Privacy Notice

Last updated: 29/09/2026

Total Transport Compliance (TTC) respects your privacy and is committed to protecting your personal information.

This Privacy Notice explains how we collect, use, store and share personal information when you visit our website, contact us, book or attend training, use our consultancy or Continued Compliance Support services, communicate with us, or otherwise interact with TTC.

It also explains your data protection rights and how to contact us about the use of your personal information.

1. Who we are

Transport Compliance Consultants Ltd, trading as Total Transport Compliance (TTC), is a company registered in England and Wales under company number 16338424.

Our registered office and correspondence address is:

14 Spen Road
Leeds
LS16 5BT
United Kingdom

For the purposes of UK data protection law, TTC will normally be the controller of personal information we collect and use for our own business purposes, including managing enquiries, bookings, client relationships, training administration, accounts and marketing.

In some consultancy engagements, TTC may process personal information on behalf of a client. In those circumstances, the client may be the controller and TTC may act as its processor. Where required, those arrangements will be governed by an appropriate data processing agreement.

If you have any questions about this Privacy Notice, how we use your personal information or your data protection rights, please contact us:

Email: info@totaltransportcompliance.com
Post: Total Transport Compliance, 14 Spen Road, Leeds, LS16 5BT, United Kingdom

2. Personal information we collect

The personal information we collect depends on how you interact with TTC and the services involved. It may include:

2.1 Contact and identity information

Your name, job title, organisation, business address, email address, telephone number and other contact information you provide to us.

2.2 Enquiry and client information

Information you provide when making an enquiry, booking a consultation or discovery call, discussing your requirements, accepting a proposal or otherwise communicating with us. This may include information about your organisation, operator licence, role, compliance arrangements and the services you require.

2.3 Training and delegate information

Information required to book, administer and deliver training, such as delegate names, contact details, employer or organisation, course and booking information, attendance and participation records, completion information and certification or registration details.

Where necessary, we may also receive information about accessibility or reasonable-adjustment requirements.

Additional information may be required for particular accredited, consortium or Driver CPC-related training. Where this applies, we will explain the relevant requirements when the course is booked or administered.

2.4 Consultancy and regulatory information

When providing consultancy, audit, Continued Compliance Support or regulatory support, we may receive personal information contained within operational and compliance records.

Depending on the agreed service, this may include information relating to operators, directors, Transport Managers, drivers, employees or other relevant individuals, including:

contact and employment information;
driver and Transport Manager records;
training and qualification information;
tachograph, telematics, working-time or other operational records;
maintenance, defect, incident and compliance records;
correspondence with DVSA, the Office of the Traffic Commissioner or other relevant bodies;
information contained within audit evidence, investigations or regulatory proceedings; and
other information reasonably necessary to provide the agreed service.

Some engagements may involve more sensitive information, such as health information or information relating to allegations, offences or regulatory enforcement. We will only use this type of information where it is necessary for the relevant purpose and where we have an appropriate legal basis for doing so.

2.5 Payment and accounting information

We may collect information relating to payments, invoices, transactions, billing contacts and accounting records.

Payments for training booked through our website are processed using our website and payment providers. TTC does not need to receive or retain your complete payment-card details in order to administer your booking.

Consultancy and Continued Compliance Support are invoiced separately rather than purchased through the website.

2.6 Communications and call information

We keep relevant business correspondence and communications, including emails and records of telephone or online conversations.

We may record selected discovery, scoping or client calls where this helps us maintain an accurate record of the discussion and prepare appropriate notes, proposals or follow-up work. We will tell you before a call is recorded. If you do not want the call recorded, you can tell us and we will use another method of taking appropriate notes.

2.7 Marketing information

We may hold information about whether you have asked to receive, or opted out of receiving, TTC newsletters, compliance updates and other marketing communications.

Where appropriate, we may also use publicly available business contact information for proportionate business-to-business marketing. If we obtain personal information from a public source, we will handle it in accordance with applicable data protection and direct-marketing requirements.

2.8 Website and technical information

When you use our website, information may be collected about your device and use of the site, such as your IP address, browser or device information and interactions with the website.

Some of this information is collected through cookies and similar technologies. Further information is provided in our Cookie Policy.

2.9 Information we receive from other sources

We normally obtain personal information directly from you, but we may also receive it from other sources where relevant to our work. These may include:

your employer or another person within your organisation;
clients who provide records relating to their personnel or operations;
delegates or booking contacts;
DVSA, the Office of the Traffic Commissioner or other regulatory bodies;
legal or other professional advisers;
training consortiums or administration providers;
publicly available registers, websites and business sources; and
service providers used to support our business.

Where data protection law requires us to provide privacy information directly to an individual whose information we have obtained from another source, we will do so unless an applicable exception applies.

3. How and why we use personal information

We only use personal information where we have a lawful basis for doing so. The lawful basis depends on the purpose for which the information is being used and our relationship with the individual.

The main ways in which TTC uses personal information are set out below.

How we use personal information: To respond to enquiries, arrange discovery or consultation calls, understand your requirements, assess whether TTC can assist and prepare proposals or quotations.

Main lawful basis: Taking steps at your request before entering into a contract, where you are the prospective client; otherwise our legitimate interests in responding to business enquiries and developing our services.

Providing training

How we use personal information: To process bookings, communicate with booking contacts and delegates, administer and deliver courses, record attendance and completion, provide joining information and manage transfers, cancellations and refunds.

Main lawful basis: Performance of a contract where the individual is our customer; otherwise our legitimate interests in administering and delivering the training purchased by the relevant organisation.

Training administration and certification

How we use personal information: To maintain appropriate training records and, where applicable, provide required information to a training consortium, certification, Driver CPC or other relevant administration provider.

Main lawful basis: Performance of a contract, legitimate interests in properly administering the training, and legal obligation where applicable.

Providing consultancy and Continued Compliance Support

How we use personal information: To understand the client's operations, review evidence, perform agreed audits or consultancy, provide advice and deliverables, support compliance improvements and administer the engagement.

Main lawful basis: Performance of a contract where the individual is the client; otherwise our legitimate interests in providing the contracted services to our client and maintaining appropriate professional records.

Regulatory and professional support

How we use personal information: To review regulatory correspondence and evidence, prepare factual material, communicate with authorised parties and support agreed DVSA, Office of the Traffic Commissioner, Public Inquiry, Preliminary Hearing or other regulatory work.

Main lawful basis: Performance of a contract, legitimate interests in providing the agreed professional service, and legal obligation where applicable.

Client and business administration

How we use personal information: To manage client relationships, correspondence, appointments, records, service quality, internal administration and follow-up actions.

Main lawful basis: Performance of a contract and our legitimate interests in operating and administering TTC effectively.

Payments, invoicing and accounts

How we use personal information: To process payments, issue and manage invoices, maintain accounting and transaction records and manage amounts due to or from TTC.

Main lawful basis: Performance of a contract and compliance with our legal obligations relating to accounting, taxation and financial records.

Recorded calls

How we use personal information: Where we tell you that a call will be recorded, to create an accurate record of selected discovery, scoping or client discussions, allow us to concentrate on the conversation, prepare accurate notes and proposals, and support appropriate follow-up.

Main lawful basis: Our legitimate interests in maintaining accurate professional records and providing an effective service. We will consider the nature of the call and the information likely to be discussed before recording.

Complaints, disputes and legal matters

How we use personal information: To investigate and respond to complaints, establish what happened, manage disputes, protect or exercise legal rights and cooperate with legal or regulatory requirements.

Main lawful basis: Performance of a contract, legal obligation and our legitimate interests in resolving disputes and establishing, exercising or defending legal rights, as applicable.

