Privacy

Nick Mudie operates BSS/OSS Academy and is the data controller for the personal data described here. Questions, access requests and complaints go to nickymudie@hotmail.com.

Usage analytics

For every page view: the path, the referring site’s hostname, a country code, and a visitor identifier. The visitor identifier is a salted SHA-256 hash of your IP address and browser user-agent, recomputed daily — the IP address itself is never written to storage, and the hash cannot be reversed or matched across days.

Account details

For reviewer and administrator accounts only: a username, an email address, and a bcrypt hash of the password. Passwords are never stored or logged in readable form.

Sign-in records

For each sign-in attempt: the event type, a hash of the identifier used, the originating IP address, and the browser user-agent. Only the most recent 200 events are retained; older ones are discarded automatically.

Feedback you submit

The name, role and text you type into the feedback form. All three are optional except the text itself, and everything you enter there is intended for publication on this site.

Quiz results

A display name of your choosing, your score, and the difficulty level. The name is free text — you are not asked for, and should not enter, a real one.

There are no third-party analytics, advertising, or tag-management scripts on this site. Nothing is shared with an advertising network, a data broker, or a social platform. No cross-site tracking takes place, and no profile is built about you.

One cookie is set, and only after you sign in: bssoss_session, which holds your signed session and expires after eight hours. It is strictly necessary to keep you signed in, so no consent banner is shown for it.

Two pieces of browser storage are used for features you control: a session-storage key that stops a page view being counted twice in one visit, and a local-storage key holding any capability-heatmap edits you make on the eTOM mapping page. Both stay in your browser, are never transmitted, and are cleared when you clear site data.

Analytics are processed on the basis of legitimate interest — understanding which material is used, in a form that cannot identify you. Account and sign-in records are processed to operate the service and to detect credential-guessing, which is both a legitimate interest and a security obligation. Feedback and quiz entries are processed on the basis of your consent, given by submitting the form.

Analytics

Aggregated daily counters, deleted automatically after 400 days.

Sign-in records

The most recent 200 events only.

Sessions

Eight hours, or until you sign out.

Accounts

Until the account is deleted on request or by an administrator.

Feedback

Until you or an administrator asks for it to be removed.

Quiz results

The most recent 50 attempts only.

The site is hosted on Vercel, and data is stored in a managed Redis instance. Both may process data outside the UK and EEA under the standard contractual clauses their terms provide. No other processor is involved.

Under the UK GDPR you can ask for a copy of the personal data held about you, ask for it to be corrected or erased, object to processing based on legitimate interest, and withdraw consent for anything given on that basis. Write to nickymudie@hotmail.com and it will be actioned within one month.

Note that analytics data is deliberately not linkable to an individual, so it cannot be retrieved or deleted per person — that is a consequence of collecting it in a form that does not identify you.

If you are not satisfied with how a request was handled, you can complain to the Information Commissioner’s Office at ico.org.uk.

Material changes will be reflected in the date at the top of this page. See also the terms of use.