Privacy Policy

Your account. Your name and email address, and a password if you set one. You can sign in with a one-time code instead, in which case we never hold a password at all.

Your enquiry. If you register interest in a course with a practical day, we collect your name, email address, phone number if you give one, your answers to the entry- requirement questions, and anything you write in the message box.

Proof of your qualifications.For courses with entry requirements, the documents you send us — typically a photograph of an ECS Gold Card, a JIB card or a certificate. These are identity documents and we treat them accordingly: see “Keeping your data safe” below.

Your learning. The courses you enrol on, which lessons you have completed, quiz and exam results, practical-day bookings and attendance, and the certificates you earn.

Payments. The amount, the date, and references issued by our payment provider. We never see or store your card number— payment happens on our provider’s own pages.

Things you say to us.Messages to the chat assistant on our website, and — if you use the voice tutor inside a lesson — a recording of your voice, which is transcribed so your question can be answered. See section 6, which covers this specifically.

Technical data. Your IP address, browser and device, and cookie identifiers. Some of this is unavoidable in order to serve you a web page at all; the rest is set only with your consent.

To provide the course you bought— access, progress, booking your practical day, issuing your certificate. Lawful basis: performance of a contract.

To check you meet the entry requirements. Awarding bodies require this before we can register you, so it is part of delivering the qualification. Lawful basis: performance of a contract, and our legal obligations to the awarding body.

To keep records we are required to keep— financial records, and assessment records the awarding body may audit. Lawful basis: legal obligation.

To run and secure the platform— preventing abuse, rate-limiting, fixing faults, and improving the courses. Lawful basis: legitimate interests.

Marketing, and analytics cookies. Lawful basis: your consent, which you can withdraw at any time and which we ask for before setting anything.

Every company below is a processor acting on our instructions under a written agreement. The list is complete as at the date on this policy — we would rather name a company that only sees your IP address than leave one out. We do not sell your personal data.

Supabase— our database and file storage, and where nearly everything described above is held. Hosted in the European Union (Ireland).

Stripe— payments. They receive your name, email address and billing details, and handle your card directly so that we never do.

Resend— sends our emails. They necessarily see both your address and the contents of the message.

Vercel— hosts the website. They do not store your records, but every request passes through them and their logs contain IP addresses.

Anthropic— provides the chat assistant and answers voice-tutor questions. They receive what you type or say to those features. Nothing else about you is sent, and your data is not used to train their models.

ElevenLabs— transcribes voice-tutor recordings and generates the spoken replies. See section 6.

Bunny.net — delivers our course videos and interactive packages. We store no personal data with them. As with any content delivery network, their servers see the IP address of the device requesting a video, which is why they are named here.

Google Analytics— only if you accept analytics cookies. Nothing is sent to Google until you do; see section 8.

Awarding bodiessuch as City & Guilds and LCL Awards, where you take a regulated qualification. They set, mark and issue that qualification and are separate data controllers for what they hold. Legal review Confirm the exact registration data each awarding body requires.

Legal review If a course is ever government-funded, data may also be shared with the Education and Skills Funding Agency. No funded courses are offered on this platform today, so nothing is currently shared with them.

Your account, your course records and your documents are held in the European Union (Ireland).

Some of the services in section 3 are based in the United States: Stripe, Resend, Vercel, Anthropic, ElevenLabs and Google. Where data reaches them it is protected by the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, or by the UK—US Data Bridge where the provider is certified under it. Legal review Confirm the current mechanism for each named provider before publishing.

Different things for different lengths of time, and none of it for ever by default.

