share with you: issuing a document that can be confirmed, and making it harder to forge.

The verification page answers one thing only: a specific code taken from a certificate. You cannot ask it about a name, there is no participant list and nothing to browse, and verification results are kept out of search engines. The code is random and long enough that guessing it is not on the table. But anyone you show the certificate to, or send the bare code to, will see the name, the course and the date — that is what the document is for.

The register lives in Azure Table Storage (Microsoft, European region). We don’t publish it, we don’t keep it in the website’s code repository, and we use it for nothing but verification — no mailing list comes out of it.

We email the finished certificate to you, together with the student workbook, in a single message. The email address comes from the attendance list and never reaches the certificate register: the register has no such field. The message is sent from training@qshmobile.com, and replies go to info@qshmobile.com.

Our mail runs on Microsoft 365 (Exchange Online) — the same provider the rest of our infrastructure sits on. The message body and both attachments pass through it, and Microsoft records technical delivery traces: when the message left, which server it reached and with what result. We do not check whether or when you opened the message, or whether you clicked a link — we switch no such tracking on and put nothing in the message that would make it possible.

After the course we send a separate message with a link to a survey run by Microsoft (MetricsThatMatter). The link is shared by the whole group — we pass none of your details to it and we do not know who filled it in. If you open it, everything from there on is handled by Microsoft, on Microsoft’s terms.

Taking the survey is optional, and you get your certificate whether you fill it in or not. We have no way of telling either way.

You can ask us to delete your entry and we will. We’ll say plainly what follows: from that moment your certificate no longer verifies, and anyone checking it is told the document isn’t in the register. Nobody takes the PDF away from you — it simply loses the ability to be confirmed.

How long we keep it

We keep data for as long as it is doing something useful:

• Correspondence from the form — up to 24 months after our last exchange, unless you ask us to delete it sooner.
• Contract paperwork, if we end up working together — for as long as UK company and tax law requires, which is generally 6 years from the end of the accounting period.
• The certificate register — indefinitely, until you ask us to remove the entry. A certificate carries no expiry date, so an entry that quietly expired on its own would invalidate a document sitting in somebody’s file.
• Attendance lists and the certificate emails — up to 24 months after the course ends. The list itself is a working file kept off the site and out of the register; it never goes into the code repository.
• The form submission counter — the digest expires after 10 minutes and stops counting towards the cap from that moment. We delete the entry itself alongside later submissions, so with no traffic at all it can sit in storage until someone uses the form again.

Who processes it with us

We don’t sell data and we don’t share it for marketing. We do rely on providers who process it on our behalf:

• Microsoft — hosting for this site (Azure Static Web Apps), delivery of the notification email (Azure Communication Services), storage for the submission counter and the certificate register (Azure Storage), the mailbox the certificates are sent from (Microsoft 365 — Exchange Online), and the post-course survey (MetricsThatMatter).
• Google — the typefaces are loaded from Google Fonts, so your IP address reaches Google’s servers when the page loads.
• Our email provider, which hosts the mailbox your inquiry lands in.

Transfers abroad

Our infrastructure runs in European regions, but several of the providers listed above are US companies, so data may be processed outside the United Kingdom and outside the European Economic Area.

Where that happens, it rests on UK adequacy regulations — including the UK Extension to the EU–U.S. Data Privacy Framework — or on standard contractual clauses with the UK addendum, that is an International Data Transfer Agreement or the UK Addendum.

Your rights

You have the right to access your data, to have it corrected or erased, to restrict how we process it, to receive it in a portable format, and to object to processing that rests on our legitimate interest.

To exercise any of these, write to the address above. We respond without undue delay, and within a month at the latest.

If you think we’re handling your data unlawfully, you can complain to our supervisory authority, the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. If you live in the European Union, you may go to the supervisory authority in your own country instead.

Cookies and browser storage

This site sets no cookies of its own, collects no visitor analytics, and runs no advertising trackers. That’s why there is no consent banner here: there is nothing to consent to.

We do save three things in your browser’s local storage, and only once you’ve asked us to:

• qsh-theme — whether you prefer the light or the dark version of the site.
• qsh-lang — which language you picked in the footer.
• qsh-notice — that you’ve closed the cookie notice, so it stays closed.

A little more detail

All three values stay in your browser. They never reach our server and they can’t identify you. Clearing site data in your browser settings removes them, as does opening the page in a private window.

The form protection adds nothing to that list. Its puzzle is solved in the memory of the open tab, and once you close it nothing of the sort remains in your browser — no cookie, no local storage entry.

UK electronic privacy rules (PECR) require consent before storing anything on your device, but they exempt whatever is strictly necessary to provide the service you asked for. Our three values sit inside that exemption, which is why you get a notice rather than a consent request.

If we ever add analytics or marketing tools, a consent request will appear here. As things stand, none is needed.

Changes to this policy

If the way we handle data changes — a new tool, a different provider — we’ll update this document and change the date at the top. Worth a glance before you send us another message.