Academy privacy notice
BINA PATHWAYS LTD · BP-ACADEMY-PRIVACY-2026-10-31-v2 · Effective 31 October 2026
This notice covers Academy visitors, individual learners, invited staff, employer managers and authorised Bina administrators. It explains the information we use, why, who can see it and your choices. UK GDPR and the Data Protection Act 2018, as amended including applicable Data (Use and Access) Act 2025 provisions, apply. This notice is information, not a request to consent to all processing.
Who is responsible and how to contact us
BINA PATHWAYS LTD (company 16667031), Apartment 02, 101 Silvester Street, Liverpool, L5 8AB, is the controller for Academy accounts, security, payments, learning delivery and its own certificate records. Contact training@binapathways.co.uk, telephone 07400 427281, or write to the address above. Address privacy questions to the directors; we do not claim an appointed statutory Data Protection Officer or ICO approval.
An employer is separately responsible for deciding which training to assign, its reasons for monitoring staff and its employment decisions. It must provide its own worker notice. Where Bina processes information only on an employer's documented instructions, the parties must have appropriate processor terms; an employer purchase alone does not settle every controller/processor role. Recruitment, staffing, payroll, client and applicant records have additional purposes and notices on our company privacy page. An Academy account does not give an employer access to those systems.
Information we collect and its source
- From you: name, email, account type, organisation, role/worker number where applicable, password hash, support messages, course choices, learning responses, feedback and privacy requests. If you choose external training-document verification, the Academy converts the date of birth you enter into a keyed one-way match value and does not keep the readable date.
- From learning activity: progress, lesson position, checkpoints and drafts, assessment responses/results, attempts, course version, certificate and renewal records, and completion evidence for required media. We do not record your camera, microphone or screen.
- From employers or authorised Bina staff: invitation email, organisation membership, assigned course/cycle, due dates and relevant practical sign-off. The invitation and join screen identify the organisation.
- From the service and payment provider: order value, acceptance and supply choices (including the verification notice acknowledgement), payment references/status, security/session records and provider technical logs. Card and bank credentials are entered at Stripe's hosted checkout, not stored in Academy learning records.
- From a document verifier: their declared name, organisation, purpose, attestation, match result, document code, date and time. Verifier details are self-declared and are not represented as independently authenticated.
Our purposes and lawful bases
| Purpose | Basis and reason |
|---|---|
| Individual registration, purchased learning, support and certificates | Contract or steps requested before contract, where necessary to provide the service to you. |
| Employer invitations, staff learning and relevant reporting | Legitimate interests in providing and evidencing workforce training, with access limited to relevant organisation/course/cycle. The employer's contract is not treated as a contract with every employee. |
| Optional external verification of a matrix or certificate | The learner’s separate, specific choice where consent is appropriate because verification can be refused or switched off without losing learning. An employer purchase acknowledgement is not consent on a learner’s behalf. Legitimate interests support proportionate fraud prevention, rate limiting and the staff-visible history of checks. |
| Account security, abuse prevention, access logs, record integrity and proportionate assessment marking | Legitimate interests in protecting learners and the service, balanced against individual rights. |
| Accounting, legally required records, legal requests and applicable data rights | Legal obligation where applicable. Legitimate interests for necessary dispute handling and defending legal claims. |
| Optional external video loading or future optional marketing | Separate, specific choices where consent is required. No marketing consent is bundled with account registration or payment. This release does not add a marketing mailing list. |
Required account and payment information is needed to provide the service. If it is not supplied, the relevant account, course access or purchase may not be available. Optional feedback and external video loading are choices; written teaching remains available. You may object to processing based on legitimate interests. We assess objections and explain any compelling lawful reason to continue.
Who can see your information
You can see your own learning. Employer managers can see only relevant assigned staff learning in their organisation, including progress, checkpoint submissions for the assigned course and cycle, results and required practical sign-off. They cannot use the employer dashboard to see unrelated private purchases or another organisation's records. Authorised Bina administrators have access needed for support, administration, compliance and resolving requests, with sensitive reporting actions recorded.
We use Namecheap hosting/email services and Stripe payment services. They receive information necessary to deliver their services; Stripe may also act as an independent controller for its fraud, payment and regulatory purposes. See Namecheap privacy information and Stripe privacy information. Professional advisers, regulators and lawful authorities receive information only when necessary and lawful. We do not sell Academy personal information.
