Privacy Policy Brightlink Learning
1 Introduction
1.1 Brightlink Learning Ltd is committed to safeguarding the privacy and security of the personal information of our website visitors, learners, prospective learners, clients, employers, partners and other service users.
1.2 This policy applies where we are acting as a data controller in relation to personal data, in other words where we determine the purposes and means of processing that personal data.
1.3 This policy applies to personal data collected through our websites, learning platforms, forms, communications and services, and to personal data provided to us by employers, apprenticeship and education partners, awarding organisations, funding bodies and other organisations where relevant to the services we provide.
1.4 We process personal data in accordance with the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”), and those laws as amended, including by the Data (Use and Access) Act 2025.
1.5 We use cookies and similar storage and access technologies on our websites. Where consent is required by law, we will ask for consent before using them. Some technologies may be used without consent where a statutory exception applies. Further information is set out in Sections 11 to 13 below.
1.6 In this policy, “we”, “us” and “our” refer to Brightlink Learning Ltd.
2 How we use your personal data
2.1 In this Section 2 we have set out:
(a) the general categories of personal data that we may process;
(b) where relevant, the source of personal data that we did not obtain directly from you;
(c) the purposes for which we may process personal data; and
(d) the legal bases on which we rely.
2.2 We may process data about your use of our websites, learning platforms and services (“usage data”). Usage data may include your IP address, approximate geographical location, browser type and version, operating system, referral source, pages viewed, navigation paths, dates and times of access and information about the timing, frequency and pattern of your use of our services.
Usage data may be processed for the purposes of operating and securing our websites and services, understanding how they are used, identifying problems and improving our services. The legal basis for this processing is our legitimate interests, namely the proper administration, security and improvement of our websites, learning services and business. Where PECR requires consent to the technology used to obtain this data, we will obtain that consent.
2.3 We may process your account data (“account data”). Account data may include your name, address, email address, telephone number, employer, employment details, learner or account number and other information required to create and administer your account.
The source of account data will usually be you. It may also be supplied by your employer, an apprenticeship partner, a referring organisation or another organisation responsible for arranging or funding your learning.
Account data may be processed for the purposes of registering you for our services, operating our websites and learning platforms, providing learning and support, communicating with you, maintaining records, providing information to relevant awarding, accrediting or funding organisations and, where your employer is funding or supporting your programme, providing appropriate information about your participation and progress.
The legal bases for this processing may include the performance of a contract between you and us, taking steps at your request before entering into a contract, compliance with legal obligations and our legitimate interests in administering and delivering our services.
2.4 We may process information contained in your learner or user profile (“profile data”). Profile data may include your name, contact information, photograph, educational history, employment information, qualifications, learning requirements and other information relevant to your programme.
Profile data may be processed for the purposes of providing, personalising and monitoring our services, supporting your learning, maintaining appropriate records and meeting qualification, accreditation, funding or regulatory requirements.
The legal bases for this processing may include the performance of our contract with you, compliance with our legal obligations and our legitimate interests in the effective provision and administration of education and training.
2.5 We may process information relating to your participation in our services (“service data”). This may include enrolment records, attendance, workshop participation, learning activity, assessments, examination information, tutor records, review records, progress information, feedback, support provided to you and communications relating to your programme.
The source of service data may be you, our staff or tutors, your employer, an awarding organisation, assessment organisation, apprenticeship or funding partner or another organisation involved in your programme.
Service data may be processed for the purposes of providing education and training, monitoring participation and progress, providing learner support, meeting apprenticeship, qualification, accreditation and quality requirements, confirming eligibility, arranging assessments and examinations, and communicating with relevant organisations involved in your programme.
The legal bases for this processing may include the performance of our contract with you, compliance with legal obligations and our legitimate interests in delivering, monitoring and improving our services.
2.6 Where an employer pays for, sponsors or is otherwise involved in your programme, we may process and share information necessary to manage that relationship. This may include attendance, participation, progress, planned learning activity, review information and other information reasonably required to support the programme.
We will not routinely provide employers with information that is unrelated to their legitimate involvement in your programme.
The legal bases for this processing may include performance of a contract, compliance with apprenticeship or funding requirements and our legitimate interests in the proper delivery and management of employer-sponsored training.
