Privacy Policy — BrillianceWay

This Privacy Policy explains how BrillianceWay (brillianceway.com) (“BrillianceWay”, “we”, “us” or “our”) collects, uses, shares and protects your personal data when you use our website, platform and services (the “Service”), and the rights you have over your data. We handle personal data in accordance with the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.

For the personal data described in this policy, we act as the data controller. If you have any questions or wish to exercise your rights, you can reach us through our Contact page.

1. Information we collect

We collect the following categories of personal data:

Account and profile data — such as your name, email address, password (stored securely), role (student, parent or teacher) and year group or qualification level.
Your Content — learning materials, assignments, uploaded files and other material you submit or generate through the Service.
Usage and technical data — such as IP address, device and browser information, pages visited and actions taken, collected through logs and cookies.
Communications — messages you send us, including via our Contact page.
Payment data — where you purchase a subscription, payment is processed by our third-party payment provider; we do not store full card details.

2. How we use your data and our legal bases

We use personal data to:

provide and operate the Service (legal basis: performance of a contract);
process AI features — your relevant Content may be processed by our AI providers to generate learning assistance, practice questions and revision support (performance of a contract);
secure the Service and prevent fraud and abuse, including bot protection (legitimate interests);
communicate with you about your account, support and service updates (performance of a contract / legitimate interests);
improve the Service and understand how it is used (legitimate interests);
send marketing where you have asked us to or where permitted — you can opt out at any time (consent / legitimate interests); and
comply with our legal obligations (legal obligation).

3. Sharing your data

We do not sell your personal data. We share it only with:

service providers (sub-processors) who help us run the Service — including cloud hosting, AI processing, email delivery, payment processing and security/anti-bot providers — under contracts that require them to protect your data;
professional advisers, regulators or authorities where required by law; and
a successor entity in connection with a merger, acquisition or reorganisation.

4. International transfers

Some of our providers may process data outside the UK. Where they do, we put in place appropriate safeguards (such as a UK adequacy decision or the International Data Transfer Agreement / Standard Contractual Clauses) so that your data remains protected.

5. Data retention

We keep personal data only for as long as necessary for the purposes set out in this policy, including to provide the Service, comply with legal obligations, resolve disputes and enforce our agreements. When you close your account, we delete or anonymise your data after a reasonable period, unless we are required to keep it.

6. Security

We use appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, tenant isolation and audit logging. No method of transmission or storage is completely secure, but we work to protect your data and to respond appropriately to any incident.

7. Your rights

Under the UK GDPR you have the right to:

access the personal data we hold about you;
rectify inaccurate or incomplete data;
erase your data (“right to be forgotten”) in certain circumstances;
restrict or object to certain processing;
data portability — receive your data in a portable format;
withdraw consent at any time where we rely on it; and
complain to the Information Commissioner's Office (ICO) at ico.org.uk.

To exercise any of these rights, please contact us through our Contact page. We would appreciate the chance to address your concerns before you approach the ICO.

8. Cookies

We use cookies and similar technologies as described in our Cookie Policy.

9. Children

The Service is designed to be used by students of all ages with parental or guardian consent. Where a student is under 13, we require a parent or guardian to create and manage the account on their behalf. We process children's data with the care required under the UK GDPR and the Children's Code (Age Appropriate Design Code).

10. Changes to this policy

We may update this Privacy Policy from time to time. Where changes are material we will take reasonable steps to notify you. The “Last updated” date above shows when this policy was last revised.

11. How to contact us

If you have any questions about this Privacy Policy or how we handle your data, please contact us through our Contact page.

1. Information we collect

We collect the following categories of personal data:

Account and profile data — such as your name, email address, password (stored securely), role (student, parent or teacher) and year group or qualification level.

Your Content — learning materials, assignments, uploaded files and other material you submit or generate through the Service.

Usage and technical data — such as IP address, device and browser information, pages visited and actions taken, collected through logs and cookies.

Communications — messages you send us, including via our Contact page.

Payment data — where you purchase a subscription, payment is processed by our third-party payment provider; we do not store full card details.

2. How we use your data and our legal bases

We use personal data to:

provide and operate the Service (legal basis: performance of a contract);

process AI features — your relevant Content may be processed by our AI providers to generate learning assistance, practice questions and revision support (performance of a contract);

secure the Service and prevent fraud and abuse, including bot protection (legitimate interests);

communicate with you about your account, support and service updates (performance of a contract / legitimate interests);

improve the Service and understand how it is used (legitimate interests);

send marketing where you have asked us to or where permitted — you can opt out at any time (consent / legitimate interests); and

comply with our legal obligations (legal obligation).

3. Sharing your data

We do not sell your personal data. We share it only with:

service providers (sub-processors) who help us run the Service — including cloud hosting, AI processing, email delivery, payment processing and security/anti-bot providers — under contracts that require them to protect your data;

professional advisers, regulators or authorities where required by law; and

a successor entity in connection with a merger, acquisition or reorganisation.

5. Data retention

6. Security

7. Your rights

Under the UK GDPR you have the right to:

access the personal data we hold about you;

rectify inaccurate or incomplete data;

erase your data (“right to be forgotten”) in certain circumstances;

restrict or object to certain processing;

data portability — receive your data in a portable format;

withdraw consent at any time where we rely on it; and

complain to the Information Commissioner's Office (ICO) at ico.org.uk.

To exercise any of these rights, please contact us through our Contact page. We would appreciate the chance to address your concerns before you approach the ICO.

9. Children