Legal

Privacy policy

Last updated 20 September 2026.

GOVBRM is run by one person trading as GOVBRM, a sole trader based in the United Kingdom. That person is the data controller for anything described on this page. GOVBRM is not a registered company. This page says what is and is not collected when you use this website, the AI Demand Toolkit, the courses and certificates of GOVBRM Academy, the Value Orchestration Workbook, the credential registry and BRM Diaries, and what your rights are.

The short version

• This website sets no cookies, runs no advertising or tracking script, and loads no third-party code. It does keep a plain count of how many times each page is opened, which records nothing about you.
• What you type into the toolkit, the workbook and the courses stays in your own browser on your own device. It is never sent to GOVBRM.
• GOVBRM holds personal data when you subscribe on Substack, book a live cohort or seat through Stripe, take part in a live cohort, apply for a funded place, message the GOVBRM LinkedIn page, or ask for a certificate to be entered in the credential register.
• Nothing is sold, rented or shared for marketing, and no automated decisions are made about you.

This website

govbrm.com is a set of static pages. It does not use cookies, loads no third-party code, and does not track you across visits or build any profile of you. The only code that runs is the site's own.

The site keeps a count of page views. When a page finishes loading it sends the path of that page, for example /framework/unit-3/, to a counter run by GOVBRM on Cloudflare, which adds one to a total for that page on that day. What is stored is a date, a path and a number. No cookie is set, no identifier is created, no IP address is kept, and there is nothing in the record that could be linked to you, to your device or to anything else you looked at. It cannot tell GOVBRM that the same person read two pages. Because it holds no personal data it does not need your consent, and there is nothing in it to ask for a copy of or to erase.

A few other things are counted the same way, as a date, a label and a number: the website that linked you here, recorded as the site's name only and never the full address, because a full address can carry personal data in it; the country the request came from, which Cloudflare works out at its network edge without GOVBRM seeing an address; how far readers get through a course, counted once per device per step; whether an access code was accepted or refused; which toolkit canvases are opened; how often a credential is checked; and any page that could not be found, so broken links can be fixed. None of these creates an identifier, and none of them can be joined up to describe a person. The few that are counted once per device use a marker stored in your own browser, which is never sent anywhere and which clearing your browser data removes. Cloudflare processes the request in order to run the counter under Cloudflare's privacy policy, and its servers may be outside the United Kingdom.

The site is hosted on GitHub Pages. Like any web host, GitHub's servers process standard technical data to serve the pages, typically your IP address, browser type and the pages requested. GOVBRM does not receive or view this data. It is processed by GitHub under GitHub's privacy statement, and GitHub's servers may be outside the United Kingdom.

What stays on your device

Several parts of the site save information in your browser's local storage. Local storage lives on your device, is not sent to GOVBRM or to anyone else, and is separate for each browser and each browser profile you use. The site saves:

• your answers in the AI Demand Toolkit, and your chosen lane
• your answers in the Value Orchestration Workbook
• the access code you enter for the framework, the toolkit and the courses, so that you are not asked for it every time
• your progress and knowledge-check answers in each course, which the Academy dashboard page reads to show you where you are
• the name, date and ID of the last certificate you generated, so that you can download it again
• a flag that records you have entered the site while it is in its pre-launch state

To remove this information: the toolkit lets you clear each canvas, the workbook has a clear button, and each course has a control to forget the access code. To remove everything at once, clear site data for govbrm.com in your browser's settings. Clearing it deletes your saved work and cannot be undone by GOVBRM, because GOVBRM never had a copy. On a shared or borrowed computer, export what you want to keep and clear the site data before you leave.

Exporting from the toolkit or the workbook creates a file that you choose where to save; importing reads a file that you choose. Printing uses your own browser's print function. None of these steps sends anything to GOVBRM.

Courses and access codes

The framework, the toolkit and the courses are opened with an access code that Substack sends in the welcome email when a membership starts. The code check runs in your browser: the course and framework text is stored on the site in encrypted form and is decrypted on your device with the code you enter. GOVBRM does not see when you use a code, which pages you open, or how you answer a knowledge check.

Some course units offer links that open a third-party AI assistant with a prepared question about the unit. If you use one of those links, the text of the prepared question, and anything you then type, goes to that service under its own terms and privacy policy, not GOVBRM's. The prepared question contains the unit topic only; it does not contain your name, your answers or your access code. You can complete every course without using these links.

