Privacy policy

1. Who we are

BMGA Foundation is the data controller for the information described here. You can reach our data protection contact at [email protected], or by post at the address on the Contact page.

2. What we collect

We collect only what a specific purpose requires:

• Contact details you give us through an enquiry or application form.
• Programme records for participants — assessment results, attendance, placement reviews.
• Basic analytics about how the site is used, in aggregate.

We do not collect special category data unless a programme requires it for safeguarding, and where we do, we say so at the point of collection.

3. Why we hold it

To run programmes, to answer enquiries, to report to funders in aggregate, and to publish impact figures in a form that cannot identify an individual. Where we rely on consent, you can withdraw it at any time.

4. Who we share it with

Placement partners receive the information a supervisor needs, and nothing more. Service providers — email, hosting, forms — process data on our instructions under contract. We do not sell data, and we do not share it with advertisers.

5. How long we keep it

Enquiries for two years. Programme records for seven years after exit, because progression is measured over time and funders may audit.

6. Your rights

You can ask for a copy of what we hold, ask us to correct it, ask us to delete it, or object to a particular use. Write to the address above and we will respond within thirty days.

7. Security

Access is limited to staff who need it, accounts require two-factor authentication, and programme records are held in systems with audit logging. Our data protection policy is published on the Governance page.

8. Changes to this policy

We review this policy annually. Material changes are dated at the top of this page.

For how the site uses cookies, see the cookie policy.