2.7 We may process information that you provide in connection with an enquiry about our courses or services (“enquiry data”). Enquiry data may include your name, contact details, employment or educational information, course interests and the content of your enquiry.
Enquiry data may be processed for the purposes of responding to your enquiry, providing information and advice about our services, discussing your options and taking steps at your request before entering into a contract.
The legal bases for this processing are our legitimate interests in responding to enquiries and developing our services and, where applicable, taking steps at your request before entering into a contract.
2.8 We may process information relating to our relationships with employers, organisations, professional contacts, partners and clients (“relationship data”). This may include names, job titles, employer or organisation details, business contact information and records of communications and meetings.
The source of relationship data may be you, your organisation, publicly available professional or business information, professional registers, events, referrals or organisations with which we work.
Relationship data may be processed for the purposes of managing professional and commercial relationships, delivering our services, maintaining records, identifying organisations that may benefit from our services and communicating about relevant services and opportunities.
The legal basis for this processing is normally our legitimate interests in managing and developing our business and professional relationships. Any direct marketing will also be carried out in accordance with PECR where it applies.
2.9 We may process information relating to transactions entered into with us (“transaction data”). Transaction data may include your contact details, details of the service purchased, payment and billing information and information concerning refunds or other financial transactions.
We do not normally retain full payment card details ourselves where payment is processed by a third-party payment service.
Transaction data may be processed for the purposes of supplying services, administering payments and refunds, maintaining financial records, dealing with queries and meeting accounting and taxation requirements.
The legal bases for this processing are the performance of a contract, compliance with legal obligations and our legitimate interests in the proper administration of our business.
2.10 We may process information contained in or relating to communications that you send to us (“correspondence data”). This may include the content of the communication, contact details and associated metadata.
Correspondence data may be processed for the purposes of communicating with you, providing support, dealing with enquiries, maintaining records, resolving concerns and administering our services.
The legal bases for this processing may include performance of a contract, compliance with legal obligations and our legitimate interests in the proper administration of our business and communications.
2.11 We may process personal data for the purposes of providing information about Brightlink courses, events, services and other opportunities that we believe may be relevant to you (“marketing data”).
Marketing data may be collected directly from you, through our existing relationship with you or your organisation, from publicly available professional or business sources or, where lawful, through another source.
Where electronic marketing is sent to individuals, we will obtain consent where PECR requires us to do so unless an applicable exemption or “soft opt-in” permits the communication. Where we communicate with corporate subscribers or other business contacts in circumstances in which PECR does not require consent, our legal basis for processing personal data will normally be our legitimate interests in promoting our services.
Every electronic marketing communication will provide a straightforward method of opting out where required. You may ask us to stop using your personal data for direct marketing at any time.
2.12 We may process information that you choose to provide for publication, including testimonials, reviews, articles, contributions, photographs or other material (“publication data”).
Publication data may be processed for the purposes for which it was provided, including publication on our websites, learning platforms, social media, course materials or other Brightlink communications.
Depending on the circumstances, the legal basis may be your consent, performance of an agreement with you or our legitimate interests. Where we rely on consent, you may withdraw that consent subject to any lawful use already made of the material.
2.13 We may process information relating to complaints, concerns, academic matters, safeguarding matters, appeals or disputes (“case data”). This may include communications, witness information, evidence, meeting notes, investigation records and decisions.
Case data may be processed for the purposes of investigating and resolving matters, protecting individuals, meeting our legal, contractual, regulatory and safeguarding responsibilities, maintaining appropriate records and establishing, exercising or defending legal claims.
The legal bases for this processing may include legal obligation, legitimate interests, vital interests and the establishment, exercise or defence of legal claims. Where special category or criminal offence data is involved, we will also identify an appropriate additional condition under data protection law.
2.14 We may process personal data where necessary for the establishment, exercise or defence of legal claims, whether in court proceedings, regulatory proceedings, complaints, investigations or an administrative or out-of-court procedure.
The legal basis for this processing is our legitimate interests in protecting and asserting our legal rights and the legal rights of others.
2.15 We may process personal data where necessary for obtaining or maintaining insurance cover, managing risk or obtaining professional advice.
The legal basis for this processing is our legitimate interests in the proper protection and administration of our organisation.
2.16 We may also process personal data where necessary to comply with a legal obligation, to protect your vital interests or those of another person, or where another lawful basis applies.
2.17 Where personal data has been obtained from someone other than you, the source may include your employer, apprenticeship provider, funding organisation, awarding or assessment organisation, educational institution, professional body, referral partner or another organisation involved in arranging or providing your training or qualification. It may also include publicly available business or professional sources where we have a lawful reason to use that information.
2.18 Please do not provide personal data about another person unless you are authorised to do so or we have asked you to provide it.
3 Special category and criminal offence data
3.1 Some personal data is afforded additional protection under data protection law. This includes information about health or disability, racial or ethnic origin, religious or philosophical beliefs, trade union membership, genetic or biometric information used for identification, sex life and sexual orientation.
3.2 In the course of providing education, training and learner support, we may need to process special category information. For example, we may process information about health, disability or learning needs in order to provide appropriate support or reasonable adjustments, and equality information where this is required or appropriate for monitoring or reporting.
3.3 We may also process sensitive information where it arises in connection with safeguarding, complaints, disciplinary matters, legal claims, regulatory requirements or the protection of an individual.
3.4 We will only process special category information where we have both a lawful basis under Article 6 of the UK GDPR and an additional lawful condition for processing special category data under Article 9 of the UK GDPR and the Data Protection Act 2018.
3.5 Depending on the circumstances, this additional condition may include explicit consent, substantial public interest, the establishment, exercise or defence of legal claims, protection of vital interests or another condition permitted by law.
3.6 We may process information concerning criminal convictions or offences where it is necessary and lawful for us to do so, including where required for safeguarding, legal, regulatory or professional purposes. We will only process such information where an appropriate condition under the Data Protection Act 2018 applies and will maintain an appropriate policy document where the law requires one.
4 Providing your personal data to others
4.1 We may disclose personal data to insurers, legal advisers, accountants, auditors and other professional advisers where reasonably necessary for obtaining or maintaining insurance, managing risks, obtaining advice, meeting professional obligations or establishing, exercising or defending legal claims.
4.2 We may provide personal data to organisations involved in the delivery, administration, funding, assessment, regulation or quality assurance of our services where this is necessary.
Depending upon the programme and service concerned, these organisations may include:
(a) awarding, assessment, professional and regulatory organisations, including CILEX and other bodies relevant to the qualification or programme being undertaken;
(b) apprenticeship partners and prime providers, including Itec Skills where relevant;
(c) the Welsh Government, Department for Education and other apprenticeship or education funding and oversight organisations;
(d) Estyn, Ofsted and other inspection, quality assurance or regulatory organisations where applicable;
(e) employers funding, supporting or participating in a learner’s programme;
(f) organisations delivering part of a programme or service in partnership with us where this applies; and
(g) examination, assessment and associated service providers.
4.3 Some of the organisations described above will process personal data as independent data controllers and will be responsible for their own use of personal data. Where applicable, their own privacy notices will explain that processing.
4.4 We use third-party organisations to support our websites, learning systems, communications and administration. These may include website and learning platform hosting providers, IT support providers, communications providers, scheduling systems, survey and assessment tools, email distribution services, video conferencing services, accounting services and other technology suppliers.
Providers currently or recently used by Brightlink in connection with relevant services include organisations such as Penguin Internet, WordPress, Zoom, Mailchimp, ScoreApp, Picktime and other specialist service providers. The particular providers used may change from time to time as our systems and services develop.
4.5 Where a third party processes personal data on our behalf as a data processor, we require it to process that personal data only for agreed purposes, to maintain appropriate security and confidentiality and to comply with applicable data protection requirements.
4.6 Financial transactions relating to our websites and services may be processed by payment and banking providers such as Barclays, PayPal, WooCommerce or other payment processors used by us from time to time.
We will disclose transaction information only to the extent reasonably necessary for processing payments, refunds, financial administration and related queries or legal requirements.
4.7 We may disclose personal data to HM Revenue & Customs, government departments, regulators, law enforcement bodies, courts or other public authorities where we are legally required or permitted to do so.
4.8 We may disclose personal data where it is necessary to protect the vital interests of an individual, for safeguarding purposes, for the prevention or investigation of crime, or for the establishment, exercise or defence of legal claims.
4.9 We may disclose personal data to another organisation in connection with a proposed or actual sale, merger, restructuring, transfer or reorganisation of all or part of our business, provided that appropriate arrangements are made to protect the information concerned.