A QR code or verification link does not reveal a learner’s details by itself. The verifier must enter the date of birth supplied by the learner, declare their name, organisation and purpose, and confirm that the learner provided the document and date of birth. Only a successful private match reveals the limited matrix or certificate details. The readable date of birth is never displayed or stored in verification history. Staff can see successful and unsuccessful attempts; authorised employer managers see attempts associated with their organisation, and authorised Bina administrators can review relevant audit history. Treat a document and date of birth as confidential. Contact us about an incorrect record or inappropriate disclosure; verification does not disclose course answers or payment details.
International processing
Do not assume all information stays in the UK. Namecheap is a US-based provider; its hosting, support and email operations may involve the United States and other service locations. Stripe and external video providers operate internationally. A restricted transfer must be covered by applicable UK adequacy regulations or a valid safeguard such as the UK IDTA/Addendum with the required transfer assessment, or a strictly applicable exception. Contact us for the countries relevant to your data and a copy or explanation of the applicable safeguards, subject to necessary redaction. We do not describe provider terms alone as proof that every transfer has been assessed.
Retention and deletion
We retain only what is needed for the stated purpose, considering active access, verification needs, legal obligations and disputes. These are review rules, not claims that all records are automatically erased on a fixed day.
| Record | Retention/review rule |
|---|---|
| Active account, learning progress and certificates | During access and while needed for account support or verification. Review inactive accounts after 24 months; review learning/certificate records when the relevant course access and verification need end. Retention beyond six years after the relevant licence ends needs a recorded continuing reason or legal hold. |
| Orders, terms acceptance, financial/dispute evidence | Normally six years after the relevant transaction/accounting period or resolution, with any required longer period recorded. No full payment credentials are held by the Academy. |
| Support and closed privacy requests | Review two years after closure; retain longer only where necessary to evidence rights handling or an unresolved dispute. |
| Authentication | Academy sessions expire after eight hours; verification links after 24 hours; password-reset links after one hour. Expiry prevents use; expiry is not a claim of immediate database erasure. |
| Date-of-birth match and verification history | The protected match value is kept only while the learner leaves external verification enabled and is deleted when they switch it off. Verification history is reviewed with the related learning record and normally no later than six years after the check unless a shorter period or continuing legal reason applies. It does not contain the readable date of birth. |
| Security/audit logs, employer invitations and backups | Review against the security, audit, invitation or recovery purpose. Expired invitations do not authorise access. Backups are restricted and records approved for erasure must not be reintroduced into active use on restoration. Ask us for the applicable provider log/backup schedule. |
Erasure is not automatic on course expiry or leaving an employer. We assess and explain any record we must retain. We must not falsify an earned result or certificate to remove an account. Contact us to ask about a particular record.
Your rights and complaints
Depending on the circumstances, you can request access, correction, erasure, restriction, portability and object to processing. Withdraw optional consent as easily as you gave it; this does not undo earlier lawful use. Use the privacy centre, email, phone or post. You do not have to use a particular form or pay a routine fee. We take proportionate steps to verify identity and protect other people's information. We normally respond without undue delay and within one calendar month; we explain any lawful extension or restriction.
The account download is a convenient Academy snapshot, not a substitute for a full subject access request. A full request may include relevant correspondence and information requiring third-party review. If you are unhappy, contact the directors. You can complain to the Information Commissioner's Office without first giving up any other remedy.
Assessments, sensitive information and security
Automated marking checks course answers against the assessment rules and controls learning progression. It does not decide recruitment, pay, clinical authorisation or regulatory fitness. You can challenge a result and ask for human review. Online theory does not establish workplace competence.
Do not enter identifiable patient, child, pupil or service-user information, medical records, bank details or passwords in free-text answers, feedback or requests. Course scenarios should use non-identifying details. If an adjustment requires health information, contact us first for a suitable secure route; a separate Article 9 condition and, where required, Data Protection Act condition must be identified before collecting it. We do not use ordinary terms acceptance as health-data consent.
We use HTTPS, protected sessions, role and organisation checks, authenticated learning files, keyed one-way date-of-birth matching, failed-attempt rate limits and restricted administrative access. These controls reduce risk; no service can promise absolute security. Report a suspected disclosure promptly to training@binapathways.co.uk. We assess incidents and notify the ICO and affected people when the law requires.
Cookies, media and changes
Read the cookie and external-media notice. External players are withheld until you choose to load them; a written alternative remains available. This release adds no advertising or analytics trackers. We update this notice when purposes or handling materially change and provide relevant information before a new use. Previous terms accepted for an order remain associated with that order.