In line with the 25th May 2018 implementation date we would like reassure our customers of our full compliance with the new General Data Protection Regulation (GDPR) legislation.
The introduction of this legislation represents the most significant change to data protection policy since the Data Protection Act was updated in 1998, and all companies that process personal and / or sensitive data are required to comply.
Please read this policy carefully, as it contains important information about what information we collect, how and why we do so, how we process and protect this data after collection, your rights in relation to your personal data and how to contact us and / or the appropriate external authorities in the event that you wish to report a concern about the way in which we process your data.
What data do we collect?
Under the terms of the GDPR, B-Academy is considered the “controller” of data that individuals or companies provide us.
Through our day-to-day business interactions with customers we may, where applicable, collect and process the following personal and / or sensitive data:
Your data of birth
Your specific learning requirements
Your contact details (phone numbers, postal address(es) and email address(es)
Your personal or company credit card / billing information
Your personal or company account information (PT mentor and Talent Scout only)
How do we collect this data?
Data is either sent directly to us via means such as email and online services (e.g. learner enrolment forms, course payments)
It is important for individuals undertaking Active IQ qualifications to know that certain elements of their personal data (e.g. name, date of birth, postcode and email address) will typically need to be shared by B-Academy, the training provider, with Active IQ, the awarding body, in order for us to deliver the relevant service. Typically registering you for a course. Wherever we share personal information, the person whose information we are collecting (the “data subject”), it is our responsibility to ensure that the data subject is fully aware that their information will be shared and has provided their consent for this to happen prior to their information being shared. Typically this will happen during the sign-up process where you will be asked to confirm your agreement and understanding to B-Academy’s terms and conditions and policies and procedures before proceeding.
We will also use Mail chimp as our online marketing platform and will share basic information such as name and email address to send out relevant communications. Where you have opted into marketing communications, please note that you can update your preferences or unsubscribe at any time. To unsubscribe from any of these communications simply click the ‘unsubscribe’ icon at the end of each email.
Why do we collect this data and how do we use it?
We collect data in order to fulfil a variety of obligations, and we ensure that those sharing data with us are aware of what information is mandatory and what is optional in order for us to fulfil those different obligations.
Under the terms of the GDPR, we collect and process this data on one or more of the following bases:
Consent: for example, when you provide us with your email address and formally opt-in to receive marketing communications from us
Contractual obligations: for example, in order to deliver contracted products and services to centres and / or individuals, we may use an individual’s personal information to contact them directly
Legitimate interests: for example, in order to assist with complaints or appeals or to optimise your website experience
Legal obligations: for example, to assist us and / or law enforcement agencies with fraud investigations
Who do we share your data with
We take all reasonable steps to ensure that personal data is suitably protected and can only be accessed and processed by those with a legitimate reason to do so. Aside from the applicable B-Academy staff, personal data may be shared with the following third parties:
Our partners (specifically, any Awarding Organisations with whom we offer joint or collaborative services)
A specific Marketing Platform company to enable communication of our products and services.
Law enforcement agencies, in the event that we are required to assist with legal proceedings
How do we protect your data?
We use a combination of organisational and technical methods to protect your data from unauthorised access and / or accidental loss. Where we use third parties to process personal information, we also require them to adhere to the same levels of security and protection.
Any personal information that you voluntarily post via public platforms (for example, in relation to B-Academy on social media) may become accessible to others. We cannot be held responsible for any personal information you have shared in this way, so you are advised to exercise caution when deciding when and where to share your information.
How long do we keep your data for?
We retain data for as long as is required to fulfil our on going regulatory, quality assurance and / or legal obligations. For example, learner and achievement data will be retained beyond the end of a contract between the awarding body and us in case it should be required during regulatory audits, complaint handling, appeals and / or legal proceedings.
Please refer to the next section of this Policy and the ‘How to contact us’ section if you feel that we are retaining your data for longer than necessary and wish to exercise your “Right to erasure”.
What rights do you have?
The GDPR outlines various rights that a data subject has with regard to their personal data.
Please see a summary below:
The “Right to be informed”: individuals must be made aware of how and why their
personal data is collected. In providing the Policy, Active IQ meets this requirement
The “Right of access”: individuals can request access to copies of their personal data in
order to verify that it is being processed in a lawful and correct way
The “Right to rectification”: individuals can request that inaccurate personal data is
corrected (or completed if it is incomplete)
The “Right to erasure”: under certain circumstances, an individual can request that their
personal data is deleted (e.g. if they wish to unsubscribe from receiving marketing communications and also have their contact details completely deleted from our systems. This would be possible provided there was no legitimate ongoing reason for us to retain their details)
The “Right to restrict process”: under certain circumstances an individual can request the suppression of their personal data (e.g. allowing us to continue holding their data, but pausing all processing of that data whilst they seek to verify that it is accurate and / or being processed lawfully)
The “Right to portability”: under certain circumstances, an individual can request that their personal data is electronically transferred from us to another data controller
The “Right to object”: under certain circumstances, an individual can object to the way in which their data is being processed (for example, if they believe that we do not have legitimate grounds for collecting and processing certain information about them). If the objection is upheld, we are required to stop processing that information
If you wish to exercise any of these rights or raise a data protection issue with us, please find the appropriate contact details below.
How to contact us
If you have any queries or concerns about this Policy or wish to exercise your rights, please email us at
Please note that your communication is addressed to Boffit Limited our Parent Company, as all data protection matters are handled by a centrally employed data protection lead (with assistance from the relevant business unit, as required).
How to lodge a complaint
If you believe that your data protection rights may have been breached, you can lodge a formal complaint by contacting us as described above. If you are unhappy with our response, please visit to access more information about how to escalate your complaint to the Information Commissioner (if you are in the UK) or to your local data protection supervisory authority.
Changes to this Policy
We may update this Policy from time to time, and when doing so we will include a new
version number and date so that you can be sure when that version was introduced. Where we believe changes to the Policy are materially significant, we will notify customers of the changes by email.