BMH Partner Portal Privacy Policy

1. Who we are

BMH Online Solutions Ltd (“BMH”, “we”, “us” or “our”) operates the BMH Partner Portal (the “Portal”).

Company number: 17388654
Registered office: 14 Dorchester Road, England, United Kingdom.

For privacy and data protection enquiries, contact us at partners@bmh-online.co.uk.

2. About this Privacy Policy

This Privacy Policy explains how BMH collects, uses, stores and protects personal data in connection with the Portal and the BMH Partner Programme. It also explains the rights available to individuals under applicable UK data protection law.

We aim to collect and use personal data only where there is a clear purpose for doing so, to keep it accurate and secure, and not to retain it for longer than necessary. This notice is intended to provide the information required by applicable data protection law, including the UK GDPR and the Data Protection Act 2018, as applicable.

3. Who this Policy applies to

This Policy primarily applies to people who create or use a BMH Partner Portal account, participate in the BMH Partner Programme, submit referrals, receive commission statements or otherwise interact with BMH through the Portal.

It may also apply to individuals whose personal data is provided to BMH in connection with Portal activity where BMH has a lawful reason to process that information. Where personal data is obtained from another source, we will provide the information required by applicable law where required.

4. Personal data we collect

Depending on how you use the Portal, we may collect:

• Identity and account information, such as name, email address, account status and authentication-related information.
• Contact information, such as email address and other contact details you choose to provide.
• Partner programme information, including referral submissions, referral status, referral ownership and related notes.
• Commission information, including eligible service/category, applicable tier, fixed commission amount, commission status, dates, project value and payment-related records.
• Bank and payout information needed to verify and make commission payments, together with audit information concerning changes to payout details.
• Portal activity, security and audit information, including records needed to protect the Portal, investigate issues and maintain accountability.
• Communications and notification records, including records necessary to administer Portal notifications and email delivery.
• Information you provide when contacting BMH or requesting changes to your account.

5. Information provided about other people

The Portal is designed around the Partner’s participation in the BMH Partner Programme. BMH does not create a Portal account for a person merely because that person or business has been referred, and referral subjects do not become partners or receive commission through the Portal.

Where BMH receives personal data about another individual in connection with a referral or other business activity, BMH will only process that information where there is an applicable lawful basis and for a relevant business purpose. This Policy does not make the referral subject a Portal user or a party to the Partner Terms.

6. Why we use personal data

• create, authenticate and administer Partner Portal accounts;
• administer participation in the BMH Partner Programme;
• receive and manage referrals and determine their status and eligibility under the Partner Terms;
• calculate, record and administer commissions in accordance with the applicable fixed commission rates and partner tier rules;
• administer bank details and make authorised commission payments;
• send transactional, account, commission, payment, security and programme notifications;
• maintain records and audit trails concerning referrals, commissions, payments, account changes and other Portal activity;
• provide support and respond to enquiries;
• protect the Portal and BMH systems against misuse, fraud, unauthorised access and other security threats;
• comply with applicable legal, accounting, tax and regulatory obligations; and
• exercise or defend legal rights and manage disputes where necessary.

7. Lawful bases for processing

We will identify an appropriate lawful basis for each relevant processing activity. The principal bases used in connection with the Portal are:

Where we rely on legitimate interests, we will consider the purpose, necessity and balance between our interests and the individual’s rights and expectations. We will not rely on legitimate interests where another lawful basis is more appropriate.

8. Information you must provide

Some personal data is necessary for BMH to create and administer a Portal account, administer the Partner Programme, determine commission eligibility or make a commission payment. Where information is required for these purposes, failure to provide it may mean that we cannot provide the relevant Portal functionality, administer the relevant programme activity or make the relevant payment.

9. Automated processing and decision-making

The Portal uses automated system processes to support administrative functions such as account management, referral status handling, commission calculations, notifications, audit records and security controls.