4.10 We do not sell personal data.
5 International transfers of your personal data
5.1 Brightlink Learning is established in the United Kingdom and our principal operations are carried out in the United Kingdom.
5.2 Some of the service providers that we use may process or store personal data outside the United Kingdom, or may use infrastructure or sub-processors based outside the United Kingdom.
5.3 Where a transfer of personal data outside the United Kingdom is a restricted transfer under UK data protection law, we will ensure that an appropriate lawful transfer mechanism is in place.
5.4 Depending on the country and circumstances, this may include:
(a) UK adequacy regulations;
(b) the UK International Data Transfer Agreement;
(c) the UK Addendum to approved EU Standard Contractual Clauses;
(d) another appropriate safeguard permitted by UK data protection law; or
(e) an applicable statutory exception where permitted.
5.5 Where required, we will also undertake the appropriate assessment of the protection available for personal data following an international transfer.
5.6 You may contact us if you would like further information about the safeguards applied to a particular international transfer of your personal data.
6 Retaining and deleting personal data
6.1 We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including to meet legal, regulatory, accreditation, funding, accounting and reporting requirements.
6.2 The appropriate retention period will depend upon the nature of the information and the reason for which it is held.
6.3 Learner and programme records will be retained for the period required by the relevant qualification, awarding, accrediting, apprenticeship or funding requirements. Where no longer period is required, learner personal data will ordinarily be retained for three years following completion or withdrawal from a course of study.
6.4 Financial, transaction, invoicing and payment information will normally be retained for six years, or for any longer period required by law.
6.5 Records relating to complaints, safeguarding matters, legal claims, regulatory matters or other cases may be retained for longer where this is necessary having regard to the nature of the matter, applicable legal limitation periods, safeguarding requirements and any regulatory, contractual or insurance requirements.
6.6 Marketing information will be retained for as long as we have an appropriate reason to communicate with you. If you object to direct marketing or unsubscribe, we may retain limited information on a suppression list so that we can respect your preference and avoid contacting you again for that purpose.
6.7 Where we cannot specify a fixed retention period in advance, we will determine the period by reference to relevant legal requirements, contractual requirements, the nature and sensitivity of the information, the purposes of the processing and the risks associated with continued retention.
6.8 We may retain personal data for longer where retention is necessary to comply with a legal obligation or for the establishment, exercise or defence of legal claims.
6.9 In some circumstances, we may anonymise information so that it can no longer be associated with an identifiable individual. Information that has been effectively anonymised is no longer personal data and may be retained and used for statistical, research, reporting or service development purposes.
7 Data security
7.1 We take appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
7.2 Access to personal data is limited to employees, contractors, tutors, service providers and other persons who have an appropriate business need to access it.
7.3 Anyone processing personal data on our behalf is expected to maintain appropriate confidentiality and security.
7.4 We keep our security arrangements under review, taking account of the nature of the personal data that we hold, the risks associated with processing and developments in available security measures.
7.5 We maintain procedures for dealing with suspected personal data breaches and will notify affected individuals and the Information Commissioner where the law requires us to do so.
8 Your rights
8.1 Data protection law gives individuals a number of rights. The rights available in a particular situation may depend upon the purposes for which we process information and the lawful basis on which we rely.
8.2 Your principal rights include:
(a) the right of access;
(b) the right to rectification;
(c) the right to erasure;
(d) the right to restrict processing;
(e) the right to object to processing;
(f) the right to data portability, where applicable;
(g) rights relating to automated decision-making, where applicable;
(h) the right to withdraw consent where processing is based on consent; and
(i) the right to complain about the way in which your personal data is handled.
8.3 You have the right to ask whether we process personal data about you and, where we do, to request access to that information together with the supplementary information required by law. This is commonly known as a subject access request.
8.4 When responding to a subject access request, we are required to make a reasonable and proportionate search for the personal data within the scope of the request. Some information may be withheld or redacted where an exemption or the rights of another person apply.
8.5 You have the right to have inaccurate personal data corrected and, taking account of the purposes of processing, to have incomplete information completed.
8.6 In some circumstances, you have the right to request erasure of your personal data. This right is not absolute. For example, we may continue to retain information where this is necessary to comply with a legal obligation or to establish, exercise or defend legal claims.
