Privacy Policy

1. Data Controller

Brackenhill Academy Ltd is the data controller responsible for your personal data. We are registered in England and Wales under Company No. 10583926, with our registered office at 47 Newhall Street, Birmingham B3 3QR, United Kingdom. Our VAT registration number is GB 287 6140 53.

This privacy policy explains how we collect, use, store, and protect your personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It applies to all personal data we process through our website, consultation bookings, course enrolment processes, and related communications.

If you have any questions about this policy or how we handle your data, you can contact our privacy team at privacy@brackenhillacademy.co.uk.

2. Data We Collect

We collect and process the following categories of personal data, depending on how you interact with us:

Information you provide directly

• Full name — so we can address you and identify your account.
• Email address — for consultation confirmations, course materials, and follow-up correspondence.
• Company name — to understand your organisational context and handle employer-sponsored billing where applicable.
• Phone number — to arrange consultation calls and provide support during enrolment.
• Tier interest — your indicated preference for the Essentials, Operations, or Architecture track, which helps us prepare a relevant consultation.
• Challenge description — the free-text field where you describe what prompted you to look into training, used to prepare for your consultation call.
• Meeting preference — your chosen format for the consultation (video call, phone, or in person), so we can schedule appropriately.

Information collected automatically

• Usage data — pages visited, time on page, referral source, browser type, device type, and screen resolution.
• IP address — collected in anonymised form only (last octet removed before storage).
• Cookie identifiers — as described in the Cookies section below.

3. Purpose and Legal Basis for Processing

Under the UK GDPR, we must have a lawful basis for every category of processing. The table below sets out our purposes and the corresponding legal bases.

Where we rely on legitimate interest, we have conducted a balancing test to confirm that our interests do not override your fundamental rights and freedoms. You may request a copy of this assessment by contacting us at the address listed below.

4. How We Use Your Data

When you submit a consultation request, we use the information you provide to prepare for and conduct your call. Your name, email, and phone number are used to schedule the meeting in your preferred format. The tier interest and challenge description allow our consultation team to research your situation beforehand, so the 30-minute call is as useful as possible rather than spent gathering basic details.

If you request the course guide, we use your email address to deliver the document and may send a single follow-up message asking whether you have questions. We do not add guide recipients to an ongoing marketing list without separate, clearly indicated consent.

For enrolled students, we process the data necessary to deliver the course, provide lab access, issue completion credentials, and handle employer-sponsored billing where applicable. We may contact former students about relevant new cohorts or programme updates, but no more than twice per calendar year, and every such message contains a clear unsubscribe mechanism.

We do not sell your personal data to third parties. We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.

5. Third-Party Services

We use a limited number of third-party services to operate our website and understand how visitors interact with it. These services are loaded only after you provide consent through our cookie banner.

Google Analytics

We use Google Analytics to measure website traffic, including pages visited, session duration, referral sources, and device information. IP anonymisation is enabled, meaning the last octet of your IP address is removed before any data is stored or processed. No personally identifiable information is sent to Google Analytics. This service is loaded only after you accept analytics cookies.

Google Ads

We use Google Ads conversion tracking to measure whether visitors who arrive through our advertising campaigns go on to book a consultation or request the course guide. This tracking is limited to aggregate conversion counts and does not build a personal profile of your browsing activity beyond our site. The conversion script is loaded only after you accept marketing cookies.

Both services process data under their own privacy policies. We have configured them to minimise data collection and to respect the consent choices you make on our site.

6. Cookies

Cookies are small text files stored on your device when you visit a website. We group the cookies used on this site into three categories:

You can change your cookie preferences at any time by clearing your browser cookies and revisiting the site, which will display the consent banner again. You can also configure your browser to block or delete cookies, though this may affect site functionality.

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by law. Our standard retention periods are:

• Consultation enquiries — 18 months from the date of submission. If you do not enrol within this period, your data is deleted. This allows time for follow-up if a cohort date did not initially suit you.
• Enrolled student records — 5 years from the date of course completion. This covers credential verification requests from employers and any post-course support queries.
• Analytics data — 14 months. This is the retention period configured in our Google Analytics property. After 14 months, user-level and event-level data is automatically deleted.
• Course guide requests — 12 months from the date of the request. If no further interaction occurs, the email address is removed from our records.

When retention periods expire, data is securely deleted or anonymised so that it can no longer be linked to an identifiable individual.

8. Your Rights Under the UK GDPR

Under the UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data:

• Right of access — You may request a copy of the personal data we hold about you. We will respond within one calendar month.
• Right to rectification — If any data we hold is inaccurate or incomplete, you have the right to ask us to correct or complete it without undue delay.
• Right to erasure — You may request that we delete your personal data where there is no compelling reason for us to continue processing it. This right is not absolute and may be limited where we have a legal obligation to retain data.
• Right to restriction of processing — You may ask us to suspend the processing of your personal data in certain circumstances, for example while we verify its accuracy following a dispute.
• Right to data portability — Where processing is based on consent or contract performance and carried out by automated means, you may request your data in a structured, commonly used, machine-readable format.
• Right to object — You have the right to object to processing based on legitimate interest. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to withdraw consent — Where we process data based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

We will not charge a fee for handling a rights request unless the request is manifestly unfounded or excessive. In such cases, we may charge a reasonable administrative fee or refuse the request, explaining our reasons.

9. How to Exercise Your Rights

To exercise any of the rights listed above, contact our privacy team using one of the following methods:

To protect your privacy, we may ask you to verify your identity before acting on a request. We aim to respond to all legitimate requests within one calendar month. If your request is particularly complex or you have made multiple requests, we may extend this by a further two months, but we will notify you of any extension and explain the reason within the first month.

10. Data Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS (HTTPS is enforced across all pages).
• Access controls that restrict personal data to authorised staff who need it for their role.
• Regular review of our data processing activities and security practices.
• Secure deletion procedures when retention periods expire.

While we implement reasonable safeguards, no method of electronic transmission or storage is entirely secure. We cannot guarantee absolute security, but we are committed to addressing any breach in accordance with our obligations under the UK GDPR. In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and the Information Commissioner's Office without undue delay.

11. Complaints

If you are unhappy with how we have handled your personal data, we encourage you to contact us first so we can attempt to resolve the issue. You can reach our privacy team at privacy@brackenhillacademy.co.uk.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:

12. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices, legal requirements, or the services we offer. When we make material changes, we will update the "Last updated" date at the top of this page. If a change significantly affects how we process your data, we will make reasonable efforts to notify you — for example, by posting a notice on our website or sending an email to addresses in our records.

We encourage you to review this page periodically to stay informed about how we protect your personal data.

13. Contact

For any questions, concerns, or requests related to this privacy policy or your personal data, contact us at: