Privacy policy

British Marine Training Academy LMS Privacy Notice

Organisation: British Marine Federation

Registered office: Tagus House, 9 Ocean Way, Southampton, England, SO14 3TJ

Company number: 02592536

VAT number: GB358705331

Contact email: training@britishmarine.co.uk

ICO registration number: Z2203195

Data Protection Officer: Earle Stanner, CEO

Email: dataprotection@britishmarine.co.uk.

Effective date: 05 August 2026

Version: 1.0

1. About this privacy notice

This privacy notice explains how British Marine Federation, referred to as we, us, our or the Association, collects and uses personal information through the British Marine Training Academy learning management system.

It applies to:

• individuals who purchase or access training personally;

• employees, workers, contractors, volunteers and other trainees enrolled by an organisation;

• people who administer training on behalf of an organisation;

• purchasers and billing contacts;

• instructors, assessors and other people involved in delivering training; and

• people who contact us about our training services.

The LMS includes our online courses, assessments, webinars, learning records, certificates, support services and associated communications.

This notice should be read alongside our general Privacy Notice, Cookie Settings, LMS Terms of Use[AB1.1] (accepted at point of login to the LMS) and any course-specific privacy information.

2. Who is responsible for your information?

For most processing described in this notice, the Association is the data controller. This means that we decide why and how your personal information is used.

Where an employer, member organisation or other organisation registers and enrols you, that organisation will normally be a separate data controller for its own activities, including:

• deciding that you should undertake the training;

• providing your information to us;

• monitoring your training requirements;

• viewing and using your progress, assessment and completion records; and

• using training records for employment, regulatory, insurance, competence or compliance purposes.

That organisation should provide its own privacy information explaining how it uses your training records.

In some bespoke arrangements, we may process information solely on an organisation’s documented instructions. Where this applies, the relevant contract or data-processing agreement will set out the parties’ respective responsibilities.

Our LMS technology provider Rise-Up will normally act as a data processor on our behalf.

3. How we receive your information

We may receive personal information:

• directly from you when you register, purchase training, complete a course or contact us;

• from your employer, member organisation or another organisation enrolling you;

• from an organisation administrator managing training accounts;

• from instructors, assessors or training partners;

• automatically when you use the LMS;

• from payment, webinar, identity-verification or certification providers; and

• from our membership, customer relationship management or finance systems.

Where an organisation provides your information to us, we will normally make this notice available to you in your account invitation, enrolment email or first communication.

4. Information we collect

Depending on the services used, we may process the following information.

Identity and contact information

This may include:

• name;

• title;

• email address;

• telephone number;

• postal address;

• date of birth, where required;

• photograph or identification information, where identity verification is necessary ; and

• account username or learner identification number.

Employment and organisation information

This may include:

• employer or organisation name;

• job title, department or role;

• work location;

• membership status;

• organisation administrator details;

• line manager or training coordinator;

• professional registration details; and

• information about the courses or competence requirements assigned to you.

Purchase and payment information

This may include:

• courses purchased;

• order and invoice details;

• billing address;

• purchase order information;

• payment status;

• discounts or membership rates applied; and

• limited payment information received from our payment provider.

We do not normally retain complete payment-card details.

Learning and assessment information

This may include:

• course enrolments;

• course start and completion dates;

• modules viewed or completed;

• time spent within the LMS;

• attendance at live sessions;

• assessment questions and submitted answers;

• assessment attempts, scores and outcomes;

• assignments and assessor feedback;

• practical assessment records;

• certificates and certificate numbers;

• qualification or continuing professional development records;

• course expiry and renewal dates; and

• records of academic or assessment misconduct investigations.

Technical and usage information

This may include:

• IP address;

• device and browser information;

• login dates and times;

• audit and activity logs;

• cookie identifiers;

• pages and course materials accessed;

• system errors and support diagnostics; and

• security and authentication information.

Communications and feedback

This may include:

• support requests;

• complaints and appeals;

• survey responses;

• course evaluations;

• correspondence with us;

• discussion-board contributions; and

• recordings or transcripts of training sessions where you have been informed that recording will take place.

Accessibility and adjustment information

Where you request an accessibility adjustment, we may collect information about:

• the adjustment or support required;

• accessibility preferences;

• dietary or communication needs; and

• limited health or disability information where necessary to provide the adjustment.

We will normally ask only for information about the adjustment required rather than requesting detailed medical information.

Where information is provided by your employer, an organisational customer, administrator, instructor or another third party, this may include the categories of data listed in this section 4 to the extent necessary to administer your training.

5. Why we use your information and our lawful bases

We must have a lawful basis whenever we use personal information. The basis used depends on the circumstances.

Registering individual customers and processing purchases

We use identity, contact, order and payment information to:

• create your account;

• process your order;

• collect payment;

• provide the purchased course;

• communicate about the purchase; and

• deal with cancellations or refunds.

Our lawful basis is normally that the processing is necessary to enter into or perform a contract with you.

Registering organisations and administrators

We use administrator and business-contact information to:

• register the organisation;

• verify British Marine membership or eligibility;

• establish administrator accounts;

• manage licences and enrolments;

• issue invoices;

• provide reports; and

• communicate about the organisation’s account.

Where the administrator is not personally party to the contract, we normally rely on our legitimate interests in administering and delivering training services, maintaining customer relationships and managing LMS accounts, and the purchasing organisation’s legitimate interests arranging and administering training for its personnel.

Enrolling trainees supplied by an organisation

We use information supplied by an employer or other organisation to:

• create the trainee’s account;

• enrol the trainee on the requested course;

• send account and course instructions;

• record participation and progress;

• deliver assessments;

• provide support; and

• issue completion records or certificates.

Where the trainee has not personally purchased the course, we normally rely on the legitimate interests of:

• the Association in providing and administering training;

• the purchasing organisation in arranging and recording appropriate training; and

• the trainee in receiving the training and having their achievements recorded.

We consider whether these interests are proportionate and necessary to pursue those legitimate interests and whether the trainee would reasonably expect the processing.

Delivering and assessing training

We use learning records to:

• deliver course content;

• monitor progress;

• mark assessments;

• provide feedback;

• verify course completion;

• prevent cheating and misuse;

• issue certificates;

• maintain certificate-validation records; and

• administer assessment appeals.

Our lawful basis is normally contractual necessity where the learner purchased the course directly, or legitimate interests where an organisation arranged the training.

Providing information to the purchasing organisation

Where an organisation enrolled you, its authorised administrators may be able to see:

• courses assigned to you;

• whether you have started a course;

• course progress;

• assessment attempts, scores and outcomes;

• attendance;

• completion status and date;

• certificate information;

• expiry or renewal dates; and

• relevant account activity, such as the date of last access.

We disclose this information because the organisation purchased or arranged the training and has a legitimate interest in administering its training, competence and compliance requirements.

We will not ordinarily give the organisation access to private support communications or information about an accessibility adjustment unless:

• this is necessary to administer the adjustment;

• you have asked us to share it;

• the organisation already provided the information;

• disclosure is required by law; or

• there is another appropriate lawful basis.

Maintaining training and certificate records

We retain appropriate records to:

• confirm that training was completed;

• validate certificates;

• deal with queries or disputes;

• meet accreditation requirements;

• support regulatory or insurance requirements; and

• protect the integrity of our training services.

We normally rely on legitimate interests and, where applicable, legal obligations.

Finance, tax and business administration

We use transaction and customer information for:

• accounting;

• taxation;

• auditing;

• financial reporting;

• debt management; and

• preventing financial fraud.

We rely on contractual necessity, legal obligations and our legitimate interests in managing our organisation.

System security and preventing misuse

We use account, technical and activity information to:

• authenticate users;

• protect accounts;

• identify attempted unauthorised access;

• investigate security incidents;

• prevent fraud and cheating;

• enforce our Terms of Use; and

• maintain the availability and integrity of the LMS.

We rely on our legitimate interests in protecting our systems, users, content and services and, where relevant, our legal obligations.

Improving courses and services

We may analyse LMS usage, assessment results and feedback to:

• evaluate course effectiveness;

• identify technical problems;

• improve course design;

• understand learner engagement;

• develop new training services; and

• produce aggregated statistical reports.

We normally rely on legitimate interests. Wherever reasonably possible, reports used for research, benchmarking or external publication will be anonymised or aggregated.

Complaints, enquiries and legal claims

We use relevant information to:

• respond to questions and support requests;

• investigate complaints;

• administer assessment appeals;

• establish or defend legal claims;

• respond to regulators; and

• maintain evidence of decisions.

We rely on contractual necessity, legal obligations and legitimate interests.

Accessibility adjustments

Where information about health or disability amounts to special-category information, we will identify both:

• a lawful basis under Article 6 of the UK GDPR; and

• an additional condition for processing special-category information.

We may rely on your explicit consent or another condition available under data protection law. We will explain the applicable basis when collecting the information where it is not already clear from this notice.

You may withdraw consent to the future use of information where we rely on consent. This will not affect processing already carried out, but it may affect our ability to provide a requested adjustment if no alternative basis applies.

Marketing

We may use purchaser, customer and business-contact information to send relevant information about:

• related courses;

• events;

• membership services;

• industry updates; and

• other Association products or services.

Depending on the recipient and communication method, we will rely on consent or legitimate interests and comply with applicable electronic-marketing rules.

Every marketing email will provide a way to unsubscribe. Unsubscribing from marketing will not prevent us from sending essential account, course, certificate or service communications.

We will not use trainee details supplied by an organisation for unrelated individual marketing unless we have an appropriate lawful basis and have clearly informed the trainee.

6. When you must provide information

Some information is necessary to:

• create an account;

• enrol you on a course;

• process a purchase;

• verify identity;

• administer an assessment; or

• issue an accurate certificate.

Where required information is not provided, we may be unable to provide the relevant service.

Providing marketing preferences, survey responses and most accessibility information is voluntary.

7. Automated processing and assessment marking

Some quizzes and assessments may be marked automatically against predetermined answers.

Automatic marking may determine whether the LMS records a module or assessment as passed. However, we do not normally use solely automated processing to make decisions that have a legal or similarly significant effect on you.

Where an assessment outcome is disputed, you may request appropriate human review through our assessment or appeals process.

We may use third-party survey tools, such as SurveyMonkey, to collect voluntary feedback after a course has been completed. Survey responses are used to help us review and improve our training services and are not used to make automated decisions about individuals.

8. Who we share information with

We may share information with the following recipients where necessary.

The organisation that enrolled you

Authorised administrators may receive the progress, assessment and completion information described in section 5.

LMS and technology suppliers

This may include providers of:

• LMS hosting;

• cloud storage;

• identity and access management;

• email delivery;

• customer relationship management;

• technical support;

• analytics;

• cybersecurity;

• survey and feedback platforms; and

• backup and disaster recovery.

Training providers and assessors

We may share necessary information with:

• instructors;

• assessors;

• moderators;

• examination providers;

• webinar hosts;

• course-development partners; and

• practical training centres.

Payment and finance providers

This may include:

• payment processors;

• banks;

• accounting providers;

• auditors; and

• debt-recovery providers.

Accreditation and professional bodies

Where a course is accredited or regulated, we may share appropriate learner and assessment information with the relevant awarding, accreditation, regulatory or professional body.

Professional advisers and authorities

We may share information with:

• legal advisers;

• insurers;

• auditors;

• law enforcement bodies;

• courts;

• regulators;

• government authorities; and

• other parties where disclosure is legally required or necessary to protect legal rights.

We require suppliers handling personal information on our behalf to provide appropriate confidentiality, security and data-protection commitments.

We do not sell personal information.

9. International transfers

Some LMS, cloud, communications, survey, feedback or support providers may process personal information outside the United Kingdom.

Where personal information is transferred internationally, we will ensure that an appropriate legal transfer mechanism is used. This may include:

• UK adequacy regulations;

• the UK International Data Transfer Agreement;

• the UK Addendum to approved standard contractual clauses;

• another legally approved safeguard; or

• an applicable legal exception.

Where required, we will carry out an assessment of the protections applying to the transfer.

Further information about relevant safeguards is available by contacting dataprotection@britishmarine.co.uk.

10. How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, financial, accreditation, insurance and dispute-resolution requirements.

Our normal retention periods are:

• LMS account information: while the account remains active and for 36 months after the last course or account activity;

• course progress and assessment records: Seven years after completion, withdrawal or expiry;

• certificate and certificate-validation records: , depending on the course and accreditation requirements, we may retain certificate and certificate-validation records permanently in order to allow verification of your completed training where required by you or third parties on your behalf;

• financial and transaction records: normally six years after the end of the relevant financial year;

• support correspondence: normally two years after the matter is closed;

• complaints, appeals and misconduct records: normally six years after the matter is closed;

• technical and security logs: normally 12 months unless required for an investigation;

• recordings of live training: 24 months, as explained when the recording is made;

• marketing records: until you unsubscribe or we determine that the information is no longer current; and

• marketing suppression records: a minimal record may be retained to ensure that we continue to respect an opt-out.

We may retain information for longer where:

• required by law or an accrediting body;

• necessary for certificate validation;

• relevant to an active complaint, investigation or legal claim; or

• the information has been securely anonymised.

11. How we protect information

We use appropriate technical and organisational measures designed to protect personal information.

These may include:

• access controls and role-based permissions;

• password and authentication controls;

• encryption where appropriate;

• secure hosting and backups;

• security monitoring and audit logs;

• supplier due diligence;

• staff confidentiality obligations;

• data-protection and cybersecurity training;

• incident-response procedures; and

• regular review of administrator access.

Organisation administrators are responsible for protecting their own login details and ensuring that administrator access is provided only to authorised personnel.

No internet-based service is entirely free from security risk, but we take reasonable steps to protect the information entrusted to us.

12. Responsibilities of purchasing organisations

An organisation registering or enrolling trainees should:

• provide only information that is necessary for the training;

• ensure that the information is accurate;

• have an appropriate lawful basis for giving the information to us;

• tell the trainee that their information will be provided to us;

• direct the trainee to this privacy notice;

• ensure that LMS administrators are properly authorised;

• remove or update administrator access when roles change;

• use progress and assessment information lawfully and fairly;

• maintain its own privacy notice covering its use of training records; and

• avoid uploading special-category or confidential information unless necessary and appropriately protected.

These responsibilities do not remove our obligation to provide privacy information directly to affected trainees.

13. Your data-protection rights

Depending on the circumstances, you may have the right to:

• receive information about how your personal information is used;

• request access to your personal information;

• ask us to correct inaccurate or incomplete information;

• ask us to erase information;

• ask us to restrict how information is used;

• object to processing based on legitimate interests;

• object at any time to direct marketing;

• receive certain information in a portable format;

• withdraw consent where processing relies on consent; and

• request safeguards or human intervention in relation to qualifying automated decisions.

These rights are not absolute. Whether a right applies may depend on the lawful basis, the type of information and any legal exemptions.

Where a purchasing organisation is responsible for the processing concerned, we may direct your request to that organisation or assist it in responding.

To exercise a right, contact:

Email: dataprotection@britishmarine.co.uk.

Address: British Marine, Tagus House, 9 Ocean Way, Southampton, England, SO14 3TJ

We may need to request appropriate information to confirm your identity.

14. Data-protection complaints

Questions or complaints about our use of personal information should be sent to:

Data protection contact: Earle Stanner, CEO

Email or electronic complaints form: dataprotection@britishmarine.co.uk.

Address: British Marine, Tagus House, 9 Ocean Way, Southampton, England, SO14 3TJ

We will acknowledge a data-protection complaint within 30 days and will respond without undue delay.

You also have the right to complain to the Information Commissioner’s Office, the UK data-protection regulator.

We would appreciate the opportunity to consider the matter first, but contacting us does not affect your right to approach the regulator.

15. Cookies

The LMS may use cookies and similar technologies to:

• keep users signed in;

• maintain security;

• remember settings;

• provide LMS functionality;

• understand performance and usage; and

• support permitted analytics.

Essential cookies may be used where necessary to provide the service. Non-essential cookies will be managed in accordance with applicable consent requirements.

Further information is provided in our Cookie Notice and cookie-preference tool.

16. Children and younger learners

The LMS is primarily intended for learners who are employed within, or otherwise working in, the marine industry and who are likely to be aged 18 or over. However, some learners may be under 18, including students or younger learners undertaking a course which is usually expressly designed or approved for younger learners.

Where we know, or reasonably believe that a learner is under 18, we will take reasonable steps to ensure that our processing is fair, transparent and appropriate for the age and understanding of the learner. This may include:

• using clear and age-appropriate privacy information;

• limiting the personal information collected to what is necessary, in line with applicable data minimisation principles;

• applying appropriate access controls;

• restricting unnecessary sharing of information;

• taking account of any safeguarding or welfare considerations relevant to the course;

• seeking parental or guardian information where appropriate;

• assessing whether any additional consent or contractual arrangements are necessary

We will not rely on consent from an under-18 learner unless it is appropriate to do so under relevant data-protection law, taking into account the learner’s age, understanding and the nature of the processing. Where consent is required and we consider that the learner may not be able to provide valid consent themselves, we may ask for consent or confirmation from a parent, guardian, employer, training provider or other appropriate responsible adult. We may, however, rely on another lawful basis, such as contractual necessity, legitimate interests or legal obligations, rather than consent.

17. Changes to this notice

We may update this notice where:

• our services or suppliers change;

• we introduce new uses of information;

• legal or regulatory requirements change; or

• clarification is required.

The current version will be published within the LMS or on our website. Where a change materially affects existing learners, we will provide an appropriate notice.

18. Contact us

Questions about this notice or our handling of personal information should be directed to:

British Marine Federation

Tagus House, 9 Ocean Way, Southampton, England, SO14 3TJ

Company number: 02592536

ICO registration number: Z2203195

Data Protection Officer: Earle Stanner, CEO

Email: dataprotection@britishmarine.co.uk.

Telephone: 01784 473377