BPIF Training Cloud

Privacy notice

BPIF Training Limited ("BPIF Training", "we", "our", "us") is committed to protecting your privacy and handling your personal data securely, fairly and transparently. This notice explains how we collect, use, store and protect personal information when you visit our website, make an enquiry, apply for or take part in training, engage with us as an employer, partner, supplier or stakeholder, sign up to receive marketing, or use our online services, including our online learning platform, BPIF Training Cloud (bpiftraining.cloud). 

BPIF Training Limited is an independent company and operates separately from the British Printing Industries Federation (BPIF).

We process personal data in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable data protection law.

1. Who we are

BPIF Training Limited is the Data Controller for personal information collected through our website, BPIF Training Cloud and our training and business activities.
Company number: 06875770
Registered office: Unit 2, Villiers Court, Meriden Business Park, Copse Drive, Coventry, CV5 9RN
Telephone: [01676 526060 – check: notice says 526030, website says 526060]
Website: [bpif.training – check: notice says www.bpiftraining.co.uk]

2. What this notice covers

This notice applies to personal data collected through our website, BPIF Training Cloud , online enquiry forms, learner enrolment, employer engagement, recruitment, events and webinars, email, and surveys and feedback forms. Our sites may link to third-party websites; we are not responsible for their content or privacy practices.

3. Your rights

Under UK GDPR you have the right to be informed about how your information is used; access it; ask us to correct it; ask us to delete it in certain circumstances; restrict or object to processing; ask us to transfer it to another organisation where applicable; withdraw consent where we rely on consent; and complain to the Information Commissioner's Office (ICO).

We do not use personal data for automated decision-making or profiling that produces legal or similarly significant effects.

4. What information we collect

Personal information: name, date of birth, home address, email address, telephone number, National Insurance number, employment and employer details, job title, CV, qualifications and achievement records, apprentice and learner identifiers, and attendance and engagement records.

Special category data: where required for training, safeguarding, funding or legal purposes, we may collect health information, learning support needs, disability information, and equality and diversity information including ethnicity. We only process special category data where the law permits and appropriate safeguards are in place.

Technical information: IP address, browser and device details, operating system, website usage information, cookie data and analytics.

5. How we use your information

We use personal information to deliver apprenticeship and training programmes; register learners with awarding organisations; arrange assessments and certification; support learner progress and achievement; administer learner and employer accounts; respond to enquiries; communicate with learners, employers and stakeholders; meet contractual obligations; support safeguarding; comply with legal and regulatory requirements; claim and manage government funding; carry out quality assurance; improve our services; manage recruitment; process payments for online courses ★; and send marketing where lawful.

5A. BPIF Training Cloud (our online learning platform) 

BPIF Training Cloud at bpiftraining.cloud is where learners access course materials, complete activities and assessments, book workshops and track their progress. It is run by BPIF Training using Moodle learning software.

What the platform stores:

• Account details: your name, email address, username and any profile details you add.
• Learning activity: the courses you are enrolled on, pages and activities you open, completion status, quiz and assignment results, work you submit, forum posts and messages, and certificates issued to you.
• Log data: dates and times you log in and use the platform, and your IP address, which we use for security, support and to evidence learning for funding and quality purposes.
• Bookings: workshops and events you book onto.

Logging in with Microsoft: if you use "Log in with Microsoft", Microsoft confirms your identity to us and shares your name and email address. We do not receive your Microsoft password.

Paying for a course: online course payments are processed by Stripe. Your card details are entered on Stripe's secure checkout and are never seen or stored by BPIF Training. We receive confirmation of payment, the amount, and your name, email and billing address. Stripe's own privacy notice applies to the information you give them: stripe.com/gb/privacy.

Linked services: some programmes use separate services such as Smart Assessor (e-portfolio) and bksb (English and maths). These have their own privacy notices, and the information in them is covered by the rest of this notice.

Who can see your information on the platform: BPIF Training staff who support your learning, such as your tutor, assessor, quality and administration staff. On apprenticeship programmes, progress information may be shared with your employer and with the organisations listed in section 9. Other learners on the same course may see your name and anything you post in shared spaces such as forums.

