Universal Motorcycle Training®
Last updated: 10 November 2026
1. Who we are
This policy explains how MACBRIT Solutions Ltd, trading as Universal Motorcycle Training® (‘UMT’, ‘we’, ‘us’), collects and uses personal information through our website (universalmct.co.uk), our bookings and our messaging channels. We are the controller of your personal information.
- Company: MACBRIT Solutions Ltd, registered in England and Wales, company number 09942776
- Registered office: 82 Sunleigh Road, Wembley HA0 4LR
- Email: [email protected] (please put ‘Data Protection’ in the subject line)
- Phone: 020 3691 8807
Privacy questions and requests are handled by our compliance team.
2. The law we follow
We follow the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), as amended by the Data (Use and Access) Act 2025.
3. What we collect
- Identity and contact details: name, date of birth, address, email address and phone number.
- Training and licence details: the information needed to book and deliver your course and issue certificates, including driving licence details, course history and the records we must keep for the Driver and Vehicle Standards Agency (DVSA).
- Booking and payment details: courses booked, amounts paid and payment references. We do not store full card numbers.
- Messages: what you send us by email, phone, website chat, WhatsApp, Facebook Messenger or Instagram, and our replies.
- CCTV images: video of you at our training centres (see section 6).
- Website and device data: IP address, browser and device type, pages visited, and actions on our site (such as phone or WhatsApp clicks, form submissions and completed bookings), collected through cookies and similar technologies as described in our Cookie Policy.
- Marketing preferences: whether you have agreed to hear from us, and any opt-outs.
4. Why we use it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Taking and managing bookings, delivering training, issuing certificates | Contract |
| Meeting DVSA and other legal requirements, keeping tax and accounting records | Legal obligation |
| Answering your enquiries and messages | Contract, if you are booking; otherwise legitimate interests (replying to people who contact us) |
| Keeping our website secure and working | Legitimate interests |
| Website statistics, heatmaps and session recordings (Google Analytics, Microsoft Clarity) | Consent, given through our cookie banner |
| Advertising and measuring our ads (Google Ads, Meta, TikTok, ChatGPT Ads) | Consent, given through our cookie banner |
| Sending marketing emails, texts or WhatsApp messages | Consent, or for existing customers the PECR ‘soft opt-in’ for similar courses, with an opt-out in every message |
| Handling complaints and legal claims | Legitimate interests and legal obligation |
| CCTV at our training centres, for safety, security, preventing and detecting crime, investigating complaints, incidents and allegations, and insurance claims | Legitimate interests (keeping people and property safe and dealing fairly with complaints and claims) |
| Reviewing CCTV to check that training is delivered as DVSA requires | Legitimate interests (making sure our courses meet DVSA standards) |
| Giving CCTV to the police | Recognised legitimate interest (preventing and detecting crime), or legal obligation where we are required to |
You can withdraw consent at any time through the Cookie settings on our Cookie Policy page, or by contacting us. Withdrawing consent does not affect anything we did lawfully before.
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
5. Advertising pixels and matched data
If you accept marketing cookies, our website loads advertising pixels from Google (Google Ads), Meta (Facebook and Instagram), TikTok and OpenAI (ChatGPT Ads). These tell each platform which of our pages you visited and whether you contacted us or booked, so we can measure our ads and show them to people likely to be interested.
Matched data. Where you give us your email address, phone number, name or address on our website, the Meta and TikTok pixels may convert it into a scrambled code (hashed) on your device and send it to the platform, which uses it to match the visit to an account. The platform does not receive the readable details. Google Ads Enhanced Conversions works in the same way.
For collecting and sending this data, Meta and TikTok act as joint controllers with us under their business terms. For what they do with it afterwards, they are controllers in their own right, and their privacy policies explain how they use it.
If you do not accept marketing cookies, none of these pixels load.
6. CCTV at our training centres
We use CCTV at our training centres. Signs show where cameras are in use.
Where the cameras are. Training areas, classrooms, waiting rooms, reception, showroom and café areas, meeting rooms, entrances and gates, bike stores and containers, plus the kit room where trainees put on jackets, helmets, gloves and hi-vis.
What we record. Video only. Our cameras record no sound. Each centre’s recorder holds footage on site. When a camera detects movement, a short clip is also copied off site.
