Privacy Policy

1. About this Privacy Policy

1.1 Brightlink Law School is the public-facing brand of Brightlink Learning Ltd.

1.2 Brightlink Learning Ltd is committed to protecting personal information and being clear about how information is collected and used.

1.3 This Privacy Policy applies specifically to the Brightlink Law School website and to personal information collected through it.

1.4 It covers people who visit the website, make an enquiry, request contact or use another website form.

1.5 If you go on to become a Brightlink learner, client, employee, contractor, employer partner or participant in one of our programmes, Brightlink may need to process additional information about you. Our wider privacy notices, Data Protection Policy, contractual arrangements and other relevant Brightlink policies will apply to that processing.

1.6 Brightlink Learning Ltd is the data controller for the personal information covered by this Privacy Policy.

1.7 We process personal information in accordance with the UK General Data Protection Regulation, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and relevant amendments made by the Data (Use and Access) Act 2025.

2. Information We Collect Through This Website

2.1 You can use most of the Brightlink Law School website without telling us who you are.

2.2 We may collect technical information when you visit the website. This may include:

• (a) your IP address;
• (b) browser and device information;
• (c) pages requested;
• (d) the time and date of requests;
• (e) referring pages or websites; and
• (f) information required for the security and technical operation of the website.

2.3 We may also collect information that you choose to give us through our website forms.

2.4 Our Talk to Us form currently asks for information including:

• (a) your name;
• (b) email address;
• (c) telephone number;
• (d) organisation, if relevant;
• (e) whether you are contacting us as a learner, employer or potential collaborator;
• (f) what you would like to talk about; and
• (g) how you would prefer us to contact you.

2.5 Our CILEX Registration Support form may also ask whether you are currently a Brightlink learner and for brief information about your current study or qualification position.

2.6 Other forms may be added as the website develops. We will only ask for information that is reasonably relevant to the purpose of the form.

2.7 We deliberately ask people not to include confidential or sensitive personal information in ordinary website enquiry boxes.

2.8 If you need to tell us something sensitive, please contact us so that we can agree an appropriate way for you to provide the information.

3. How We Use Website Enquiries

3.1 We use information submitted through our website to understand why you have contacted us and respond appropriately.

3.2 Depending on your enquiry, this may include:

• (a) answering a question about Brightlink;
• (b) helping you understand routes into law;
• (c) discussing legal education or training;
• (d) explaining CILEX courses or qualification routes;
• (e) discussing Welsh Legal Services Apprenticeships or other funded routes where relevant;
• (f) discussing training or workforce development with an employer;
• (g) discussing a potential education, training or other collaboration;
• (h) arranging a telephone or Zoom conversation that you have requested;
• (i) supporting an existing Brightlink learner with a CILEX registration request; or
• (j) taking steps at your request before you enter into an agreement with Brightlink.

3.3 We do not treat the submission of an ordinary website enquiry as consent to receive unrelated marketing.

3.4 We may contact you again where it is reasonably connected with the enquiry you made or the relationship you asked us to explore.

4. Our Legal Bases for Using Your Information

4.1 We will only process personal information where we have a lawful reason to do so.

4.2 Where you ask us for information or contact us about a course or service, our legal basis will usually be:

• (a) taking steps at your request before entering into a contract; and/or
• (b) our legitimate interests in responding to enquiries, communicating with people who are interested in Brightlink and operating our education and training services effectively.

4.3 Where you contact us on behalf of an employer or another organisation, we may rely on our legitimate interests in establishing, maintaining and developing professional and organisational relationships.

4.4 Where processing is necessary to meet a legal obligation, our legal basis will be compliance with that obligation.

4.5 Where we rely on consent for a particular use, we will make that clear when we ask for the information. You may withdraw consent at any time.

4.6 Where we rely on legitimate interests, we consider the purpose of the processing, whether it is necessary and the effect it may have on the individual concerned.

5. Information About Learners and Prospective Learners

5.1 The Brightlink Law School website is a public information and enquiry website. It is not Brightlink’s learning management system and does not provide learner accounts.