Security and prevention of misuse

How we use personal information: To protect our systems, accounts, website, information and business from unauthorised access, misuse, fraud and other security threats.

Main lawful basis: Our legitimate interests in protecting TTC, our clients and our systems, and legal obligation where applicable.

Newsletter and marketing where you have opted in

How we use personal information: To send TTC newsletters, compliance updates and information about relevant services where you have chosen to receive them.

Main lawful basis: Consent. You can withdraw your consent at any time.

Other permitted business-to-business marketing

How we use personal information: Where permitted by applicable law, to contact relevant business prospects using appropriate business contact information about TTC services that we reasonably believe may be relevant to their organisation.

Main lawful basis: Our legitimate interests in promoting and developing TTC, where those interests are not overridden by the individual's rights and where applicable direct-marketing rules permit the communication.

Marketing preferences and suppression records

How we use personal information: To record subscriptions, withdrawals, objections and do-not-contact preferences so that we respect your choices and do not send marketing where you have asked us not to.

Main lawful basis: Legal obligation and our legitimate interests in demonstrating compliance and respecting marketing preferences.

Website operation and improvement

How we use personal information: To operate, secure and understand use of our website and improve its functionality and performance. Where cookies or similar technologies require consent, we will ask for it through our cookie controls.

Main lawful basis: Legitimate interests for appropriate essential or security-related processing; consent where required for non-essential cookies or similar technologies.

3.1 Our legitimate interests

Where we rely on legitimate interests, those interests may include:

providing and administering professional services requested by our clients;
communicating effectively with clients, delegates and business contacts;
maintaining accurate and appropriate professional records;
improving and developing our services;
protecting TTC, our clients, our systems and information;
managing complaints, disputes and legal or regulatory matters; and
promoting TTC to relevant business audiences where permitted by law.

Before relying on legitimate interests where appropriate, we consider whether the processing is necessary and whether our interests are outweighed by the rights, freedoms or reasonable expectations of the individuals concerned.

You have the right to object to processing based on legitimate interests in certain circumstances. Your right to object to the use of your personal information for direct marketing is absolute. Further information about your rights is provided later in this Privacy Notice.

3.2 Consent

Where we rely on your consent, you can withdraw that consent at any time. Withdrawing consent will not affect the lawfulness of processing that took place before you withdrew it.

You can unsubscribe from TTC marketing emails using the unsubscribe option provided in the communication or by contacting us at info@totaltransportcompliance.com.

3.3 Special category and criminal offence information

Some consultancy, regulatory or training activities may involve more sensitive personal information, including health information or information relating to criminal allegations, offences or proceedings.

Where TTC acts as a controller and uses special category personal information, we will identify both an appropriate lawful basis and an additional condition required by data protection law.

Where we process criminal offence information as a controller, we will only do so where we have an appropriate lawful basis and the additional legal authority or condition required by data protection law.

Where TTC processes this information solely on behalf of a client as its processor, the relevant client remains responsible for identifying the applicable lawful basis and any additional condition required for its processing, and our processing will be governed by the relevant data processing arrangements.

4. Who we share personal information with

We only share personal information where this is reasonably necessary for the purposes described in this Privacy Notice, where you have asked or authorised us to do so, or where disclosure is required or permitted by law.

Depending on your relationship with TTC and the service involved, we may share personal information with the following categories of recipient.

4.1 Technology and service providers

We use trusted third-party providers to support the operation of TTC. These may include providers of:

website hosting, online forms and booking systems;
payment processing;
email, cloud storage and document management;
online meetings, calendars and communications;
accounting and bookkeeping systems;
IT, security and technical support; and
other business administration services.

These providers may process personal information on our behalf or, in some circumstances, act as separate controllers for particular processing activities.

Our current systems include Wix for our website, online bookings and website training payments; Microsoft 365, SharePoint and OneDrive for business communications, document management and storage; and Google Calendar and Google Meet for scheduling and remote meetings or training.

We may update or replace business systems from time to time. Where we do so, we will take appropriate steps to assess the data protection arrangements involved.

4.2 Training providers, consortiums and administration bodies

Where necessary to administer or provide a particular course, we may share relevant delegate and training information with an applicable training consortium, certification or administration provider, or another body involved in recording or evidencing completion.

The information shared will depend on the course and applicable requirements. We will only share information that is reasonably necessary for the relevant purpose.

Where additional or specific information is required for a course, we will explain this as part of the relevant booking or administration process where appropriate.

4.3 Regulators and public authorities

Where relevant to an agreed service, appropriately authorised communication or legal requirement, personal information may be shared with bodies such as:

the Driver and Vehicle Standards Agency (DVSA);
the Office of the Traffic Commissioner (OTC);
courts or tribunals;
law enforcement bodies;
tax or other public authorities; and
other regulatory or governmental bodies where applicable.

We will only make disclosures that are appropriate to our role, authority and legal obligations.

4.4 Professional advisers and specialists

We may share relevant personal information with professional advisers or specialists where necessary, including lawyers, accountants, insurance providers or brokers, and other appropriately engaged professional advisers.

Where you enter into a separate relationship directly with a professional or specialist introduced by TTC, that organisation or individual will be responsible for explaining how they use personal information they receive as an independent controller.

4.5 Subcontractors and associate professionals

Where TTC uses an appropriately appointed subcontractor or associate professional to assist with an agreed service, we may provide them with the personal information reasonably necessary to perform their role.

We will put appropriate confidentiality and data protection arrangements in place where required.

4.6 Our clients and people within their organisations

Where TTC provides services to an organisation, we may share relevant information with appropriate people within that organisation, such as directors, Transport Managers, authorised contacts or other personnel who reasonably need the information for the service.

We will take account of confidentiality, data protection and the individual's role before sharing information.

4.7 Business transfers and legal requirements

If TTC or its business or assets are reorganised, sold or transferred, relevant personal information may be disclosed to professional advisers and prospective or actual parties to that transaction where appropriate and subject to suitable safeguards.

We may also disclose personal information where required or permitted by law, to establish, exercise or defend legal rights, or where reasonably necessary to protect the rights, property or safety of TTC or others.

5. International transfers

Some of the service providers and technology platforms we use may process, store or make personal information accessible outside the United Kingdom.

Where TTC is responsible for making a restricted transfer of personal information outside the UK, we will ensure that an appropriate mechanism is in place as required by UK data protection law.

Depending on the circumstances, this may include:

transferring personal information to a country, territory or organisation covered by UK adequacy regulations;
using appropriate contractual safeguards, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to approved standard contractual clauses, together with any required assessment of the protection provided; or
relying on another transfer mechanism or exception permitted by data protection law where appropriate.

We also take reasonable steps when selecting and using service providers to understand how they handle and protect personal information.

If you would like more information about the safeguards relevant to your personal information, you can contact us at info@totaltransportcompliance.com.

6. How long we keep personal information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including where we need it to provide our services, maintain appropriate professional records, meet legal, accounting or regulatory requirements, resolve complaints or disputes, or establish, exercise or defend legal rights.

The appropriate retention period depends on the type of information and why we hold it. In determining retention periods, we consider the nature and sensitivity of the information, the purposes for which it is used, applicable legal or regulatory requirements and whether we may reasonably need the information in connection with a complaint, dispute or legal claim.

