Privacy Policy

1. Introduction

Chefs Bay Academy is operated by Chefs Bay Hospitality Limited (Company No. 13588811), registered in England and Wales. Our registered address is Liscard Business Centre, 188 Liscard Rd, Wallasey, CH44 5TN.

We are committed to protecting your personal data and respecting your privacy. This policy explains how we collect, use, store, and protect the information you provide when using our website at chefsbayacademy.co.uk and our online training platform.

For the purposes of data protection legislation, Chefs Bay Hospitality Limited is the data controller.

2. Data We Collect

We may collect and process the following personal data:

Identity data: Your name and email address, provided when you purchase a licence or contact us.
Payment data: Payment card details are processed securely by Stripe. We do not store your full card details on our servers.
Course progress data: Information about which courses you have started, completed, and the certificates you have earned.
Technical data: Your IP address, browser type and version, device type, operating system, and browsing behaviour on our website. This data is collected through cookies and analytics tools.
Communication data: Any information you provide when you contact us by email or phone, including your name, email address, and the content of your message.

3. How We Use Your Data

We use your personal data for the following purposes:

Account management: To create and manage your training platform account and provide you with login credentials.
Course access: To grant you access to courses, track your progress, and issue CPD accredited certificates upon completion.
Payment processing: To process your payment securely through Stripe and provide receipts or invoices.
Communication: To respond to your enquiries, send you important updates about your account or courses, and provide customer support.
Website improvement: To analyse how visitors use our website so we can improve the user experience, content, and performance.
Advertising measurement, with your consent: To understand whether our OpenAI ads lead to people starting checkout or completing a purchase.
Legal compliance: To comply with our legal obligations, including tax and accounting requirements.

Optional analytics and advertising measurement are controlled by your cookie choices. We do not sell your personal data. Choosing advertising measurement permits the OpenAI event sharing described below; it does not sign you up for marketing emails.

4. Cookies and your choices

Our website uses cookies to ensure it functions correctly and to help us understand how visitors use it.

Essential cookies

These cookies are necessary for the website to function and cannot be switched off. They include cookies that remember your preferences and enable core functionality like secure payment processing.

Analytics cookies

With analytics consent, Google Analytics measures website use and checkout activity using browser identifiers and event data. These identifiers are not the same as anonymous information. We remove the payment-session access identifier from the page address sent to Google Analytics.

With analytics consent, Apollo's website tracker also loads. It uses browser and network information to identify the company a visit comes from, and in some cases the individual visiting, so that we can follow up business enquiries. Person-level identification applies to visitors in the United States only. Withdrawing consent stops the tracker loading on later pages. See Apollo's privacy policy.

Advertising measurement

With advertising consent, the OpenAI Pixel and our server-side Conversions API report checkout starts and verified purchase confirmations. Events include the access plan, quantity, amount and currency, a conversion identifier, and available advertising or browser references. Our server event does not include your name, email, phone number, card details or payment-session access link. Browser requests also expose ordinary connection information to the service receiving them.

Automatic advanced matching is enabled for our OpenAI Pixel. With advertising consent, the Pixel can detect supported customer information available on a page, such as an email address, phone number or name. It normalises and hashes that information in your browser before including the hashes with events. Hashing does not make personal information anonymous. Our server-side events do not add customer contact details or their hashes. We set the event option that opts out of future user-level personalisation.

OpenAI's Pixel uses the first-party __oppref cookie for an ad reference, with a requested lifetime of 30 days, and __obref for a browser reference, with a requested lifetime of 365 days. Browser restrictions can shorten those periods. These are cookie lifetimes, not a promise about how long conversion reports are retained. See OpenAI's privacy policy.

Analytics and advertising are off until you choose them. Use here or in the footer to change your choices. Rejecting or withdrawing consent stops future optional measurement and removes the corresponding first-party measurement cookies where the browser permits. Withdrawing consent does not remove events already sent. The essential cba_measurement preference cookie remembers your choices for up to 180 days. You can still browse, buy and use training without accepting optional measurement.

Vercel Analytics

With analytics consent, Vercel Web Analytics measures visits and page use. It does not use analytics cookies. We remove query strings and fragments from the page address sent to this service.

5. Third Parties

We share your data with the following third-party service providers, who process it on our behalf:

Stripe — Processes payments securely. Stripe is PCI DSS Level 1 certified. See Stripe's Privacy Policy.
Google Analytics — Measures website usage when you consent to analytics. See Google's Privacy Policy.
Apollo — Identifies the companies visiting our website when you consent to analytics. See Apollo's Privacy Policy.
OpenAI — Receives advertising conversion events when you consent to advertising measurement. See OpenAI's Privacy Policy.
Vercel — Hosts our website and provides performance analytics. See Vercel's Privacy Policy.

We ensure that all third-party providers have appropriate data protection measures in place and process your data only for the purposes we have specified.

6. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes for which it was collected:

Account data: Retained for the duration of your licence plus 12 months, to allow you to access your certificates and re-purchase if needed.
Payment records: Retained for 7 years as required by UK tax and accounting legislation.
Course completion records: Retained for 3 years after your licence expires, so we can verify certificate authenticity if requested by you or your employer.
Communication records: Retained for 2 years after your last interaction with us.
Analytics data: Aggregated and anonymised analytics data may be retained indefinitely.

7. Your Rights Under GDPR

Under the UK General Data Protection Regulation (UK GDPR), you have the following rights:

Right of access: You can request a copy of the personal data we hold about you.
Right to rectification: You can ask us to correct any inaccurate or incomplete personal data.
Right to erasure: You can ask us to delete your personal data, subject to our legal obligations to retain certain records.
Right to restrict processing: You can ask us to limit how we use your personal data in certain circumstances.
Right to data portability: You can request your personal data in a structured, commonly used, machine-readable format.
Right to object: You can object to the processing of your personal data in certain circumstances, including processing for direct marketing.

To exercise any of these rights, please contact us using the details below. We will respond to your request within 30 days. There is no fee for making a request, unless the request is clearly unfounded or excessive.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

8. How to Contact Us

If you have any questions about this privacy policy, or wish to exercise your data protection rights, please contact us:

Email: workwithus@chefsbay.co.uk
Phone: 0151 440 2249
Post: Chefs Bay Hospitality Limited, Liscard Business Centre, 188 Liscard Rd, Wallasey, CH44 5TN

9. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. When we make changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.