Privacy Policy

The Bespoke CV Consultant Ltd is the data controller responsible for your personal information in connection with BCV. This means we decide how and why your personal information is processed.

If you have any questions about this policy or how we handle your information, contact us using the details in Section 15.

The information we collect depends on whether you're purchasing the Course, using it as a Student, or getting in touch with us.

When you purchase the Course

• Name and email address
• Billing details necessary to process payment (handled directly by our payment processor — see Section 6; we do not store full card details ourselves)
• Whether the purchase is for yourself or as a gift, and, where applicable, the Student's name and email address

When you access or use the Course as a Student

• Account login details and password (stored securely, never in plain text)
• Course progress (which modules you've accessed or completed)
• Technical information such as IP address and device/browser type, used for account security and to apply per-student content protection (see Section 5)

When you contact us

• Your name, email address and the contents of your message

We do not knowingly collect any special category data (such as health information, religious beliefs or political opinions) and ask that you don't include this in any messages you send us.

Under UK data protection law, we must have a valid legal basis for each way we use personal information. We rely on the following:

• Contract — to process your purchase, provide access to the Course, deliver customer support, and send service communications necessary for that (purchase confirmation, access details, password resets), because this is necessary to perform our contract with the Purchaser (see Sections 2 and 6 of the Terms & Conditions).
• Contract — to send the course-guidance emails that form part of the Course itself (such as the post-purchase email sequence). Where these emails are limited to helping the Student use and progress through the Course, we treat them as part of delivering the Course rather than as promotional marketing. A Student can still opt out of them at any time without affecting their access to the Course — see Section 7.
• Legitimate interests — to protect the Course from unauthorised sharing (Section 5 below), to keep our platform secure, and to understand and improve how the Course is used, where these interests aren't overridden by your rights.
• Consent, or the PECR "soft opt-in" for existing customers where its conditions are met — for any promotional marketing about BCV or other products/services. We'll always give you a clear way to opt out, both when your details are first collected and in every marketing message. See Section 7.
• Legal obligation — to keep financial and accounting records as required by law.

To help protect the Course from unauthorised copying or distribution, materials made available to each Student may be individually watermarked or otherwise associated with that Student's account.

This is a deterrence and traceability measure, not a guarantee that content cannot be copied or shared. We use it, together with technical measures such as blocking public file access, solely to identify and act on breaches of the Terms & Conditions (see Section 13 of the Terms & Conditions) — not to monitor your general activity beyond that purpose.

We don't sell personal information. We share it only with the following types of organisation, and only as needed to run BCV:

• Payment processing — Stripe, to process card payments securely. Stripe processes your payment details directly; we do not see or store full card numbers.
• Database and account authentication — Supabase, to store and manage account, login and Course data.
• Hosting — Vercel, to run our website and course platform.
• Email delivery — our email service provider, to send purchase confirmations, access details, course-use emails and, where applicable, marketing emails in accordance with Section 7.
• Professional advisers — such as our accountant or solicitor, where necessary and under confidentiality obligations.
• Legal or regulatory bodies — where we're required to by law, or to protect our rights, property or safety, or that of our Students.

We send three distinct types of email, and treat each differently:

Service emails

Purchase confirmation, access details, password resets, and security notices. These are necessary to provide the Course and can't be opted out of while you hold an active account.

Course-use emails

This covers the guidance and reminder emails that support the Course itself — such as the post-purchase email sequence sent to the Student across the academic year. Where these emails are limited to helping the Student use and progress through the Course, we treat them as part of delivering the Course rather than promotional marketing, and keep them free of sales or promotional content to reflect that. You can still unsubscribe from this sequence at any time using the link in any email, or by contacting us — this won't affect your underlying access to the Course.

Marketing emails

Promotional messages about BCV or any other products or services, if we send these. Where we do, we'll only send them with your consent, or — for existing customers — under the PECR "soft opt-in," and only where its conditions are genuinely met: you were given a clear opportunity to opt out when your details were first collected, and every message gives you a clear way to opt out going forward.

Where a Course is bought as a gift, we don't assume the Purchaser's consent extends to marketing the Student — each person's marketing preferences are their own, and we don't use a parent's purchase as a basis for marketing to the Student directly.

We do not share your details with third parties for their own marketing purposes.

Our website and course platform use cookies that are essential for them to work — for example, to keep you logged in, maintain essential account functionality, and remember your progress through the Course.

We currently do not use analytics or advertising cookies. If this changes, we will update this section and ask for your consent where required before setting any non-essential cookie.

We securely delete or anonymise personal information once it's no longer needed for the purposes it was collected for, unless we're required to keep it longer by law.

We use appropriate technical and organisational measures to protect your personal information, including encryption, secure password storage, access controls, row-level database security, and restricting administrator access to those who need it to operate BCV.

No online service can guarantee complete security. If you believe your account has been compromised, contact us immediately using the details in Section 15.

Two of our processors store or process information in the United States: Supabase (database and authentication) and Vercel (hosting). Both are able to provide the safeguards UK data protection law requires for this kind of transfer:

• Supabase's Data Processing Addendum incorporates the UK International Data Transfer Addendum and the EU Standard Contractual Clauses.
• Vercel provides equivalent UK transfer safeguards through its own Data Processing Addendum.

We have accepted and retain a copy of Supabase's Data Processing Addendum, and hold either an upgraded Vercel plan or written confirmation from Vercel that appropriate processor terms cover our account.

We keep this arrangement under review. If we relocate hosting to a UK or EU region in future, we'll update this section accordingly.

BCV is designed for university students and is not intended for children under 13. Some university students may be under 18. Where we process their personal information, we apply the protections required by UK data protection law, including the ICO's Children's Code where it applies to our services.

The consent age for data protection purposes in the UK is 13 — if we ever relied on consent to process a child under 13's information, we would seek parental consent first. In practice, our Course is not aimed at or accessed by children under 13, and if you believe a child has provided us with personal information inappropriately, please contact us and we will delete it.

Under UK data protection law, you have the right to:

• Access the personal information we hold about you;
• Correct inaccurate or incomplete information;
• Erase your information, in certain circumstances;
• Restrict or object to certain processing;
• Data portability — receive your information in a portable format, where technically feasible; and
• Withdraw consent at any time, where we rely on consent (such as marketing emails) — you can also unsubscribe from course-use emails without this affecting your access, see Section 7.

Where a Purchaser and Student are different people, each may exercise these rights over their own personal information — a Purchaser can't use these rights to access a Student's private course progress, and vice versa.

To exercise any of these rights, contact us using the details in Section 15. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk, though we'd appreciate the chance to resolve any concern directly first.

We may update this Privacy Policy from time to time, for example if we change our processors, add new features, or if data protection law changes.

Where changes are significant, we'll take reasonable steps to let existing Purchasers and Students know. The latest version will always be available through our website.

If you have any questions, concerns, or want to exercise any of your rights, please get in touch: