Privacy Policy

Last updated: 30 June 2026

1. About this privacy policy

This privacy policy explains how the Thermal Insulation Contractors Association, referred to in this policy as TICA, ACAD, we, us or our, collects, uses, shares and protects personal information.

ACAD is the Asbestos Control and Abatement Division of TICA.

Unless a separate privacy notice states otherwise, the Thermal Insulation Contractors Association is the data controller responsible for personal information processed in connection with TICA and ACAD.

This policy applies when you:

• visit or use our website;
• contact TICA or ACAD;
• sign up for newsletters or communications;
• apply for or hold TICA or ACAD membership;
• apply for training, an apprenticeship, an assessment or a qualification;
• apply for or hold a TICA or ACAD Skill Card;
• book or attend an event;
• make a payment;
• provide a reference;
• take part in an audit, inspection or accreditation process;
• apply for employment with us; or
• otherwise interact with TICA or ACAD.

We process personal information in accordance with the UK General Data Protection Regulation, the Data Protection Act 2018 and other applicable UK data protection legislation.

2. How to contact us

Questions, requests or complaints about the use of personal information should be sent to:

Data Protection Lead
Thermal Insulation Contractors Association
TICA House
34 Allington Way
Darlington
DL1 4QB

Email: enquiries@tica.uk.com
Telephone: 01325 466704

Please mark correspondence for the attention of the Data Protection Lead.

3. Personal information we collect

The personal information we collect depends on how you interact with TICA or ACAD.

It may include:

Identification and contact information

• name;
• title;
• date of birth;
• postal address;
• email address;
• telephone number;
• photograph;
• signature; and
• identification or eligibility documents.

Employment and organisation information

• employer or business name;
• job title;
• employment history;
• professional responsibilities;
• company address and contact details;
• membership information;
• insurance details;
• trade or client references;
• information about directors, owners or senior employees; and
• information needed for audits, inspections or membership applications.

Training, qualification and Skill Card information

• apprenticeship and training records;
• attendance and progress information;
• assessment results;
• qualifications and certificates;
• National Insurance number, learner number or other training identifiers;
• employment and workplace information;
• practical assessment evidence;
• health and safety qualifications;
• Skill Card application and issue history;
• card photographs;
• equality, accessibility or reasonable adjustment information; and
• information supplied by employers, training providers, awarding organisations or funding bodies.

Financial and transaction information

• billing address;
• payment and transaction details;
• invoices;
• purchase history;
• bank details where required;
• funding information; and
• credit or financial standing information relevant to a membership application.

Where payments are made through a third-party payment provider such as Stripe, the payment provider processes your card details. We may receive limited information confirming the payment, such as the amount, date, transaction status and payment reference.

Communications and preferences

• enquiries and correspondence;
• records of telephone calls or meetings;
• complaints and feedback;
• marketing preferences;
• event bookings;
• survey responses; and
• information you provide through website forms.

Website and technical information

When you use our website, we may collect:

• IP address;
• browser and device information;
• pages viewed;
• links selected;
• date and time of visits;
• approximate location;
• referring website;
• website account activity;
• cookie identifiers; and
• information about how the website is used.

Photographs, video and event information

We may take photographs or video recordings at training activities, events, awards ceremonies, meetings and other TICA or ACAD activities.

Where an individual is the main subject of promotional photography or video, we will normally obtain consent or make the intended use clear at the time.

General photographs of events may be taken where this is within our legitimate interests, provided that this does not override the rights and interests of the people shown.

4. Special category and criminal offence information

In limited circumstances, we may process more sensitive personal information, known as special category data.

This may include information about:

• health or disability;
• accessibility requirements;
• ethnicity;
• religious beliefs;
• trade union membership; or
• other information needed for equality monitoring, safeguarding, learner support or reasonable adjustments.

We only process this information when there is a lawful basis under Article 6 of the UK GDPR and an additional condition under Article 9 of the UK GDPR.

Depending on the circumstances, this may include explicit consent, employment and social protection law, substantial public interest, safeguarding, or the establishment, exercise or defence of legal claims.

We may process information relating to criminal convictions or offences where this is necessary for safeguarding, recruitment, legal compliance or determining suitability for a particular role or activity. We will only do so where permitted by law and subject to appropriate safeguards.

