Effective date: 1 June 2026 — Last reviewed: June 2026
1. Who We Are
The British Society for Accreditation of Professional Engineers (BSAPE) is a professional body incorporated and registered in Scotland, United Kingdom, operating as part of the BOMEQP Group. BSAPE acts as the data controller for personal information collected through this website and through its accreditation processes.
For data protection enquiries, contact us at: privacy@bsape.com
2. What Personal Data We Collect
We may collect and process the following categories of personal data:
- Contact information: name, email address, telephone number, and postal address
- Professional information: engineering discipline, qualifications, work experience, employer details, and CPD records
- Application data: information submitted as part of professional accreditation or approved provider applications
- Identity verification: copies of academic certificates, professional references, and identification documents where required
- Website usage data: IP address, browser type, pages visited, and session duration (collected via cookies)
- Communications: records of email correspondence, enquiry form submissions, and meeting notes
3. How We Use Your Personal Data
We use your personal data for the following purposes:
- Processing applications for professional accreditation certificate types (Certificate of Completion, Certificate of Skill, Certificate of Achievement)
- Administering organisational accreditation and Approved Provider assessments
- Managing your professional record and issuing certificates and credentials
- Communicating with you about your application, membership, or enquiry
- Maintaining the integrity of the BSAPE credential verification register
- Sending updates about CPD requirements, policy changes, or BSAPE news (where you have consented)
- Complying with our legal and regulatory obligations
- Improving our website and services through anonymised analytics
4. Legal Basis for Processing
We process your personal data under the following lawful bases as defined by UK GDPR:
- Contract performance: to process your application and deliver the accreditation services you have requested
- Legitimate interests: to maintain the public register of BSAPE-accredited professionals and protect the integrity of our credentials
- Legal obligation: to comply with applicable laws and respond to regulatory or law enforcement requests
- Consent: for optional marketing communications, newsletters, and non-essential cookies — you may withdraw consent at any time
5. Sharing Your Personal Data
BSAPE does not sell or rent your personal data to third parties. We may share your data in the following limited circumstances:
- With independent assessors and peer reviewers involved in evaluating your application, bound by confidentiality obligations
- With IT service providers who process data on our behalf under a data processing agreement (e.g., email systems, cloud storage)
- On our public credential verification register: your name, certificate type, and credential reference only — unless you request otherwise
- With regulatory authorities or law enforcement where required by law
- Where you have given explicit consent for any other form of disclosure
6. Data Retention
We retain your personal data for as long as necessary to fulfil the purposes for which it was collected, subject to the following:
- Accredited professionals: records retained for the duration of active accreditation plus 7 years after lapse or withdrawal
- Unsuccessful applicants: application data retained for 2 years from the date of the final decision
- Enquiry and contact form data: retained for 12 months unless a subsequent application is received
- CPD records: retained for a minimum of 5 years
- Website analytics data: anonymised and retained for up to 26 months
7. Your Rights
Under UK GDPR, you have the following rights in relation to your personal data:
- Right of access: request a copy of the personal data we hold about you
- Right to rectification: ask us to correct inaccurate or incomplete data
- Right to erasure: request deletion of your data in certain circumstances
- Right to restrict processing: ask us to limit how we use your data
- Right to data portability: receive your data in a structured, machine-readable format
- Right to object: object to processing based on legitimate interests
- Rights related to automated decision-making: BSAPE does not make solely automated decisions that produce legal effects
To exercise any of these rights, contact us at privacy@bsape.com. We will respond within one calendar month of receiving your request.
8. Cookies
Our website uses strictly necessary cookies to ensure it functions correctly. We also use optional analytics cookies to understand how visitors use the site — these are only placed with your consent. You can manage your cookie preferences at any time via the cookie settings link in the footer.
9. How to Complain
If you are not satisfied with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:
- ICO website: www.ico.org.uk
- ICO helpline: 0303 123 1113
We would always appreciate the opportunity to resolve concerns directly before you approach the ICO.
10. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Material changes will be communicated via a notice on our website. The effective date at the top of this page will be updated accordingly.