8.7 In some circumstances, you have the right to request restriction of the processing of your personal data.
8.8 Where we rely upon legitimate interests as the lawful basis for processing, you may have the right to object on grounds relating to your particular situation. We will stop the relevant processing unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms or the processing is necessary for legal claims.
8.9 You have an absolute right to object to the processing of your personal data for direct marketing purposes. If you ask us to stop direct marketing, we will do so.
8.10 Where processing is based on consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing that took place before consent was withdrawn.
8.11 Where the conditions for data portability apply, you may have the right to receive personal data that you have provided to us in a structured, commonly used and machine-readable format or to ask for it to be transmitted to another controller where technically feasible.
8.12 Rights requests may be made verbally or in writing. For clarity and to help us respond efficiently, you may contact us at connect@brightlink.org.uk.
8.13 We may ask you for information reasonably necessary to confirm your identity. We will not request more identification than is appropriate in the circumstances.
8.14 We will respond to rights requests without undue delay and normally within one calendar month. Where permitted by law, the time period may be extended for complex or multiple requests. The applicable time period may also be affected where we reasonably require identification, clarification or other information from you in order to deal with the request.
8.15 We do not normally charge a fee for exercising your rights. A reasonable fee may be charged, or a request may be refused, where permitted by law, including where a request is manifestly unfounded or excessive.
9 Data protection complaints
9.1 If you are concerned about the way in which we have collected, used, disclosed, retained or otherwise handled your personal data, you have the right to make a data protection complaint to us.
9.2 You may make a data protection complaint by contacting us at:
or by writing to:
Data Protection Officer
Brightlink Learning Ltd
53 Ridgeway Road
Rumney
Cardiff
CF3 4AB
9.3 You do not have to use any particular wording or form when making a data protection complaint. It will help us investigate if you explain what has happened, the personal data concerned, what you believe has gone wrong and, where appropriate, what outcome you are seeking.
9.4 We will acknowledge a data protection complaint within 30 days of receiving it.
9.5 We will take appropriate steps to investigate the complaint, keep you informed of progress where appropriate and provide you with the outcome without undue delay.
9.6 We may ask for further information where reasonably necessary to investigate a complaint. We may also ask for appropriate evidence of identity or authority where a complaint is made on behalf of another person.
9.7 You also have the right to raise a concern with the Information Commissioner’s Office (“ICO”), the United Kingdom supervisory authority for data protection.
The ICO can be contacted at:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk
9.8 We would welcome the opportunity to address any concern directly and would encourage you to contact us first where appropriate, although this does not affect your right to contact the ICO.
10 Automated decision-making
10.1 Automated decision-making means a decision made using automated processing without meaningful human involvement.
10.2 Brightlink does not currently make decisions about admission, assessment, learner progression, learner support, disciplinary matters or access to our services solely by automated processing where the decision would have a legal or similarly significant effect on an individual.
10.3 We may use technology to support administrative tasks, analysis or the organisation of information, but responsibility for significant decisions remains with appropriate people.
10.4 If we introduce solely automated processing that results in significant decisions about individuals, we will comply with the requirements of data protection law, including providing required information and appropriate safeguards.
10.5 Where the law requires safeguards in relation to a significant automated decision, these may include the ability to make representations, obtain meaningful human intervention, contest the decision and obtain appropriate information about the decision.
11 About cookies and storage and access technologies
11.1 A cookie is a small file placed on a device when a website is accessed. Cookies and other storage and access technologies can perform a variety of functions, including remembering information, maintaining sessions, providing website functionality and understanding how a service is used.
11.2 Cookies may be “persistent” cookies, which remain on a device until their expiry date or until deleted, or “session” cookies, which normally expire when the browser is closed.
11.3 Cookies and similar technologies do not always contain information that directly identifies a person, but information obtained through them may constitute personal data or may be linked with other information that we hold.
11.4 We will obtain consent before storing or accessing information on your device where consent is required by PECR.
11.5 The law allows certain storage and access technologies to be used without consent where the applicable statutory conditions are met. These include technologies used:
(a) solely to transmit a communication;
(b) where strictly necessary to provide an online service requested by you;
(c) solely to collect statistical information about the use of a service or website for the purpose of improving it, where the statutory requirements are satisfied;
(d) solely to adapt the appearance or functionality of a service in accordance with a user’s preferences, where the statutory requirements are satisfied; and
(e) in certain circumstances relating to emergency assistance.