Certificates and badges

When you pass the final knowledge check of a free micro-course you can generate a certificate by typing your name. The certificate is drawn in your browser on your device, and the name is used to draw it and to compute the credential ID printed on it.

At that point you are asked whether the certificate should be entered in the Academy's credential register. If you agree, your name, the credential, the issue date and the credential ID are sent to GOVBRM and stored, so that the certificate can be verified by anyone you show it to and so that GOVBRM has a record of what it has issued. If you do not agree, nothing is sent: the certificate is still yours to download and keep, it simply is not listed and its ID will not verify. The box is presented at the moment of issue and the choice is yours; the certificate is not withheld either way.

The lawful basis is your consent, which you can withdraw at any time by emailing GOVBRM, and the entry is then deleted. Register entries are kept for as long as GOVBRM Academy runs, because a credential that cannot be checked is of no use to the person holding it. The register is not used for marketing, is not sold or shared, and no decision about you is made from it.

The Add to LinkedIn profile button takes you to LinkedIn with the credential name, issuing organisation, date and ID in the link; what LinkedIn does with them is covered by LinkedIn's privacy policy.

The credential registry and the verification page

GOVBRM Academy publishes a small registry file listing practitioner and master credentials it has issued. For each credential it holds the credential ID, the credential name, the issue date and its status, and, only where the holder has agreed, the holder's name. The registry is public and can be read, copied and indexed by anyone, including search engines, so a name that has been published may persist elsewhere after it is removed here. You can decline to have your name listed when the credential is issued, and you can ask for it to be removed or corrected at any time; the entry then shows the ID, credential, date and status only. If a credential is withdrawn, the entry stays in the registry marked as withdrawn, without a name, so that the ID cannot be reused. The registry is currently empty.

The verification page reads the registry in your browser. For free micro-course certificates it computes the credential ID from the name and date you enter and compares it with the ID you are checking; those entries are processed in your browser and are not sent anywhere.

Live cohorts, seats and assessments

If you book a place on a live masterclass or a portfolio assessment, GOVBRM holds your name, email address, organisation, attendance record, submitted work and assessment outcome for the purposes of running the programme, marking the assessment, issuing the credential, handling any appeal and keeping a record of what was issued. The platform used for live sessions and for submitting work is named before you book, and its operator's privacy policy applies to what it processes. That platform, and the email and storage tools GOVBRM uses to run a cohort, may be outside the United Kingdom.

Payment for a seat or an assessment booked outright is taken on a page hosted by Stripe. Stripe collects your name, email address, organisation and payment details as a controller in its own right under Stripe's privacy policy. GOVBRM receives your name, email address and organisation from Stripe so that the seat can be confirmed and the certificate issued, and never sees your card details.

Applications for funded places

GOVBRM offers a small number of funded places on its masterclasses. The application form runs on Microsoft Forms. Microsoft processes what you submit on its own infrastructure under Microsoft's privacy statement, and its servers may be outside the United Kingdom.

The form asks for your name, your email address, whether you live in the United Kingdom, and why a funded place would make a difference to you. It also asks, so that places can be prioritised fairly, whether any of a list of circumstances apply to you. Some of those answers are sensitive: whether you are disabled or live with a long-term health condition is data about your health, which United Kingdom data protection law treats as special category data.

Answering those questions is voluntary and you can apply without answering them. They are used only to decide who is offered the funded places in that round, and never to set a price, to assess your work, or for any other purpose. The lawful basis is your consent, and for the sensitive answers your explicit consent, given when you submit the form. You can withdraw it by emailing GOVBRM, and the application is then deleted.

Applications are read only by GOVBRM. They are deleted twelve months after the round closes, except that GOVBRM keeps the name and email address of anyone offered a place for as long as the cohort record is kept, because a funded place is a booking like any other. Unsuccessful applications are not kept for future rounds unless you ask for that.

The newsletter and membership

BRM Diaries and all memberships run on Substack. If you subscribe, Substack collects and stores your email address and handles sending, unsubscribing, payments and related messages. Substack acts as GOVBRM's processor for the list and as a controller in its own right for its platform; its handling of your data is set out in Substack's privacy policy. If you take out a paid membership, Substack and its payment processor Stripe take the payment and hold the payment details; GOVBRM never sees your card details. GOVBRM can see your email address, your membership tier and the dates you joined or left, and uses them only to run the newsletter and to send the access code. GOVBRM runs no separate mailing list or sign-up form outside Substack. Substack's servers are outside the United Kingdom.

Messages

If you message the GOVBRM LinkedIn page, the message and your profile details are processed by LinkedIn under its own terms, and GOVBRM reads them to reply.

Why GOVBRM is allowed to use your data

United Kingdom data protection law applies to GOVBRM as a controller based in the United Kingdom. Where you are in the European Union or the European Economic Area, the EU General Data Protection Regulation may also apply to how your data is handled. If you are elsewhere, the law where you live may give you rights in addition to those set out here. The basis for each use is:

• Newsletter subscription and the access code: your consent, given when you subscribe, which you withdraw by unsubscribing.
• Running a live cohort or assessment you have booked, and issuing its credential: performance of the contract you enter when you book.
• Listing your name in the credential registry: your consent, which you can withdraw at any time.
• Keeping the credential ID, name of credential, date and status in the registry, and the record of what was issued: GOVBRM's legitimate interest in keeping an accurate record of credentials so that they can be verified and cannot be reused.
• Deciding who is offered a funded place: your consent, and your explicit consent for any answer about health or disability, both given when you submit the application form and withdrawable at any time.
• Entering a foundation certificate in the credential register: your consent, given by ticking the box when the certificate is issued, and withdrawable at any time.
• Counting page views: no personal data is involved, so no basis is needed.
• Reading and answering messages: GOVBRM's legitimate interest in responding to people who contact it.

Using this website does not, by itself, mean you have agreed to anything. Consent is only ever asked for when you subscribe or when you are asked whether your name may appear in the registry.

How long data is kept

• Newsletter and membership data: for as long as you are subscribed, then as Substack's own retention allows after you unsubscribe.
• Booking details received from Stripe: twelve months after the cohort or assessment ends, unless a credential is issued, in which case the cohort record applies.
• Cohort and assessment records, including submitted work and outcomes: for six years after the credential is issued, withdrawn or refused, for the record of what was issued and for any appeal or dispute.
• Registry entries: for as long as the Academy exists; a name is removed at your request, and a withdrawn credential's entry stays without a name.
• Funded-place applications: twelve months after the round closes, or, where a place is offered and taken, as part of the cohort record.
• Register entries for foundation certificates: for as long as the Academy runs, or until you ask for the entry to be deleted.
• Page view counts: indefinitely, as dated totals per page containing no personal data.
• Messages: twelve months after the last reply.
• Everything stored in your own browser: until you clear it.

Where data goes

Substack, Stripe, GitHub, Microsoft, Cloudflare and LinkedIn are based outside the United Kingdom and process data on their own infrastructure under their own terms, including the safeguards they rely on for international transfers. GOVBRM's own records of cohorts and bookings are kept in the United Kingdom where possible. The platform named for a cohort, and the email and storage tools GOVBRM uses to run it, may process data outside the United Kingdom under the safeguards those operators rely on for international transfers. GOVBRM does not otherwise transfer your data outside the United Kingdom.

What is not collected or done

• No special category data is asked for anywhere on this site, and none is wanted, with one exception: the voluntary equality questions on a funded-place application form, which are described above, are optional and are used only to award those places.
• No behavioural advertising, ad tracking or profiling of any kind. The page count described above is a tally per page, not a record of people.
• No data is sold, rented or shared with anyone for their own marketing.
• No automated decision-making about you. The knowledge checks and certificate IDs are computed on your device and GOVBRM makes no decision from them.
• The site and the Academy are for working practitioners and are not directed at children.

Your rights

You have the right to ask what personal data GOVBRM holds about you, to receive a copy, to have it corrected or deleted, to object to or restrict how it is used, to receive the data you provided in a usable form, and to withdraw any consent you have given. Withdrawing consent does not affect anything done before you withdrew it. For your Substack subscription the quickest route is the unsubscribe link in any email or your Substack account settings. For anything else, message the GOVBRM LinkedIn page. GOVBRM aims to reply within one month.

You can also complain to a supervisory authority. In the United Kingdom that is the Information Commissioner's Office. If you live elsewhere, you can complain to the data protection authority for where you live.

Changes to this page

If GOVBRM adds a contact form, changes how payments are taken, names a cohort platform or otherwise changes how data is handled, this page is updated first and the date at the top changes. Substantive changes are listed here with the date they were made.

• 14 September 2026: first published.