Data Processing Information

Blueprint to Brilliance is generally the controller for information used to operate our own website, sales, bookings, client administration and business records. Where a client instructs us to process personal information solely on its behalf as part of an agreed service, we may act as a processor and the client may act as controller.

Where we act as processor, the parties should put appropriate written data processing terms in place covering the subject matter and duration of processing, nature and purpose, types of personal data, categories of data subjects, documented instructions, confidentiality, security, sub-processors, assistance obligations, deletion or return, and audit/information rights as required by applicable law.

The platform uses Supabase for database and authentication functionality, Railway for production hosting, and Stripe for secure payment processing. Stripe handles payment-card details directly; those card details are not stored in the Blueprint to Brilliance application.

We use suppliers only where they are reasonably necessary to operate the platform or deliver contracted services. Before material production use, we assess the supplier's role, security, contractual terms and relevant data-location or international-transfer considerations. A current list of material sub-processors can be provided to clients where required by contract.

Our platform uses authenticated access, role-based permissions, encrypted network connections and Supabase row-level security policies designed to restrict access to protected records. We also use validation and rate-limiting controls for public forms and maintain administrative access controls for staff functions.

Security is reviewed as the service develops. Clients remain responsible for access they grant to their own authorised users and for notifying us promptly when user access should be changed or removed.

Technology providers may operate infrastructure in more than one country. Where personal information subject to UK transfer restrictions is transferred internationally, we will use an applicable adequacy arrangement, approved contractual safeguard or other lawful mechanism where required.

Controller records are retained in accordance with our Privacy Policy and legal or contractual requirements. Where we act as a processor, retention, deletion or return will follow the client's documented instructions and the applicable service or data processing agreement, subject to information we are legally required to retain.

We maintain procedures intended to identify and respond to relevant security incidents. Where we act as processor and become aware of a personal data breach affecting client-controlled data, we will notify the relevant client without undue delay in accordance with the applicable agreement and law, and provide reasonable information available to us to support the client's response obligations.

Clients that require a data processing agreement, sub-processor information, security questionnaire response or other privacy documentation should contact us using the details on our Contact page before production processing begins.