11.6 Where we rely upon an exception for statistical purposes or website appearance or functionality, we will provide clear information about the use concerned and a simple and free means of objecting where required by law.
11.7 Where a technology is used for advertising, profiling or another purpose for which an exception does not apply, we will obtain any consent required by law before it is used.
12 Cookies and technologies that we use
12.1 We use or may use cookies and similar technologies for the following purposes:
(a) authentication – to recognise login sessions and support secure access to our website or learning services;
(b) security – to protect our websites, accounts and services and help prevent unauthorised access or misuse;
(c) status and functionality – to identify whether a user is logged in and to provide functions requested by the user;
(d) preferences – to remember choices such as cookie preferences or website settings;
(e) purchasing – to support shopping basket, checkout and payment functionality where online purchases are available; and
(f) analytics – to understand how our websites and services are used and identify opportunities for improvement.
12.2 WordPress and WooCommerce may use necessary session and functionality cookies. Depending upon the configuration of our website, these may include cookies such as wordpress_test_cookie, wordpress_logged_in_ and wp_woocommerce_session_ or successor cookies serving the same purposes.
12.3 We may use Google Analytics or another analytics provider to obtain statistical information about the use of our website. Google Analytics cookies may include _ga and related or successor analytics cookies.
12.4 We may use third-party payment providers such as PayPal. Payment providers may use their own cookies and other technologies when their services are accessed.
12.5 The precise cookies used on our websites may change as technology and service providers are updated. Our cookie consent or preference tool provides current information where applicable.
13 Managing cookies
13.1 When you first visit our website, you will be given information and choices concerning cookies and similar technologies where required.
13.2 You can change your cookie preferences through the cookie settings or consent facility available on our website, where provided.
13.3 You can also configure most browsers to refuse, block or delete cookies. The method varies between browsers and devices.
13.4 Blocking cookies that are necessary for the operation of a website or service may prevent some functions from working correctly.
13.5 Where we rely upon a statutory exception that requires us to provide a simple means of objecting, we will make that option available to users.
14 Children and young people
14.1 Some Brightlink programmes, including apprenticeship and education programmes, may be available to people under the age of 18.
14.2 Where we process the personal data of a child or young person, we recognise that they may require particular protection and will take their age and circumstances into account when deciding how their personal data should be collected and used.
14.3 We may process information about a young person for the purposes of providing education and training, administering an apprenticeship, monitoring progress, providing support, meeting safeguarding responsibilities and complying with funding, regulatory and legal requirements.
14.4 Where appropriate and lawful, we may communicate or share information with parents, carers, employers, apprenticeship partners, funding bodies or safeguarding organisations. We will consider the young person’s rights, age and circumstances before doing so.
14.5 We will apply data protection by design and default to online services where those services are likely to be accessed by children and will take account of the need for enhanced protection of children’s personal data.
15 Amendments
15.1 We may update this privacy policy from time to time to reflect changes in our services, systems, suppliers or legal and regulatory requirements.
15.2 The current version will be published on our website.
15.3 Where a change is significant and it is appropriate to do so, we may also notify affected individuals by email or another appropriate means.
16 Our details
16.1 This website and the services described in this policy are operated by Brightlink Learning Ltd.
16.2 Brightlink Learning Ltd is registered in England and Wales under company number 09929745.
16.3 Our registered office is:
53 Ridgeway Road
Rumney
Cardiff
CF3 4AB
16.4 Our principal place of business is via the internet.
16.5 You can contact us:
(a) by post, using the address above;
(b) using the contact form on our website;
(c) by telephone, using the contact number published on our website from time to time; or
(d) by email at connect@brightlink.org.uk.
17 Data Protection Officer
17.1 Our Data Protection Officer is our Chief Executive.
17.2 Questions about this privacy policy, requests to exercise data protection rights and data protection complaints may be sent to:
Data Protection Officer
Brightlink Learning Ltd
53 Ridgeway Road
Rumney
Cardiff
CF3 4AB
Email: connect@brightlink.org.uk
Telephone: 02921 888386
Last updated: 8 September 2026
