Privacy Policy

This policy explains how Brightpeak Connect handles your personal data. Brightpeak Connect is the online learning platform operated by Workpays Limited (company number 07387325), Floors 1 and 2, 4 Babington Lane, Derby, DE1 1SU. It serves commercial learners who buy a course themselves. We are the data controller for the personal data described here. We ask for as little as we can: enough to sell you a course, enough to register you with the awarding body so you receive the qualification you paid for, and enough to put your name on a CPD certificate we issue ourselves.

1. The data we collect

Your account. Your name and email address, and a password if you set one. You can sign in with a one-time code instead, in which case we never hold a password at all.

Your enquiry. If you register interest in a course with a practical day, we collect your name, email address, phone number if you give one, your answers to the entry-requirement questions, and anything you write in the message box.

Proof of your qualifications. For courses with entry requirements, the documents you send us — typically a photograph of an ECS Gold Card, a JIB card or a certificate. These are identity documents and we treat them accordingly: see "Keeping your data safe" below.

Your learning. The courses you enrol on, which lessons you have completed, quiz and exam results, practical-day bookings and attendance, and the certificates you earn.

Payments. The amount, the date, and references issued by our payment provider. We never see or store your card number — payment happens on our provider's own pages.

Things you say to us. Messages to the chat assistant on our website. We do not record your voice anywhere on this platform. See section 6.

Technical data. Your IP address, browser and device, and cookie identifiers. Some of this is unavoidable in order to serve you a web page at all; the rest is set only with your consent.

2. Why we use it, and our lawful basis

To provide the course you bought — access, progress, booking your practical day, issuing your certificate. Lawful basis: performance of a contract.

To check you meet the entry requirements. Awarding bodies require this before we can register you, so it is part of delivering the qualification. Lawful basis: performance of a contract, and our legal obligations to the awarding body.

To keep records we are required to keep — financial records, and assessment records the awarding body may audit. Lawful basis: legal obligation.

To run and secure the platform — preventing abuse, rate-limiting, fixing faults, and improving the courses. Lawful basis: legitimate interests.

Marketing, and analytics cookies. Lawful basis: your consent, which you can withdraw at any time and which we ask for before setting anything.

3. Who we share it with

Every company below is a processor acting on our instructions under a written agreement. The list is complete as at the date on this policy — we would rather name a company that only sees your IP address than leave one out. We do not sell your personal data.

Supabase — our database and file storage, and where nearly everything described above is held. Hosted in the European Union (Ireland).

Stripe — payments. They receive your name, email address and billing details, and handle your card directly so that we never do.

Resend — sends our emails. They necessarily see both your address and the contents of the message.

Vercel — hosts the website. They do not store your records, but every request passes through them and their logs contain IP addresses.

Anthropic — provides both the chat assistant on our course pages and "Your Tutor" inside a lesson. They receive what you type to the chat, and, for the tutor, the part of the lesson you asked about together with how you described your own experience and goal when you started the course. In a quick-check they also receive the question and the answer you picked. Your name and email address are never sent, and your data is not used to train their models.

Bunny.net — delivers our course videos and interactive packages. We store no personal data with them. As with any content delivery network, their servers see the IP address of the device requesting a video, which is why they are named here.

Google Analytics — only if you accept analytics cookies. Nothing is sent to Google until you do; see section 8.

Awarding bodies such as City & Guilds and ILM, where you take a regulated qualification. They set, mark and issue that qualification and are separate data controllers for what they hold.

If a course is ever government-funded, data may also be shared with the Education and Skills Funding Agency. No funded courses are offered on this platform today, so nothing is currently shared with them.

4. Where your data is held

Your account, your course records and your documents are held in the European Union (Ireland). The website itself runs in Dublin, in the same country, so your data is not sent elsewhere simply to display a page.

Backups run every day and are kept in the same place, so a backup never moves your data outside the EU.

Course videos are stored in London, in the UK. They contain nothing about you.

Some of the services in section 3 are based in the United States: Stripe, Resend, Anthropic and, only once you allow analytics, Google. Where data reaches them it is protected by the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, or by the UK—US Data Bridge where the provider is certified under it.

5. How long we keep it

Different things for different lengths of time, and none of it for ever by default.