5.2 If you become a Brightlink learner, we will need to process more information than is collected through this website.

5.3 This may include information about enrolment, qualifications, employment, attendance, learning, assessments, examinations, progress, learner support, professional experience, apprenticeships and communications relating to your programme.

5.4 That information is processed as part of Brightlink’s wider education and training activity and is governed by the appropriate Brightlink privacy notices and policies.

6. Information Received From Employers or Other Organisations

6.1 Sometimes an employer, education provider, apprenticeship provider or another organisation may contact Brightlink about somebody else.

6.2 Where we receive personal information in this way, we will only use it where we have an appropriate lawful reason.

6.3 Where required, we will provide the person concerned with appropriate privacy information.

7. Special Category and Criminal Offence Information

7.1 We do not ask visitors to provide special category personal information through ordinary website enquiry forms.

7.2 Special category information includes information concerning matters such as health, disability, racial or ethnic origin, religious or philosophical beliefs, trade union membership, sex life and sexual orientation.

7.3 If special category information is provided to us, we will only process it where we have both a lawful basis for processing personal information and an appropriate additional condition permitting that type of information to be processed.

7.4 The same principle applies to information about criminal convictions or offences.

7.5 Where information of this kind is needed later for learner support, reasonable adjustments, safeguarding or another legitimate purpose, it will be handled under Brightlink’s wider data protection arrangements.

8. Children and Young People

8.1 Brightlink provides education and training and some people interested in our services may be under the age of 18.

8.2 We take particular care with the personal information of children and young people and aim to explain clearly how their information will be used.

8.3 We do not encourage children or young people to provide sensitive personal information through general website forms.

8.4 Where a safeguarding concern arises, Brightlink’s Safeguarding Policy and procedures apply.

9. Who We Share Website Information With

9.1 We do not sell personal information.

9.2 We may share or make website-related personal information available to organisations that help us operate the website and communicate with people who contact us, including:

• (a) website hosting and technical support providers;
• (b) website form and communication providers;
• (c) email and telecommunications providers;
• (d) cyber security and IT service providers; and
• (e) professional advisers where necessary.

9.3 A service provider does not automatically receive all information held by Brightlink. Access should be limited to information relevant to the service it provides.

9.4 If a website enquiry develops into enrolment, training, an apprenticeship, an employer relationship or another Brightlink service, information may then need to be shared with organisations relevant to that relationship.

9.5 Those organisations may include awarding, professional, regulatory, assessment, apprenticeship, funding or inspection bodies, employers or education partners where appropriate.

9.6 Information is not shared with those organisations merely because somebody visits this website.

9.7 Some recipients act as processors on Brightlink’s behalf. Others may be independent data controllers responsible for their own use of personal information.

9.8 We may also disclose information where required or permitted by law, including to regulators, courts, law enforcement bodies or safeguarding agencies where appropriate.

10. International Processing and Transfers

10.1 Brightlink Learning Ltd is established in the United Kingdom.

10.2 Some technology providers may operate internationally or use organisations based outside the United Kingdom.

10.3 Where Brightlink makes a restricted transfer of personal information to a separate organisation outside the United Kingdom, we will ensure that an appropriate transfer mechanism applies.

10.4 Depending on the circumstances, this may include UK adequacy regulations, appropriate contractual or other safeguards, or a statutory exception.

11. How Long We Keep Website Information

11.1 We keep personal information only for as long as it is reasonably required for the purpose for which it was collected and for any applicable legal, regulatory or evidential requirements.

11.2 An ordinary website enquiry will normally be retained while we deal with the enquiry and for as long as reasonable follow-up remains appropriate.

11.3 If the enquiry develops into a learner, employer, client, partner or other continuing relationship, the information may become part of the records relating to that relationship and will then be retained in accordance with Brightlink’s relevant retention arrangements.

11.4 Technical and security information is retained for the period reasonably required for website operation, security, troubleshooting and protection against misuse.

11.5 Where a person has objected to direct marketing, we may retain limited information on a suppression record so that their preference can continue to be respected.

11.6 We may retain information for longer where this is necessary to establish, exercise or defend legal claims or to meet a legal obligation.

12. Security

12.1 Brightlink takes appropriate technical and organisational measures to protect personal information against accidental or unlawful loss, destruction, alteration, disclosure or access.

12.2 Access to personal information is limited to people and service providers who have an appropriate reason to use it.

12.3 No internet service can be guaranteed to be completely secure. We therefore keep our security arrangements under review and respond appropriately to suspected personal data breaches.

13. Automated Decision-Making

13.1 Brightlink’s approach is based on people supporting people.

13.2 We do not use this website to make decisions about admission, learner support, qualification routes or access to Brightlink services solely by automated processing where the decision would have a legal or similarly significant effect on a person.

13.3 Technology may support administration and communication, but significant decisions about people remain subject to appropriate human involvement.

14. Your Data Protection Rights

14.1 Depending on the circumstances, you may have the right to:

• (a) ask whether we hold personal information about you;
• (b) request access to personal information that we hold about you;
• (c) ask us to correct inaccurate or incomplete information;
• (d) ask us to erase information in circumstances where the right to erasure applies;
• (e) ask us to restrict processing;
• (f) object to processing based on legitimate interests;
• (g) object to direct marketing;
• (h) receive or transfer certain information where the right to data portability applies;
• (i) withdraw consent where processing is based on consent; and
• (j) exercise rights relating to significant automated decisions where applicable.

14.2 The right to object to processing for direct marketing purposes is absolute.

14.3 A subject access request does not have to use any particular wording.

14.4 Where we receive a subject access request, we will carry out a reasonable and proportionate search for personal information falling within the request.

14.5 We will normally respond to an individual rights request within one month, subject to the provisions of data protection law concerning identification, clarification, complex requests, multiple requests and extensions of time.

14.6 We may ask for information reasonably necessary to confirm identity before disclosing personal information.

14.7 We do not normally charge for an individual rights request, although data protection law permits a reasonable fee or refusal in certain circumstances.

15. Data Protection Complaints

15.1 If you are concerned about the way Brightlink has collected, used, shared, retained or otherwise handled your personal information, you may make a data protection complaint to us.

15.2 You can complain by email, telephone or post.

15.3 Please provide enough information for us to understand what has happened and what you are concerned about. You do not need to use legal terminology.

15.4 We will acknowledge a data protection complaint within 30 days of receiving it.

15.5 We will, without undue delay:

• (a) make appropriate enquiries into the complaint;
• (b) take appropriate steps to respond;
• (c) keep you informed about progress where appropriate; and
• (d) tell you the outcome.

15.6 You also have the right to complain to the Information Commissioner’s Office.

15.7 We would welcome the opportunity to understand and resolve a concern directly, but contacting Brightlink first does not remove your right to approach the Information Commissioner’s Office.

16. Contacting Brightlink About Personal Information

16.1 Brightlink Learning Ltd has appointed Lorna Baldry as its Data Protection Officer.

16.2 You can contact the Data Protection Officer at:

Lorna Baldry
Data Protection Officer
Brightlink Learning Ltd
53 Ridgeway Road
Rumney
Cardiff
CF3 4AB

Email: lorna@brightlink.org.uk

16.3 You may also email connect@brightlink.org.uk and mark your message for the attention of the Data Protection Officer.

16.4 Telephone: 02921 888386.

17. About Brightlink Learning Ltd

17.1 Brightlink Law School is a public-facing brand operated by Brightlink Learning Ltd.

17.2 Brightlink Learning Ltd is registered in England and Wales.

Company number: 09929745

Registered office:
53 Ridgeway Road
Rumney
Cardiff
CF3 4AB

18. Changes to This Policy

18.1 We may update this Privacy Policy when our website, services or legal obligations change.

18.2 The current version will be published on the Brightlink Law School website.

18.3 Where a change materially affects the way we use personal information already collected, we will take appropriate steps to bring that change to the attention of affected people.