5. Information about children and young people

Some of our apprentices, learners or applicants may be under the age of 18.

Where we process the personal information of children or young people, we take additional care to ensure that the information is handled fairly, securely and in a way that the individual can understand.

We may collect parent or carer contact details where this is necessary for safeguarding, welfare, accommodation, emergencies or the administration of training.

6. How we obtain personal information

We may collect personal information directly from you when you:

• complete a form;
• contact us;
• create or use an online account;
• make a booking or payment;
• apply for membership, training, an apprenticeship, an assessment or a Skill Card;
• attend an event;
• provide a reference;
• respond to a survey; or
• communicate with our employees.

We may also obtain personal information from other sources, including:

• your employer or prospective employer;
• member companies;
• apprenticeship employers;
• parents, carers or emergency contacts;
• referees;
• clients, suppliers and contractors;
• training providers;
• colleges;
• awarding organisations;
• assessment organisations;
• qualification databases;
• government departments;
• devolved administrations;
• apprenticeship and skills funding bodies;
• regulatory and enforcement bodies;
• Skill Card and card-verification providers;
• credit reference or company information providers;
• publicly available sources, including Companies House and company websites;
• event organisers;
• professional advisers; and
• organisations with which you have authorised us to communicate.

Where we obtain personal information from someone other than you, we will provide relevant privacy information within the period required by law, normally within one month, at the point we first contact you, or before we first disclose the information to another organisation.

7. How and why we use personal information

We use personal information for the purposes described below.

Enquiries and communications

We use personal information to:

• respond to enquiries;
• provide information about our services;
• manage correspondence;
• provide advice and support; and
• maintain records of communications.

Our lawful bases are taking steps at your request before entering into a contract and our legitimate interests in responding to enquiries and operating our services effectively.

Membership applications and services

We use personal information to:

• assess TICA and ACAD membership applications;
• verify eligibility;
• obtain and check references;
• conduct company, background or credit checks;
• administer membership;
• collect membership fees;
• communicate with members;
• provide membership services and benefits;
• maintain member directories;
• conduct audits or inspections;
• investigate compliance concerns; and
• manage membership renewals, suspensions or terminations.

Our lawful bases are contract, steps taken before entering into a contract, legal obligation and our legitimate interests in maintaining appropriate standards, protecting the integrity of membership and administering TICA and ACAD.

Apprenticeships, training and learner support

We use personal information to:

• assess eligibility for training or an apprenticeship;
• recruit and enrol apprentices;
• match applicants with employers;
• administer learning programmes;
• record attendance and progress;
• provide learner support;
• arrange accommodation or travel where applicable;
• meet safeguarding responsibilities;
• arrange assessments and qualifications;
• report to employers, awarding bodies and funding organisations;
• verify funding eligibility;
• complete statutory or regulatory returns;
• issue certificates; and
• monitor the quality and effectiveness of training.

Our lawful bases are contract, steps taken before entering into a contract, legal obligation, legitimate interests and, where applicable, tasks carried out in the public interest in connection with funded education or training.

Where special category information is required, we rely on an appropriate condition under data protection law, including explicit consent, employment and social protection law, substantial public interest, safeguarding or legal claims.

Qualifications, assessments and Skill Cards

We use personal information to:

• process Skill Card applications;
• verify qualifications, training and experience;
• assess eligibility for a card;
• produce physical or virtual cards;
• manage card renewals;
• maintain cardholder records;
• provide card verification services;
• prevent fraud or misuse;
• communicate with cardholders and employers; and
• meet requirements connected with CSCS or other industry schemes.

Our lawful bases are contract, steps taken before entering into a contract, legal obligation and our legitimate interests in verifying competence, preventing fraud and supporting safe working practices.

Audits, inspections and accreditation

We use personal information to:

• arrange and conduct audits or inspections;
• assess compliance;
• maintain audit evidence;
• communicate findings;
• manage corrective actions;
• investigate complaints;
• make certification, accreditation or membership decisions; and
• demonstrate the quality and integrity of our schemes.

Our lawful bases are contract, legal obligation and our legitimate interests in maintaining industry standards and the integrity of TICA and ACAD schemes.

Events and bookings

We use personal information to:

• process event registrations;
• administer bookings;
• take payment;
• arrange catering, accommodation or accessibility requirements;
• communicate event information;
• maintain attendance records; and
• manage event safety and security.

Our lawful bases are contract, legal obligation, consent where appropriate and our legitimate interests in organising and improving events.

Payments, finance and debt management

We use personal information to:

• process payments;
• issue invoices and receipts;
• maintain financial records;
• manage refunds;
• recover outstanding payments;
• prevent fraud; and
• meet tax, accounting and audit requirements.

Our lawful bases are contract, legal obligation and our legitimate interests in protecting our financial position and managing payments effectively.

Marketing and newsletters

We may use contact information to send:

• TICA or ACAD newsletters;
• information about training;
• event invitations;
• membership updates;
• funding information;
• Government or regulatory updates;
• technical information;
• industry news; and
• information about related TICA or ACAD services.

Where required by the Privacy and Electronic Communications Regulations, we rely on consent.

In some business-to-business circumstances, we may rely on our legitimate interests in communicating relevant professional, membership, training or industry information to existing members, customers and business contacts, where the law allows.

Every marketing email will include a way to unsubscribe. You may also ask us to stop marketing at any time by contacting us.

Service messages, such as information about an existing booking, membership, training programme, payment or Skill Card, are not marketing messages and may still be sent where necessary.

Website operation, security and improvement

We use technical and website information to:

• operate the website;
• maintain security;
• prevent fraud and misuse;
• investigate technical problems;
• understand how visitors use the website;
• improve content and navigation; and
• maintain evidence of cookie preferences.

Our lawful bases are legitimate interests, legal obligation and consent where consent is required for cookies or similar technologies.

Complaints, disputes and legal matters

We use personal information to:

• investigate and respond to complaints;
• manage disputes;
• establish, exercise or defend legal claims;
• respond to regulators or public authorities;
• maintain insurance records; and
• comply with legal and regulatory obligations.

Our lawful bases are legal obligation and our legitimate interests in resolving complaints, protecting our legal rights and maintaining appropriate records.

Recruitment

Where you apply to work for TICA or ACAD, we may use personal information to:

• assess your application;
• communicate with you;
• conduct interviews;
• obtain references;
• verify qualifications and right-to-work information;
• carry out appropriate background checks; and
• make recruitment decisions.

Our lawful bases are steps taken before entering into an employment contract, legal obligation and our legitimate interests in recruiting suitable employees.

Successful applicants will receive additional privacy information about the processing of employee information.

8. Our legitimate interests

Where we rely on legitimate interests, these may include:

• operating TICA and ACAD effectively;
• supporting our members, learners and industry;
• maintaining accurate records;
• providing relevant services;
• promoting training, competence and industry standards;
• protecting the integrity of membership and Skill Card schemes;
• preventing fraud and misuse;
• improving our website and services;
• keeping our systems and premises secure;
• managing professional relationships;
• communicating with business contacts;
• recovering debts;
• investigating complaints; and
• protecting our legal rights.

Before relying on legitimate interests, we consider whether the processing is necessary and whether your rights and interests override our interests.

9. When providing information is mandatory

Some personal information must be provided so that we can:

• enter into or perform a contract;
• process an application;
• verify identity or eligibility;
• administer training or an apprenticeship;
• issue a qualification or Skill Card;
• meet safeguarding duties;
• obtain Government or industry funding;
• comply with regulatory requirements;
• take payment; or
• meet legal and accounting obligations.

Mandatory information will normally be identified on the relevant form.

Where required information is not provided, we may be unable to process an application, provide a service, issue a qualification or card, complete a booking or meet our legal obligations.

10. Who we share personal information with

We may share personal information where necessary and lawful with:

• TICA and ACAD employees;
• your employer or apprenticeship employer;
• member companies;
• training providers and colleges;
• tutors, assessors and quality assurance personnel;
• awarding organisations;
• end-point assessment organisations;
• qualification verification services;
• Skill Card production and verification providers;
• CSCS and related industry card schemes;
• Government departments;
• devolved administrations;
• apprenticeship and skills funding bodies;
• local authorities;
• regulators and enforcement agencies;
• safeguarding authorities;
• auditors and inspectors;
• IT, website, database and software providers;
• email and communications providers;
• payment providers, including Stripe;
• event venues and service providers;
• accommodation and travel providers;
• insurers;
• accountants;
• legal and professional advisers;
• debt recovery providers;
• credit reference and company information providers;
• law enforcement agencies;
• courts and tribunals; and
• another organisation involved in a merger, restructuring or transfer of our activities.

We require service providers that process personal information on our behalf to protect the information, use it only for the agreed purpose and comply with applicable data protection law.

We do not sell personal information.

11. International transfers

Some of our technology, communications, website or software providers may process or store personal information outside the United Kingdom.

Where personal information is transferred outside the UK, we take steps to ensure that it receives an appropriate level of protection.

Depending on the destination and provider, this may include:

• transferring information to a country covered by UK adequacy regulations;
• using the UK International Data Transfer Agreement;
• using the UK Addendum to approved contractual clauses;
• implementing additional technical and organisational safeguards; or
• relying on another transfer mechanism permitted by law.

You may contact us for more information about the safeguards used for international transfers.

12. How long we keep personal information

We keep personal information only for as long as it is reasonably necessary for the purpose for which it was collected.

We consider:

• the nature and sensitivity of the information;
• the reason it was collected;
• legal, contractual, funding and regulatory requirements;
• awarding body requirements;
• limitation periods for legal claims;
• safeguarding requirements;
• fraud prevention;
• the need to verify qualifications, competence or Skill Card history; and
• whether the information remains accurate and relevant.

Our general retention periods are:

Website enquiries and general correspondence

Normally two years after the enquiry is closed, unless it leads to a membership, training, contractual or other ongoing relationship.

Membership records

For the duration of membership and normally six years after membership ends.

Records required to demonstrate historic membership, disciplinary action, audit history or the integrity of a scheme may be retained for longer where necessary.

Unsuccessful membership applications are normally retained for two years after the decision.

Apprenticeship, training, qualification and assessment records

Normally for at least six years after completion, withdrawal or the end of the relevant funding period.

Core qualification, achievement, assessment and certification information may be retained for longer where necessary to verify qualifications, respond to future enquiries, meet awarding body requirements or prevent fraud.

Skill Card records

For the period that the card remains valid and normally for six years after expiry, replacement or cancellation.

Core card issue, qualification and verification records may be retained for longer where necessary to demonstrate competence, confirm card history or prevent fraudulent applications.

Financial and payment records

Normally for six years after the end of the financial year to which the record relates.

Event records

Normally for three years after the event.

Financial records connected with an event may be retained for six years.

Marketing records

Until you unsubscribe, withdraw consent or object to marketing.

We may retain limited information on a suppression list after an opt-out so that we can ensure that further marketing is not sent.

Complaints, disputes and legal claims

Normally for six years after the complaint or dispute is closed, or longer where legal proceedings, safeguarding concerns or regulatory requirements apply.

Recruitment records

Records relating to unsuccessful applicants are normally retained for six months after the recruitment process ends, unless there is a reason to retain them for longer or the applicant agrees to remain in a recruitment pool.

Information about successful applicants becomes part of their employment record.

Cookie and website information

In accordance with the lifespan of the relevant cookie, security requirement or analytics purpose, as explained through our cookie controls or Cookie Policy.

Information may be securely deleted, anonymised or aggregated when it is no longer required.

13. Security

We use appropriate technical and organisational measures to protect personal information against:

• unauthorised access;
• unlawful use;
• accidental loss;
• alteration;
• disclosure;
• destruction; and
• damage.

These measures may include:

• access controls;
• passwords and multi-factor authentication;
• encryption;
• secure backups;
• system monitoring;
• staff training;
• data protection policies;
• secure disposal arrangements;
• supplier due diligence; and
• contractual protections.

Access to personal information is limited to employees and service providers who need it for their work.

No method of electronic transmission or storage is completely secure. We regularly review our controls and respond to identified risks.

14. Your data protection rights

Depending on the circumstances and the lawful basis used, you may have the following rights.

Right to be informed

You have the right to receive clear information about how we use your personal information.

Right of access

You may ask for confirmation that we process your personal information and request a copy of that information.

This is commonly known as a subject access request.

There is normally no charge for exercising this right. A reasonable fee may only be charged where permitted by law, such as where a request is manifestly unfounded or excessive.

Right to rectification

You may ask us to correct inaccurate or incomplete personal information.

Right to erasure

You may ask us to delete personal information in certain circumstances.