• Access to course materials — 24 months from enrolment, or from your practical day if that is later. This is about content, not records: the regulations change and we would rather not leave you reading a withdrawn edition.
• Your certificate — kept indefinitely. It stays in your portal and stays verifiable, because an employer may check it years later. You can ask us to erase it.
• Your account — kept until you ask us to erase it. We do not close accounts because a course has ended.
• Proof of qualifications — kept while you are enrolled and for the awarding body’s audit period afterwards, then deleted. Legal review Confirm the audit period each awarding body requires.
• Payment and enrolment records — six years from the end of the financial year they fall in, which is what company and tax law requires. In practice that means up to seven years for something bought early in a year, which is why you may see the period written as seven years elsewhere — it is the same rule, rounded up. If you ask to be erased we keep these rows with your name and details removed, so the figures still add up but they are no longer about you.
• Enquiries that did not proceed — 24 months, so that we can tell you when a course you were not yet eligible for becomes suitable. You can opt out at any time.
• Voice-tutor recordings — not kept at all. Your recording is passed straight through to be transcribed and is never written to our database or our servers. Neither the recording nor the transcript of what you asked is stored by us. Legal reviewConfirm the retention setting on the transcription provider’s own account.
• Website chat transcripts. Kept so we can improve the answers. Legal review Confirm a period; 12 months is the recommendation.

Two features on this site send what you write or say to another company, and we would rather spell that out than bury it in a list.

The chat assistant on our course pages sends your messages to Anthropic, which generates the reply. We keep the conversation so we can improve the answers and see what people are asking.

The voice tutor inside a lesson records your question when you hold the button, and sends that recording to ElevenLabs to be turned into text. The text then goes to Anthropic to be answered, and the spoken reply is generated by ElevenLabs. Both are in the United States.

We do not keep your recording.It is passed straight through to be turned into text and is never saved to our database or our servers — and we do not store the transcript of what you asked either. Nothing you say to the voice tutor is kept by us at all.

It is optional. The voice tutor only records while you are holding the button, you can use the course entirely without it, and if you would rather not use either feature, don’t — nothing about your course depends on them.

You can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or send it to somebody else. You can object to processing based on our legitimate interests, and you can withdraw consent for marketing or analytics whenever you like.

Email hello@brightpeakconnect.com and we will respond within one month. There is no charge. If you ask to be erased, your account, your documents and your certificate are deleted; the payment and enrolment rows we are legally required to keep remain, with your personal details stripped out.

Essential cookies keep you signed in and keep the site secure. These cannot be turned off without breaking the site, and they are not used to track you.

Google Analytics is the only non-essential cookie we set, and it is set only after you press “Allow analytics”. Until you do, Google Analytics is not loaded on the page at all — so no cookie exists and no request about your visit reaches Google, not even an anonymous one. If you press “No thanks”, nothing is loaded and nothing is sent. You can change your mind at any time using the “Cookie choices” link in the footer.

Some specifics, because “appropriate technical and organisational measures” on its own tells you nothing:

• Your qualification documents are held in private storage. They have no public address. Staff open them through a link that is generated on request and expires within minutes.
• The database enforces, at row level, that you can only ever read your own records — so a mistake in our code cannot show your data to another learner.
• Notes staff write about an enrolment are blocked at the database level from ever being read by a learner account.
• Nobody can create an account themselves. Accounts exist only because someone paid or because a member of staff enrolled them.
• The platform is covered by an automated security test suite that is re-run against the live site, including checks that one learner cannot reach another’s documents, records or certificates.

Legal review Confirm whether learners under 18 are accepted. Several courses have an entry-requirement question asking whether you are 18 or over, which implies they are not, but that needs stating explicitly along with a named safeguarding contact if it changes.

If you are unhappy with how we handle your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk, or by calling 0303 123 1113.

Coniston Peak (WP) Limited, 4 Babington Lane, Derby, DE1 1SU. Telephone 01246 918 340. Email hello@brightpeakconnect.com. Our Data Protection Officer is Ingrid, who is responsible for how your information is handled and is the person to contact if you are unhappy with our answer. Legal reviewConfirm the ICO registration number, and add the DPO’s surname and direct contact address before publishing.

We may update this policy. When we do, we will post the new version here with an updated date. If the change is significant we will tell enrolled learners by email.