Lawful basis: for apprentices and funded learners, see section 6 (contract, legal obligation and public task). For people who buy a short course, we process your data to provide the course you have paid for (contract).

How long we keep it: apprenticeship and funded learner records are kept in line with Department for Education funding rules (see section 7). For people who buy a short course, we keep your account and course record for [the length of your access plus 2 years] so we can reissue certificates and deal with queries, then delete or anonymise it. Payment records are kept for [6 years] to meet financial requirements. You can ask us to delete your account sooner, unless we need to keep it for legal or funding reasons.

Cookies on the platform: BPIF Training Cloud uses a small number of strictly necessary cookies to keep you logged in and the site secure (for example, MoodleSession). [It does not use analytics or advertising cookies – check with IT.]

Where the data is held: [BPIF Training Cloud is hosted in the UK by NAME OF HOSTING PROVIDER – check with IT.]

6. Our lawful basis for processing

• Contract: to fulfil a contract or take steps before entering one, including when you buy a course. 
• Legal obligation: to comply with legal and regulatory requirements.
• Legitimate interests: for our legitimate business interests, where your rights are not overridden.
• Consent: where required, we obtain and manage consent appropriately.
• Public task: where necessary to deliver publicly funded education and training.

For special category data we rely on the additional conditions permitted under UK GDPR and the Data Protection Act 2018.

7. How long we keep information

We keep personal information only as long as needed for the purposes it was collected for. Typically: learner records in line with Department for Education and funding requirements; financial records in line with statutory requirements; recruitment records for up to 12 months after recruitment ends; marketing records until consent is withdrawn or no longer needed; online course records as set out in section 5A . Information no longer needed is securely deleted or anonymised.

8. How we store and protect information

Our safeguards include HTTPS encryption, access controls and user permissions, multi-factor authentication where appropriate, regular updates and monitoring, secure cloud storage, staff data protection training, secure disposal and cyber security controls. We review these regularly.

9. Who we share information with

We only share personal information where necessary and lawful, including with: the Department for Education; awarding organisations; end-point assessment organisations; Ofsted; employers; safeguarding agencies where required; professional advisers; auditors and regulators; technology service providers (including our learning platform hosting and Microsoft) ; and payment and finance providers (including Stripe). Third parties must protect personal information and process it only on our instructions and in line with the law. We may also disclose information where required by law, court order or regulation.

[Note for Karly: the original refers to the ESFA. The ESFA closed in March 2025 and its functions moved into the DfE, so I've removed it. Check this with your compliance lead.]

10. International transfers

Most personal information is stored in the UK. Some service providers, such as Stripe and Microsoft, may process data outside the UK; where this happens we make sure appropriate safeguards are in place under UK GDPR. 

11. Marketing communications

We may send updates about apprenticeships, commercial training, industry events, webinars, news and employer services. Where the law requires it, we only do this with your consent. You can unsubscribe at any time using the link in our emails or by contacting us. Opting out of marketing does not affect service messages, such as course notifications from BPIF Training Cloud. 

12. Cookies

Our website uses cookies to make it work, remember preferences, improve performance, analyse traffic and support security. Strictly necessary cookies cannot be switched off. Non-essential cookies are only used with your consent. See section 5A for cookies on BPIF Training Cloud, and our Cookies Policy for our website.

13. Exercising your rights

To exercise your rights or make a request about your personal information, contact:
Max Walkington, Operations Director, BPIF Training Limited
Email: training@bpif.training
Unit 2, Villiers Court, Meriden Business Park, Copse Drive, Coventry, CV5 9RN

We normally respond within one month of receiving a valid request.

14. Complaints

If you are concerned about how we handle your personal information, please contact Max Walkington first. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk, 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

15. Changes to this notice

We may update this notice to reflect changes in the law, our business or how we process data. Updates will be published here with a new revision date.

Data Controller: BPIF Training Limited (company number 06875770)
Contact for data protection: Max Walkington, Operations Director, training@bpif.training
Last updated: October 2026