Privacy Policy

1. Introduction

Toto Logistic Services LTD (“we”, “us”, “our”) is committed to protecting and respecting your privacy. This Privacy Policy (together with our Cookie Policy, Terms & Conditions and any other documents referred to) describes how we collect, use, disclose, transfer and store your personal data when you use our website, purchase our services, enrol in our courses, or otherwise engage with us.

2. Who we are

• Company name: Toto Logistic Services LTD
• Company number: 11631796
• Registered office address: 37 Reynolds Avenue, Maidstone, ME17 3GW
• Director/Person with Significant Control: Madalin Zorzoliu
• Service overview: We are a family-run business established in 2018, specialising in training services (Driver CPC courses, First Aid training, CPD-accredited e-learning courses), transport audits, transport consultancy, External Transport Manager services, and associated compliance services.

3. Data we may collect

We may collect and process the following types of personal data:

• Identity data: name, date of birth, job title, company name (if applicable)
• Contact data: email address, postal address, telephone number
• Account data: username and login details (if you register on our site)
• Transaction data: billing details and purchase history. Card payments are processed by Stripe; we do not see or store your full card details
• Technical data: IP address, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform, other technology on the devices you use to access this website
• Online activity data: pages visited, time spent on pages, navigation paths through the site, search terms used
• Course/Training data: course enrolment information, attendance, assessment results, certification status
• Compliance and audit data: for operators who use our audit, we may process driver and vehicle records, such as licence-check results (including penalty points and endorsements), tachograph and working-time data, licence copies, defect reports and induction paperwork. Section 12 explains our role for this data.
• Marketing and communications data: preferences for receiving marketing from us, responses to surveys, feedback.

4. How and why we use your data (purpose and lawful basis)

We process your personal data only when we have a lawful basis to do so under UK GDPR. Common lawful bases we rely on include:

• Performance of a contract (e.g., when you buy a course, register for training)
• Compliance with a legal obligation (e.g., keeping financial records for HMRC and the training records required by our Driver CPC approval)
• Our legitimate interests (e.g., managing our business, and marketing to business customers), provided your rights and freedoms are not overridden
• Consent (e.g., where you opt in to receive marketing communications)

Specifically, we use your data for:

• Enrolling you on courses, providing access credentials, supporting your learning journey
• Processing payments and issuing receipts/invoices
• Administering and managing our customer relationship and support services
• Sending you relevant communications (with your consent or, for business contacts, where we have a legitimate interest)
• Conducting audits, compliance reviews and consultancy in the transport sector
• Ensuring the security, integrity and operational performance of our website and IT systems
• Meeting legal, regulatory and statutory obligations including data-retention requirements
• Analysing how our website and services are used so that we can improve our offering
• Sharing your data with third-party service providers where required (e.g., hosting, payment processors, training partners)

5. Disclosure of your data

We may share your personal information with third parties where necessary for the purposes set out above. This may include:

• Service providers – for example, our website hosting provider, Stripe (card payments), e-learning platform providers and email services
• Our training partners – e.g., Pro Trainings UK for First Aid courses, where course delivery or certification involves sharing certain participant data
• DVSA and JAUPT – to upload Driver CPC training to your Driver CPC record, as required for approved training centres
• Your employer – if your employer booked or paid for your training, we share attendance, results and certificates with them
• Legal and regulatory authorities – if required by law or regulation (for example, for transport-industry audit records or DVSA/Traffic Commissioner requirements)
• Prospective buyers or advisers – in the event of a merger, sale, reorganisation or disposal of assets
• Other parties, with your explicit consent

If we transfer your personal data outside the UK (or European Economic Area), we will ensure appropriate safeguards are in place (for example, standard contractual clauses) in accordance with UK GDPR.

6. Data retention

We will retain your personal data only for as long as is necessary for the purposes for which it was collected, including meeting legal, regulatory or contractual obligations. When your data is no longer needed, we will securely delete or anonymise it.

We keep personal data for the following periods:

• Training enrolment, attendance, assessment and certification records: 6 years after the course ends, so we can confirm your training if asked and support audits by approval and awarding bodies
• Marketing preferences and contact details: until you unsubscribe or object. We then keep a record of your opt-out so we do not contact you again
• Website analytics and server log data: no more than 26 months

7. Your rights

Under UK GDPR you have a number of rights in respect of the personal data we hold about you. Depending on the circumstances, these may include:

• The right to access the personal data we hold about you and obtain a copy
• The right to rectify inaccurate or incomplete data
• The right to ask us to erase your data in certain circumstances (the “right to be forgotten”)
• The right to restrict our processing of your data in certain circumstances
• The right to object to our processing of your data (for example for direct marketing or legitimate-interest processing)
• The right to data portability — to receive your data in a structured, commonly-used machine-readable format
• The right to withdraw your consent at any time (where our processing is based on consent)
• The right to complain to us, and to the Information Commissioner’s Office (“ICO”) if you are not happy with our response (see below)

If you wish to exercise any of these rights, please contact us using the details in Section 11 below.

You can contact the Information Commissioner’s Office at ico.org.uk/make-a-complaint, by phone on 0303 123 1113, or by post at Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

8. Security of your data

We take appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing, accidental loss, destruction or damage.

These measures include a secure (HTTPS) website, password-protected systems, access limited to people who need it, secure card payments, regular reviews of our security processes, and ensuring our service providers maintain high standards of security.

9. Cookies and tracking technologies

Our website uses cookies and similar tracking technologies to understand how users engage with our site, to manage login sessions, to enable certain features and to improve performance. We distinguish between essential cookies (necessary for site operation) and non-essential cookies (analytics, marketing).

You can change your preferences at any time through our cookie banner or your browser settings. Non-essential cookies are only set if you agree to them.

Further information is set out in our separate Cookie Policy, which lists the cookies we use and how to change your choices.

10. Changes to this Privacy Policy

We may change this Privacy Policy from time to time (for example if we change our business or regulatory requirements). Any changes will be posted on this page, and where appropriate we will notify you via email or via a notice on our website.

We recommend you check this page periodically to keep up to date.

11. Contact us

If you have any questions about this Privacy Policy or the way we process your personal data, please contact:

• Email: admin@tlslogistic.co.uk
• Correspondence address: 37 Reynolds Avenue, Maidstone, ME17 3GW
• Contact person: Madalin Zorzoliu

12. Data we handle for transport operators

When we carry out compliance audits or consultancy for a transport operator, we handle driver and vehicle records (such as tachograph data, licence-check results, licence copies and induction paperwork) on the operator’s behalf and on its instructions. In that role, the operator is the data controller, and we act as its data processor, under a written data processing agreement. Drivers should contact their employer first with questions about how this data is used.

We keep records of our processing activities and carry out Data Protection Impact Assessments where required.

Reviewed and approved by: Madalin Zorzoliu, Managing Director, Toto Logistic Services LTD

Date: 10/10/2026 (version 1.1)

Toto Logistic Services LTD is a private limited company registered in England and Wales, company number 11631796, registered office 37 Reynolds Avenue, Maidstone, ME17 3GW.