Commission calculations and eligibility-related processing are performed according to the business rules configured for the Partner Programme. Where a decision produces a legal or similarly significant effect on an individual, BMH will not rely solely on automated processing unless permitted by applicable law and the required safeguards are in place. Where applicable, individuals will be provided with the rights required by law in relation to automated decision-making.

10. Who we share personal data with

• service providers that host, maintain or support the Portal and its infrastructure;
• authentication, database, application and cloud service providers used to operate the Portal;
• Microsoft 365 and Microsoft Graph services used for BMH email and notification delivery;
• banking or payment-related providers where necessary to administer authorised payments;
• professional advisers, accountants, insurers, auditors or legal advisers where reasonably necessary;
• law enforcement, courts, regulators or other public authorities where required or permitted by law; and
• other persons where necessary to protect BMH’s rights, property, security or users.

We require service providers processing personal data on our behalf to handle that data appropriately and in accordance with applicable data protection requirements.

11. International transfers

Some service providers used by BMH may process personal data outside the United Kingdom. Where personal data is transferred internationally, BMH will use an appropriate lawful transfer mechanism and safeguards required by applicable data protection law.

Further information about relevant international transfers and safeguards can be provided on request where appropriate.

12. Security

BMH uses technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, loss or destruction. These measures include access controls, authentication, role-based permissions, security and audit records, controlled handling of sensitive information and appropriate safeguards for Portal infrastructure and communications.

No internet-based system can be guaranteed to be completely secure. BMH will investigate and respond to suspected personal data incidents in accordance with applicable legal and internal requirements.

13. Retention of personal data

We retain personal data only for as long as reasonably necessary for the purposes for which it is processed, including to administer the Partner Programme, maintain appropriate business and audit records, resolve disputes, protect our legal interests and comply with legal, accounting, tax and regulatory obligations.

The exact retention period depends on the type of information, why it is held, the relationship with the individual, applicable legal or regulatory requirements and whether there is an ongoing legitimate business or legal need to retain it.

We maintain internal retention rules and review information periodically. When personal data is no longer required, we will delete it, securely dispose of it or anonymise it where appropriate. Some records may need to be retained after a Portal account is closed where necessary for legitimate business, legal, accounting, payment, audit or dispute purposes.

14. Your rights

• request access to your personal data;
• request correction of inaccurate or incomplete personal data;
• request erasure of personal data in appropriate circumstances;
• request restriction of processing in appropriate circumstances;
• object to processing based on legitimate interests or for direct marketing, subject to applicable rules;
• request portability of certain personal data where the right applies; and
• withdraw consent where we rely on consent as the lawful basis for a particular processing activity.

You may also have rights relating to automated decision-making and profiling where applicable. Requests should be sent to partners@bmh-online.co.uk. We may need to verify your identity before responding to a request.

15. Complaints

If you have concerns about how BMH uses your personal data, please contact us first at partners@bmh-online.co.uk so that we can investigate and try to resolve the issue.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection. Further information is available from the ICO.

16. Cookies and similar technologies

The Portal may use cookies or similar technologies that are necessary to provide secure authentication, maintain sessions, remember necessary preferences and operate the Portal. Where non-essential cookies or similar technologies are used, BMH will provide the information and obtain consent where required by applicable law.

17. Marketing communications

The BMH Partner Portal primarily supports transactional and programme-related communications, such as account, referral, commission, payment and security notifications. If BMH sends direct marketing communications, it will do so in accordance with applicable data protection and electronic communications laws, including the Privacy and Electronic Communications Regulations (PECR), where applicable. Where consent is required, BMH will obtain it before sending the relevant marketing communications.

18. Children

The BMH Partner Programme is a business-to-business programme and is not directed at children. BMH does not knowingly seek to collect children’s personal data through the Portal.

19. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to the Portal, our processing activities, applicable law or regulatory guidance. The latest version will be made available through the Portal or the relevant BMH website. Where appropriate, we will provide additional notice of material changes.

20. Contact

For privacy, data protection or Portal-related enquiries, contact: