Privacy notice

Draft for review. This notice is a working draft. Items marked like this still need real company details filled in, and the whole document should be reviewed by a legal adviser before you rely on it. See CONTENT-TODO.md in the site source.

1. Who we are

Bnm (“we”, “us”) is a company registered in England and Wales. Company number: [company number]. Registered office: [registered address].

We are registered with the Information Commissioner's Office under registration number [ICO number].

For any privacy question, contact privacy@bnmbnm.co.uk.

2. Two different roles

It matters which hat we are wearing, because it determines who is responsible for what.

As a data controller

When you visit this website or contact us as a prospective customer, we decide how your data is used. We are the controller for that data.

As a data processor

When a school uses our platform, the school is the data controller for its students' personal data. We process that data only on the school's documented instructions, under a written agreement made under Article 28 of the UK GDPR. If you are a student or parent with a question about that data, your school is the right first point of contact — though we will always help them answer you.

3. What we collect

Website visitors

This site does not use analytics, advertising or third-party tracking. There are no cookies set for tracking purposes, no embedded social media widgets, and no external fonts or scripts — nothing on this page causes your browser to contact another company.

Our hosting provider processes standard server request information (such as IP address, timestamp, requested page and user agent) for the purposes of delivering the site and protecting it from abuse.

People who contact us

The contact form on this site does not transmit anything to us. It assembles your message and hands it to your own email application, so you send it yourself. Once you email us, we hold your name, email address, organisation, role and the content of your message so that we can reply and, if relevant, manage the resulting business relationship.

Students and staff using the platform

On behalf of schools, we typically process: the student's name, year group and class, a school-issued identifier, their responses to questions, their progress and mastery estimates, and technical usage data such as sign-in times. The exact fields are set out in the processing agreement with each school. We do not ask for special category data, and schools should not send it to us.

4. Why, and on what legal basis

To reply to your enquiry — legitimate interests (responding to someone who contacted us), or steps prior to entering a contract.
To provide the platform to a school — performance of our contract with the school. For the student data within it, the school determines the lawful basis, usually public task.
To keep the service secure and available — legitimate interests in protecting our systems and our users.
To meet legal and accounting obligations — legal obligation.

We do not rely on consent for marketing to schools by post or to business email addresses, but you can opt out of any communication from us at any time by asking.

5. What we never do

We do not sell personal data. There is no circumstance in which we would.
We do not share personal data with advertisers or data brokers.
We do not use identifiable student data to build or train models for other customers.
We do not build profiles of students for any purpose other than delivering the educational service to their school.
We do not use children's data for marketing.

We use a small number of service providers (sub-processors) to run the service — for example cloud hosting and email delivery. Each is bound by a written contract, may only act on our instructions, and is subject to appropriate security obligations.

The current sub-processor list is provided to school customers in writing as part of the processing agreement, and we give notice before adding a new one. To request the current list, email privacy@bnmbnm.co.uk.

We may also disclose data where we are legally required to, or to establish or defend legal claims.

7. Where data is held

Student data processed for schools is stored and processed in the United Kingdom. Where any transfer outside the UK is necessary for a supporting service, it is made under an approved safeguard such as UK International Data Transfer Agreement or Addendum, and the detail is disclosed in the processing agreement.

8. How long we keep it

Enquiries — up to 24 months from our last contact, unless a customer relationship begins.
Customer records and contracts — for the duration of the agreement plus six years, for legal and accounting purposes.
Student data — for the duration of the school's agreement, then deleted on the schedule set out in that agreement. We confirm deletion in writing.
Server logs — a short rolling window for security and diagnostics.

9. Security

We encrypt data in transit and at rest, apply role-based access control with multi-factor authentication for staff, keep an audit trail of administrative access, and limit access to personal data to those who need it to do their job. We test our systems and maintain an incident response process. If a personal data breach affects a school's data, we notify that school without undue delay so that they can meet their own obligations.

10. Your rights

Under UK data protection law you have the right to access your personal data, to have inaccurate data corrected, to have data erased in some circumstances, to restrict or object to certain processing, and to data portability.

If we are the controller — for example because you contacted us — exercise these rights by emailing privacy@bnmbnm.co.uk. We will respond within one month.

If your data is held because your school uses our platform, contact your school, which is the controller. We will support them in responding to you.

You also have the right to complain to the Information Commissioner's Office at ico.org.uk. We would appreciate the chance to put things right first, but that is your choice, not a condition.

11. Children

Our platform is used by children in an educational setting under the direction of their school. We apply the principles of the ICO's Age Appropriate Design Code: data minimisation by default, no profiling for commercial purposes, no nudge techniques designed to encourage children to give up more data or spend more time on the service, and privacy settings that default to high protection.

This website is aimed at teachers, school leaders and parents rather than at children.

12. Cookies

This website sets no cookies at all. It stores a single item in your browser's local storage, named bnm-theme, which remembers whether you chose the light or dark appearance. It contains no identifier, is never sent to us or anyone else, and clearing your browser data removes it. Because it is strictly necessary to provide a feature you explicitly requested, no consent banner is required — and we would rather not show you one.

The Bnm platform itself uses a session cookie strictly necessary for keeping a signed-in user signed in. It is not used for tracking.

13. Changes to this notice

If we make a material change we will update the date at the top of this page and, for school customers, tell you directly rather than relying on you noticing.

14. Contact

Privacy questions: privacy@bnmbnm.co.uk
Everything else: hello@bnmbnm.co.uk