This right does not apply where we must retain the information to comply with a legal obligation, perform a contract, establish or defend legal claims, or for another lawful reason.

Right to restrict processing

You may ask us to limit how we use personal information in certain circumstances.

Right to data portability

Where processing is based on consent or contract and is carried out by automated means, you may have the right to receive information you provided to us in a structured, commonly used and machine-readable format.

Right to withdraw consent

Where we rely on consent, you may withdraw it at any time.

Withdrawing consent does not affect processing that took place before consent was withdrawn.

Right to object

You have the right to object at any time to the use of your personal information for direct marketing.

You may also object to processing based on legitimate interests. We will stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims.

Rights relating to automated decision-making

You have rights relating to decisions made solely by automated means where those decisions have legal or similarly significant effects.

15. Automated decision-making

We do not currently make decisions about individuals solely through automated processing, including profiling, where those decisions have legal or similarly significant effects.

Automated tools, searches, credit information or verification systems may support membership, eligibility, fraud prevention or qualification checks. However, decisions involving an individual are subject to meaningful human review.

We will update this policy and provide additional information before introducing any solely automated decision-making that has legal or similarly significant effects.

16. How to exercise your rights

To exercise a data protection right, contact:

Email: enquiries@tica.uk.com

Or write to:

Data Protection Lead
Thermal Insulation Contractors Association
TICA House
34 Allington Way
Darlington
DL1 4QB

Please provide enough information for us to identify you and understand your request.

We may ask for proof of identity where this is necessary to protect personal information from unauthorised disclosure.

We will respond without undue delay and normally within one month. Where a request is complex or numerous, the response period may be extended where permitted by law. We will tell you if an extension is required.

Some rights are subject to legal conditions and exemptions. We will explain our decision where we cannot comply fully with a request.

17. Data protection complaints

You may complain to us if you believe that we have not handled your personal information appropriately.

Complaints should be sent to:

Email: enquiries@tica.uk.com

Or:

Data Protection Lead
Thermal Insulation Contractors Association
TICA House
34 Allington Way
Darlington
DL1 4QB

We will:

• acknowledge receipt of your complaint within 30 days;
• take appropriate steps to investigate it;
• keep you informed where appropriate; and
• tell you the outcome without undue delay.

You also have the right to complain to the Information Commissioner’s Office.

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113

We would appreciate the opportunity to consider your concerns before you contact the Information Commissioner’s Office, but you are not required to contact us first.

18. Cookies and similar technologies

Cookies are small files or pieces of information stored on or accessed from your device when you visit a website.

We may use cookies and similar technologies to:

• operate essential website functions;
• maintain website security;
• remember preferences;
• manage website forms or online accounts;
• understand how the website is used;
• measure website performance;
• display embedded content; and
• support communications or marketing.

Strictly necessary cookies

These cookies are required for the website to function properly or to provide a service you have requested.

Consent is not normally required for strictly necessary cookies.

Analytics and performance cookies

These cookies help us understand how visitors use the website and identify areas for improvement.

Where required by law, these cookies will only be used after you have provided consent.

Functionality cookies

These cookies remember choices and provide enhanced website features.

Where required, they will only be used with consent.

Third-party and embedded content

Website pages may include content or services provided by third parties, such as videos, maps, payment services, social media content or event platforms.

Those providers may place cookies or collect information about your device and website activity. Where consent is required, the relevant content or cookies will not be activated until consent has been provided.

You can accept, reject or manage non-essential cookies through the website’s cookie controls.

You may withdraw or change your consent at any time through the cookie preference tool. Rejecting non-essential cookies should not prevent access to the main content of the website, although some optional features may not work as intended.

Browser settings can also be used to block or delete cookies.

19. Links to other websites

Our website may contain links to websites operated by other organisations.

Once you follow a link to another website, that organisation is responsible for how it collects and uses personal information.

This policy does not apply to external websites. You should read the privacy information provided by the relevant website operator.

20. Changes to this privacy policy

We may update this policy to reflect:

• changes to our services;
• changes to how we use personal information;
• new technology;
• changes to suppliers;
• legal or regulatory developments; or
• improvements to our data protection arrangements.

The latest version will be published on our website with the date it was last updated.

Where a change is significant, we may also notify affected individuals through email, website notices or other appropriate communications.