Why we have it. To keep trainees, staff and visitors safe; to protect our premises and motorcycles; to prevent and detect crime; to look into complaints, incidents and allegations, including allegations about our staff or instructors; to handle insurance claims; and to check that training is delivered the way DVSA requires.
Our legal basis. Legitimate interests. We have weighed these interests against your privacy and written down our assessment. Ask us if you would like a summary.
Where it is kept, and for how long. Footage held on each centre’s recorder is automatically overwritten after no more than 30 days. Clips copied off site are transferred over an encrypted connection to servers we rent from a hosting provider in Germany, and are deleted automatically after 30 days. If a clip is needed for a complaint, incident, insurance claim or police investigation, we save a copy and hold it until the matter is closed and for 12 months after that, or longer while any DVSA, insurance, police or legal matter remains open.
Who can see it. Only authorised UMT managers. We may pass relevant footage to DVSA, the police, our insurers and professional advisers. If an allegation is made about an instructor, we may show or give that instructor the relevant footage so that they can respond. We do not routinely hand footage to trainees.
Use of AI tools. When we look into a complaint or incident, we may use AI tools supplied to us under contract to help us locate and review the relevant clips. Every decision is made by a member of our team.
Our instructors and staff. Cameras also film our instructors and staff while they work. We may review footage to check that training meets DVSA requirements, for instance how long on-road riding lasts and when groups leave and come back. We give our instructors and staff separate information about this.
How to ask for footage of yourself. Email us, putting ‘Data Protection’ in the subject line. Tell us which centre, the date and the approximate time. Clips are deleted after 30 days, so please get in touch promptly. We may blur other people before sending you a copy.
7. Who we share it with
We share personal information only where needed:
- DVSA, and other bodies that regulate or fund training (such as TfL), where a course requires it.
- Our service providers, who act on our instructions: In-Contact (bookings and customer records), Crisp (website chat and messaging), ManyChat (Facebook and Instagram messaging), Meta’s WhatsApp Business service, consentmanager (our cookie banner), Microsoft Clarity (website statistics, only if you consent), our website hosting and security providers, Google Workspace (email), a hosting provider in Germany (storage of CCTV clips), and AI tools supplied to us under contract (to help us review records, including CCTV clips, when we handle complaints).
- Payl8r, if you apply to pay for training in instalments. Payl8r handles your application under its own privacy policy.
- The advertising platforms in section 5, only if you accept marketing cookies.
- Professional advisers, insurers, the police or courts, where the law requires it or to protect our rights.
We do not sell your personal information.
8. International transfers
Some of these providers process data outside the UK, mainly in the United States and the European Economic Area. We only allow this where UK law permits it: where the UK has adequacy regulations for that country (such as the EEA, or the UK-US Data Bridge for certified US companies), or where the provider has signed the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.
CCTV clips are stored in Germany, which the UK recognises as having adequate data protection. AI tools we use may process information in the United States under the safeguards above.
9. How long we keep it
- Booking, training and payment records: six years after your last course, for tax, legal and DVSA purposes.
- Enquiries that do not lead to a booking: up to two years.
- Marketing preferences: until you opt out, plus a short record of the opt-out so we keep respecting it.
- CCTV: up to 30 days on our recorders and for clips copied off site, unless a clip is saved for a complaint, incident, claim or investigation (see section 6).
- Cookie and pixel data: as set out in our Cookie Policy.
After that, we delete the information or anonymise it so you cannot be identified.
10. Your rights
You have the right to: see the personal information we hold about you; have it corrected; have it erased; restrict or object to how we use it (including stopping marketing at any time); have it moved to another provider; and withdraw consent. Email [email protected] and we will reply within one month (we will tell you if the law allows us to extend this).
11. Complaints
If you are unhappy with how we have handled your information, please tell us first at [email protected]. We will acknowledge your complaint within 30 days and tell you what we are doing about it. You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.
12. Security
Only staff and contractors who need your information can access it, and they must keep it confidential. If a breach is likely to put you at risk, we will tell you and the ICO as the law requires.
13. Children
Our website is not intended for children under 13. Some courses are open to riders from 16; for riders under 18 we collect only what we need to deliver the training.
14. Changes to this policy
We will update this page when our practices change. The date at the top shows the latest version.
