Privacy notice

1. 01

   Who we are

   This website is run by Barham Protection Services Ltd (BPS), company number 14868639. We decide how the information you give us here is used, so we are the "controller" of it under UK data protection law.

   To write to us or visit us, use our headquarters and training centre: Unit 10, The Old Brewery, Buckland Road, Maidstone, ME16 0DZ.

   We are registered with the Information Commissioner's Office (ICO). Our registration reference is ZB691705.

   Questions about your information: email operations@bps-ltd.org or call 0330 043 8443.

2. 02

   What we collect and why

   We collect what you type into our forms, plus the few technical details below. You can browse the site without filling in a form. Like any website, our hosting provider has to receive your IP address to send you our pages, and may keep short technical logs to run and protect the service.

   Making an enquiry (the contact form)

   What we collect	Why we use it
   Your name, email address and message	To read your enquiry and reply to you.
   Phone number and organisation, if you give them	To call you back, or to understand who you are enquiring for.
   What your enquiry is about (a service, training or recruitment), and the page you came from	To send it to the right team: training enquiries to our training team, everything else to our operations team.
   A keyed code made from your IP address, and a count against it	To stop the form being flooded: no more than 5 enquiries from one address in 10 minutes, and no more than 3 from one email address in an hour. The address itself is never saved. It is turned into a keyed code (a hash) that cannot be turned back into the address, and a count is kept against that code for each 10-minute window. A daily job deletes counts older than 24 hours, so none is kept for more than two days. The same protection, with the same kind of code, covers our booking checkout, discount-code checks and staff sign-in.

   We email a copy of your enquiry to our team, and send you a short acknowledgement. The acknowledgement does not repeat anything you typed.

   Booking a course

   What we collect	Why we use it
   Your name, email address and phone number (phone is optional)	To take your booking, confirm it and contact you about it.
   Each delegate's name, email address, mobile number and date of birth	To give each delegate their place and contact them about the course. Our awarding bodies need the date of birth to register a delegate on the course, and it shows the delegate is 18 or over on the first day.
   Each delegate's gender	Highfield, one of our awarding bodies, requires it to register a delegate. We ask for it on every course.
   The course, date and number of places, the price and when you accepted our booking terms	To run the course, keep our accounts and show what was agreed.
   Attendance and a short result note, added by our staff	To keep training records for each course.

   If you start a booking but don't finish it, our training team will send you one email to offer help.

   If you book for someone else, please tell them you are sharing their details with us and point them to this notice. Each delegate gets their own confirmation email. Dates of birth and gender are never put in a confirmation email: they go only to our own training inbox, so we can register each delegate with the awarding body.

   If you use a Blue Light Card discount code we ask for your card number as a check that the discount is for you. We do not verify it with Blue Light Card.

   Paying for a course

   What we collect	Why we use it
   Your card details	Entered on Stripe's own secure page. They go to Stripe and are never seen or stored by BPS.
   Payment references, amounts, Stripe's fee and any refund	To match your payment to your booking, handle refunds and keep our accounts.

   Recruitment

   What we collect	Why we use it
   Your name, contact details, and what you tell us about your background in your message	To consider you for work with BPS and reply to you.
   Your CV and a headshot photograph, if we ask for them	To decide whether to take your application forward.
   Vetting information, such as driving licence and passport details, if we take you forward	To vet you to BS 7858, the British Standard for screening people who work in security.
   A copy of your own DBS (criminal record check) certificate, which you send us, if we take you forward	Part of the same BS 7858 vetting.

   Recruitment enquiries use the same contact form and go to our operations team. If we would like to know more, our operations manager will email you from our operations inbox to ask for your CV and a headshot. If we take your application forward, we send you a link to a form on Monday.com, where you give the vetting information BS 7858 requires. We hold a copy of your own DBS (criminal record check) certificate, which you send us, as part of that vetting. All vetting information, DBS certificate copies included, is held in Monday.com; where you email us a copy, that email stays in our operations mailbox until it is deleted.

   This website never receives your CV, your photograph or your vetting documents.

3. 03

   Our lawful basis

   The law asks us to name a reason, or "lawful basis", for each use. Ours are:

   • Answering your enquiry: our legitimate interest in replying to people who contact us, or steps you ask us to take before a contract.
   • Your course booking: to perform our contract with you (the booking).
   • Accounts: legal obligations, such as keeping financial records for tax.
   • Training records: our legitimate interest in meeting the rules of the awarding bodies, which require us to keep them so that your qualification can be awarded and checked.
   • Recruitment and vetting: steps you ask us to take before a possible contract with you, and our legitimate interest in vetting everyone who works for us to BS 7858. Copies of DBS (criminal record check) certificates are criminal offence data, which the law protects more strictly. We use them only to decide whether someone can work for us. We keep them in Monday.com, stored in the EU, and in our operations mailbox where a copy was emailed to us; they can be seen only by our management and compliance team, never on this website, and we delete them one year after the person leaves us or is not taken on. We handle them under our criminal record information policy.
   • Keeping the site and forms safe, and preventing fraud: our legitimate interest in protecting our customers and our business.

   We do not use your information for marketing, and we never sell it.

4. 04

   Who we share it with

   A few companies help us run the website and our business. They handle your information only on our instructions, under written data processing terms.

   • Vercel Inc.: hosts this website and runs its forms.
   • Neon (part of Databricks, Inc.): stores our enquiry and booking records in a database.
   • Resend (Plus Five Five, Inc.): sends the website's emails, such as your acknowledgement and booking confirmations.
   • Stripe: takes card payments. Stripe also uses payment details for its own legal and fraud checks, as set out in its privacy policy at stripe.com/gb/privacy.
   • Cloudflare, Inc. (Turnstile): checks that a person is filling in the contact form, to keep out automated spam.
   • Pink Frog Studio: builds and looks after this website for us, under a written data processing agreement.
   • monday.com Ltd: holds our recruitment and vetting records, stored in its data centres in the EU.
   • Neo (Titan Solution Ltd SEZC): hosts our own email inboxes, where your enquiries, booking notices and recruitment emails arrive.

   If you message us on WhatsApp, your message and phone number are handled by WhatsApp (Meta) under its own privacy policy. We use them only to reply to you.

   For course bookings, we pass delegate details to the awarding body for the course so it can register you and award your qualification:

   • Highfield Qualifications (Highfield Awarding Body for Compliance Limited) needs at least your first name, last name, gender and date of birth, so we ask every delegate for their gender when they book. Highfield is the controller of the information it receives, and its privacy policy says it keeps it for 40 years from the date you complete your course.
   • Qualsafe Awards (Qualsafe Limited): we send your name and date of birth, and for some regulated qualifications your identity documents. Qualsafe and BPS are joint controllers of that information, and Qualsafe's privacy policy says it keeps learner data indefinitely.

   Both publish their own privacy policies: highfieldqualifications.com/privacy-policy and qualsafe.org/qualsafe-awards-privacy-policy.

   Our website's servers and our database are in London.

   Vercel, Neon, Resend and Cloudflare are United States companies, monday.com is based in Israel and Neo in the Cayman Islands, so some of your information may be handled outside the UK. Where it is, it is protected by the safeguards in each company's data processing terms.

   We will also share information if the law requires it, for example with the police or a regulator.

5. 05

   Payments

   When you pay, you leave our site for Stripe's secure checkout page. Your card details go straight to Stripe. We never see or store your full card number. We give Stripe your email address, a booking reference and the course you are paying for.

6. 06

   Cookies

   We use analytics cookies only if you say yes. Until then, and if you say no, they are not set and no Google tag is loaded. If your browser sends a Global Privacy Control signal, we treat it as a no. You can change your choice at any time with the Cookie settings link at the foot of every page.

   Cookies this website can set

   Name	What it is for	How long
   __Host-bps_admin	What it is forKeeps a member of staff signed in to the admin area. Staff only. Strictly necessary.	How longUp to 12 hours
   bps_consent	What it is forRemembers your cookie choice, so we do not ask again on every page. Strictly necessary.	How long6 months
   _ga	What it is forGoogle Analytics: tells visits apart so we can count them. Set only if you say yes to analytics cookies.	How long2 years
   _ga_<id>	What it is forGoogle Analytics: keeps track of your current visit. Set only if you say yes to analytics cookies.	How long2 years

   • Contact form: Cloudflare Turnstile checks your browser to keep out automated spam. It does not set cookies on our site. It does receive your IP address and technical details about your browser.
   • Payments: Stripe sets its own cookies on its checkout page, for security and fraud prevention, under Stripe's cookie policy.

   Links to maps and social media take you to those websites, which have their own privacy and cookie policies.

7. 07

   How long we keep it

   We keep information only as long as we need it:

   • Enquiries that do not lead to a booking or work: 12 months from our last contact, then deleted.
   • CVs and headshots of people we do not take on: deleted after 12 months.
   • Vetting records and copies of DBS (criminal record check) certificates, held in Monday.com (and in our operations mailbox where a copy was emailed to us): kept for one year after someone leaves us or is not taken on, in case a complaint comes up about work they were involved in, or until an open complaint is closed if that is later.
   • Bookings, payments and invoices: 6 years after the end of the financial year they belong to, for our accounts.
   • Training records for Highfield courses, including learner details and assessment decisions: 3 years, as Highfield asks of the centres that deliver its courses.
   • Training records for Qualsafe courses: 3 years after the course, or longer where Qualsafe's terms require it.
   • Copies of the emails we send you are kept for 90 days.
   • Technical logs kept by our hosting provider: a short period set by the provider.

   When the time is up, we delete the information or make it anonymous.

8. 08

   Your rights

   Under UK data protection law you have the right to:

   • ask for a copy of the information we hold about you;
   • ask us to correct it if it is wrong;
   • ask us to delete it;
   • ask us to limit how we use it;
   • object to us using it where we rely on our legitimate interests;
   • ask for information you gave us in a format you can take elsewhere.

   To use any of these rights, email operations@bps-ltd.org or call 0330 043 8443. It is free, and we will reply within one month. Some rights have limits: for example, we must keep accounting records for as long as the law says.

   If you are unhappy with how we have handled your information, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk.

9. 09

   Changes to this notice

   If we change how we use your information, we will update this page and the date below.

This notice was last updated on 16 October 2026.