Our usual approach includes the following:

Enquiries and prospective client information: retained for a limited period where necessary to respond to the enquiry, follow up an opportunity or maintain an appropriate record of our discussions. Information that is no longer required will be deleted or anonymised in accordance with our retention arrangements.
Client and consultancy records: retained for an appropriate period after the engagement ends to maintain professional records, respond to subsequent queries and deal with potential complaints, regulatory matters or legal claims.
Training and delegate records: retained for the period necessary to administer the training, evidence attendance or completion and comply with any applicable training, certification, consortium or regulatory record-keeping requirements.
Financial and accounting records: retained for the period required by applicable tax, accounting and other legal requirements.
Call recordings: where a selected call is recorded, the audio recording will normally be retained for no longer than 30 days, while it is required to prepare or verify an appropriate written record. The recording may be retained for longer where there is a specific and justified reason, such as an ongoing complaint, dispute or regulatory matter.
Marketing information: retained while you remain subscribed or while we have an appropriate lawful reason to contact you. If you unsubscribe or object to direct marketing, we may retain limited information on a suppression list so that we can respect your preference in future.
Website and technical information: retained in accordance with the purpose for which it was collected and the applicable settings and retention arrangements for our website, security and analytics tools.

Different retention periods may apply where information is subject to a legal or regulatory requirement, an ongoing investigation, complaint, dispute, legal claim or another justified reason for keeping it for longer.

When personal information is no longer required, we will securely delete or destroy it or, where appropriate, anonymise it so that it can no longer identify an individual.

Further details about particular retention periods are available on request by contacting info@totaltransportcompliance.com.

7. How we protect personal information

We take appropriate technical and organisational measures to protect personal information against unauthorised or unlawful access, use, alteration or disclosure and against accidental loss, destruction or damage.

The measures we use are proportionate to the nature and sensitivity of the information, the way it is processed and the risks involved. They may include:

using reputable business systems and service providers with appropriate security measures;
access controls so that personal information is available only to people who reasonably need it for their role;
password protection, multi-factor authentication and other account-security measures where appropriate;
encryption and security features provided by the systems and devices we use;
secure cloud-based storage and document-management arrangements;
appropriate methods for transferring sensitive or confidential information;
keeping the amount of personal information we collect and share to what is reasonably necessary;
keeping devices, software and systems appropriately maintained and updated;
appropriate confidentiality and data protection requirements for people who work with or on behalf of TTC; and
procedures for identifying, managing and responding to information-security incidents and personal data breaches.

We review our security arrangements as appropriate and take account of the sensitivity of the information involved when deciding how it should be stored, accessed, transferred or shared.

Where we use third-party service providers to process personal information on our behalf, we take reasonable steps to assess their data protection and security arrangements and put appropriate contractual arrangements in place where required.

No method of storing or transmitting information can guarantee absolute security. However, we take reasonable and appropriate measures designed to protect the personal information entrusted to us.

Personal data breaches

If we become aware of a personal data breach, we will assess and respond to it in accordance with applicable data protection law.

Where required, we will report a breach to the Information Commissioner's Office or another relevant supervisory authority and notify affected individuals where the applicable legal threshold for notification is met.

8. Your data protection rights

Depending on the circumstances and the way we use your personal information, you may have the following rights under data protection law.

8.1 Right to be informed

You have the right to be told how and why your personal information is collected and used. This Privacy Notice is intended to provide that information.

8.2 Right of access

You may ask us whether we hold personal information about you and request a copy of that information, together with other information about how it is being used.

8.3 Right to rectification

You may ask us to correct personal information that is inaccurate or complete information that is incomplete.

8.4 Right to erasure

In certain circumstances, you may ask us to delete your personal information.

This right is not absolute. We may need or be entitled to retain particular information, for example where it is required for legal, regulatory, accounting or evidential purposes or for the establishment, exercise or defence of legal claims.

8.5 Right to restrict processing

In certain circumstances, you may ask us to restrict the way we use your personal information. For example, this may apply while we investigate a concern about the accuracy of information or consider an objection to particular processing.

8.6 Right to data portability

In certain circumstances, you may have the right to receive personal information you have provided to us in a structured, commonly used and machine-readable format or ask us to transfer it to another organisation where technically feasible.

This right applies only to certain processing carried out by automated means and does not apply to all information TTC holds.