• Access to course materials — 24 months from enrolment, or from your practical day if that is later. This is about content, not records: the regulations change and we would rather not leave you reading a withdrawn edition.
• Your certificate — kept indefinitely. It stays in your portal and stays verifiable, because an employer may check it years later. You can ask us to erase it.
• Your account — kept until you ask us to erase it. We do not close accounts because a course has ended.
• Proof of qualifications — kept for six months after we have checked it, then deleted. Once we have confirmed you meet the entry requirements, the document has done its job.
• Payment and enrolment records — six years from the end of the financial year they fall in, which is what company and tax law requires. In practice that means up to seven years for something bought early in a year, which is why you may see the period written as seven years elsewhere — it is the same rule, rounded up. If you ask to be erased we keep these rows with your name and details removed, so the figures still add up but they are no longer about you.
• Enquiries that did not proceed — 24 months, so that we can tell you when a course you were not yet eligible for becomes suitable. You can opt out at any time.
• Website chat. A record of what was asked and answered is kept for 12 months so we can improve the replies. It is not linked to you or to any account, and anything that looks like an email address or phone number is removed before it is saved.

6. The chat assistant

One feature on this site sends what you write to another company, and we would rather spell that out than bury it in a list.

The chat assistant on our course pages sends your messages to Anthropic, which generates the reply. We keep the conversation so we can improve the answers and see what people are asking.

"Your Tutor" inside a lesson does the same thing for the material in front of you. When you ask it to explain something, we send Anthropic that section of the lesson, the course and lesson name, and the answers you gave on the start screen about how much you already know and why you are taking the course — so the explanation is pitched at you. If you get a quick-check wrong and ask for help, we also send that question and the answer you chose. We do not send your name or your email address, and we do not keep what you asked.

Both are optional. If you would rather not use them, don't — nothing about your course depends on either.

There is no voice feature. An earlier version of this site had a voice tutor that recorded a spoken question. It was removed in September 2026 — the code is deleted, not switched off — and no recording of anyone was ever kept.

7. Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or send it to somebody else. You can object to processing based on our legitimate interests, and you can withdraw consent for marketing or analytics whenever you like.

Email hello@brightpeakconnect.com and we will respond within one month. There is no charge. If you ask to be erased, your account, your documents and your certificate are deleted; the payment and enrolment rows we are legally required to keep remain, with your personal details stripped out.

8. Cookies and analytics

Essential cookies keep you signed in and keep the site secure. These cannot be turned off without breaking the site, and they are not used to track you.

Google Analytics is the only non-essential cookie we set, and it is set only after you press "Allow analytics". Until you do, Google Analytics is not loaded on the page at all — so no cookie exists and no request about your visit reaches Google, not even an anonymous one. If you press "No thanks", nothing is loaded and nothing is sent. You can change your mind at any time using the "Cookie choices" link in the footer.

9. Keeping your data safe

Some specifics, because "appropriate technical and organisational measures" on its own tells you nothing:

• Your qualification documents are held in private storage. They have no public address. Staff open them through a link that is generated on request and expires within minutes.
• The database enforces, at row level, that you can only ever read your own records — so a mistake in our code cannot show your data to another learner.
• Notes staff write about an enrolment are blocked at the database level from ever being read by a learner account.
• Nobody can create an account themselves. Accounts exist only because someone paid or because a member of staff enrolled them.
• The platform is covered by an automated security test suite that is re-run against the live site, including checks that one learner cannot reach another's documents, records or certificates.

10. Under-18 learners

Our courses are intended for learners aged 18 and over, and the entry requirements ask you to confirm this. If that ever changes, this policy will be updated with a named safeguarding contact.

11. Complaints

If you are unhappy with how we handle your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, or by calling 0303 123 1113.

12. Contact

Workpays Limited, Floors 1 and 2, 4 Babington Lane, Derby, DE1 1SU. Telephone 01246 918 340. Email hello@brightpeakconnect.com. Our Data Protection Officer is Ingrid, who is responsible for how your information is handled and is the person to contact if you are unhappy with our answer.

13. Changes to this policy

We may update this policy. When we do, we will post the new version here with an updated date. If the change is significant we will tell enrolled learners by email.