Privacy policy

Last updated: 1 November 2026

Who we are

This website is run by BMS SKILLS ACADEMY LTD (company number 17423255). We are responsible for the personal data described in this policy.

Contact: bmsskillsacademy@gmail.com

What data we collect

• Emails you send us. If you email us, we receive your email address, your name if you include it, and anything you write in your message.
• Delegate accounts. If you are booked onto a course, we create a delegate account for you so you can log in to your course and its forum. See Delegate accounts below.
• Basic server logs. Our hosting provider, Netlify, automatically records basic technical information when you visit the site, such as your IP address, browser type, the pages requested and the date and time.

The enquiry form on this site is not connected yet. It does not send or store anything you type into it. Please email us instead.

Delegate accounts

Accounts are created by us for booked delegates; you cannot sign yourself up. For each account we hold:

• your email address, name and username
• your region (UK or US edition) and which courses you are enrolled on
• anything you post in your course forums
• your password, stored only in hashed (scrambled) form; we cannot see it

• Supabase stores this account data for us in its EU (London) region.
• Resend sends account emails for us, such as your invitation and password reset emails, from its EU region. It receives your email address and the content of those emails.
• Netlify Functions handle logging in, password reset requests and our admin tools, and check you are logged in before showing course pages.

Our lawful basis is contract: we need the account to give you the course you booked. We keep account data for up to 2 years after your course access ends, then delete it, unless we need booking and payment records longer for a legal reason. You can ask us to close your account at any time.

Why we use it and our lawful basis

• To reply to your email and deal with your enquiry. Our lawful basis is legitimate interests (answering people who contact us). If you are asking about booking a course, it is also to take steps at your request before entering into a contract.
• To provide your course through your delegate account. Our lawful basis is contract.
• To run and protect the website. Server logs are used to keep the site working and secure. Our lawful basis is legitimate interests.

We do not sell your data or use it for marketing without your consent.

How long we keep it

• Emails: we keep enquiry emails for up to 2 years from our last contact with you, then delete them, unless we need them longer for a course booking or a legal reason (for example, booking and payment records may be kept for 6 years for tax purposes).
• Delegate accounts: up to 2 years after your course access ends, as described above.
• Server logs: kept by Netlify for a limited period under its own retention policy. We do not keep separate copies.

Who we share it with

• Netlify, which hosts this website and runs its server functions.
• Supabase, which stores delegate account data (EU, London).
• Resend, which sends account emails (EU).
• Google, because our email account is a Gmail account, so emails you send us are stored by Google.

We do not share your data with anyone else unless the law requires it.

International transfers

Netlify, Google, Supabase and Resend may process data outside the UK, including in the United States. Where this happens, we rely on the safeguards these providers offer for transfers of UK personal data, as set out in their own terms (for example, the UK International Data Transfer Addendum or the UK–US data bridge).

Cookies and storage on your device

This website does not use analytics, advertising or tracking cookies. It uses only these essential cookies:

• bmsa_region: remembers whether you chose the UK or US edition of the site, so you are sent to the right pages. It lasts for 1 year.
• bmsa-access-token: set only when you log in to a delegate account. It keeps you logged in and lets the site check you can see your course pages. It expires when your login session ends and is removed when you log out.

To choose the UK or US edition the first time you visit, the site uses the approximate country of your connection, provided by Netlify. This is not stored.

Some features also save information in your own browser (local storage):

• Delegate login: your login session and a copy of your name, username and role, so you stay logged in and the header can show your account. These are removed when you log out.
• Online learning pages: which lessons you have ticked as complete, so your progress is remembered. This stays on your device.
• Fault-finding simulator app: your attempt history, the trainee name you enter on the record sheet, and your sound on/off setting. The app also stores its own files in your browser (a service worker cache) so it works offline. This stays on your device.

You can delete this at any time by clearing your browser's site data. You can also clear your simulator attempt history inside the app.

Your rights

You have the right to:

• ask for a copy of your personal data
• ask us to correct it
• ask us to delete it
• ask us to limit how we use it
• object to how we use it
• ask us to transfer it to you or another organisation, where this applies

To make a request, email bmsskillsacademy@gmail.com. We will reply within one month.

How to complain

If you are unhappy with how we have used your data, please contact us first. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk.

Our ICO registration number: ZC290048.

Changes to this policy

We may update this policy from time to time. We will show the date of the latest update at the top of this page.