8.7 Right to object

You may have the right to object to processing based on our legitimate interests, taking account of your particular circumstances.

You have an absolute right to object to the use of your personal information for direct marketing. If you tell us that you do not want to receive direct marketing, we will stop using your personal information for that purpose.

We may retain limited information on a suppression list so that we can continue to respect your preference.

8.8 Right to withdraw consent

Where we rely on your consent to process personal information, you may withdraw that consent at any time.

Withdrawal does not affect the lawfulness of processing that took place before consent was withdrawn.

For marketing emails, you can withdraw your consent by using the unsubscribe option in the communication or by contacting us.

8.9 Automated decision-making

TTC does not currently make decisions about individuals based solely on automated processing that produce legal or similarly significant effects.

If this changes, we will update our privacy information and put appropriate safeguards in place as required by data protection law.

8.10 Exercising your rights

To exercise a data protection right or ask us a question about your personal information, please contact:

Email: info@totaltransportcompliance.com

Post: Total Transport Compliance, 14 Spen Road, Leeds, LS16 5BT, United Kingdom

Please provide enough information for us to understand your request and identify the relevant information.

We may ask for information reasonably necessary to confirm your identity where appropriate. We will not ask for more identification information than is necessary.

We will respond to requests in accordance with the timescales required by applicable data protection law.

Some rights are subject to conditions, limitations and exemptions. If we cannot comply with all or part of a request, we will explain our decision where required by law and tell you about any further rights available to you.

9. Complaints about how we use personal information

If you have a concern or complaint about how TTC has collected, used, stored, shared or otherwise handled your personal information, or about how we have responded to a data protection rights request, please contact us.

You do not need to use legal terminology or refer to data protection legislation. Please provide enough information for us to understand your concern, identify the relevant information where possible and understand what you would like us to look into.

You can make a data protection complaint using the following contact details:

Email: info@totaltransportcompliance.com

Post: Total Transport Compliance, 14 Spen Road, Leeds, LS16 5BT, United Kingdom

We will:

acknowledge your data protection complaint within 30 days of receiving it;
take appropriate steps to investigate the matters you have raised;
keep you appropriately informed about the progress of our investigation; and
provide you with an outcome without unnecessary or unjustifiable delay.

We will explain the outcome of our investigation and, where appropriate, any action we have taken as a result.

Complaining to the Information Commissioner's Office

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator, if you are concerned about how your personal information has been handled.

The ICO generally recommends giving the organisation concerned an opportunity to investigate and respond first, as this may allow the issue to be resolved more quickly.

Information about making a data protection complaint is available on the ICO's website.

Making a complaint to TTC or the ICO does not affect any other rights or remedies available to you.

10. Changes to this Privacy Notice

We keep this Privacy Notice under regular review and may update it from time to time to reflect changes to our services, business practices, systems, legal requirements or the way we use personal information.

The current version will be published on our website and will show the date on which it was last updated.

Where we make a material change that affects how we use personal information, we will take reasonable steps to bring the change to the attention of affected individuals where appropriate.

If we intend to use personal information for a new purpose that is not compatible with, or reasonably covered by, the purposes previously explained to you, we will provide appropriate privacy information before beginning that new processing, as required by law.

11. If you do not provide information we need

In some circumstances, we need certain personal information in order to respond to a request, enter into or perform a contract, administer training, provide an agreed service, meet a legal or regulatory requirement, or maintain appropriate business records.

Where information is required, we will normally explain this at the point it is requested.

If you do not provide information that is reasonably necessary, we may be unable to:

respond fully to an enquiry or assess whether TTC can assist;
prepare or enter into an appropriate engagement;
process or administer a training booking;
provide joining information, completion records or certification where applicable;
carry out all or part of an agreed consultancy, audit or regulatory-support service;
process a payment or issue appropriate financial documentation; or
comply with a legal, regulatory or professional requirement.

We will not ask you to provide personal information that is not reasonably necessary for the relevant purpose.