Introduction
Business Today Simulations LLC ("BT Simulations," "we," "us," or "our") is a business simulation training company registered at 1315 Walnut St. Ste 801, Philadelphia, PA 19107, USA. We are the data controller for personal information collected through our services.
This Privacy Policy applies to:
- Our public website at btsimulations.com
- The BT Simulations IBP (Independent Business Partner) Portal
- Our referral intake form at affiliate.btsimulations.com
- Any other digital touchpoints operated by BT Simulations
By using any of the above, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with its terms, please discontinue use of our services.
Data We Collect
The personal data we collect depends on how you interact with us:
| Context | Data Collected |
|---|---|
| IBP Portal Registration | First name, last name, work email address, organization name, password (stored as a one-way hash — never in plain text) |
| Admin-Created Accounts | Full name, email, organization, country, assigned role (admin or client) |
| CCR Submissions | Client organization name, simulation program name, trainer/facilitator name, course dates, number of participants, amount invoiced, royalty deduction details, country of delivery, fiscal year |
| Referral Inquiry Form | Full name, email address, organization name, phone number (optional), simulation program interest, approximate team size, goals or message (optional), name of referrer |
| Automatically Collected | Account creation timestamp, last login timestamp. We do not collect IP addresses, browser fingerprints, or device identifiers. |
We do not collect sensitive personal data such as health information, financial account numbers, government IDs, racial or ethnic origin, political opinions, or religious beliefs.
How We Use Your Data
We use personal data only for the purposes for which it was collected:
- Account management — creating and maintaining your IBP Portal account, enabling secure login, and communicating account-related information
- CCR processing — receiving, storing, reviewing, and auditing Completed Course Register submissions for billing, royalty calculations, and partner reporting
- Inquiry handling — responding to program inquiries submitted through the referral funnel and connecting interested clients with our program advisors
- Transactional communications — sending email confirmations, password reset links, and account notifications via Supabase
- Security — detecting and preventing fraud, unauthorized access, and abuse of our platform
- Legal compliance — meeting audit, financial reporting, and regulatory obligations
We do not use your personal data for advertising, behavioral tracking, or sale to third parties.
Legal Basis for Processing (GDPR)
For users in the European Economic Area (EEA) or United Kingdom, we process personal data under the following legal bases as defined by the General Data Protection Regulation (GDPR):
- Contract performance (Art. 6(1)(b)) — processing necessary to provide the IBP Portal service, process CCR submissions, and fulfil our obligations under IBP agreements
- Legitimate interests (Art. 6(1)(f)) — fraud prevention, platform security, audit obligations, and internal reporting. These interests do not override your fundamental rights and freedoms.
- Consent (Art. 6(1)(a)) — processing of inquiry form submissions and your cookie/local storage consent preference
- Legal obligation (Art. 6(1)(c)) — retaining financial records (CCR data) for the legally required period
You may withdraw consent at any time where consent is the legal basis for processing. Withdrawal does not affect the lawfulness of processing before withdrawal.
Data Storage & Security
All personal data collected through BT Simulations services is stored in Supabase, a cloud database platform built on PostgreSQL and hosted on Amazon Web Services (AWS) infrastructure in the United States.
We implement the following security measures:
- Row-Level Security (RLS) — enforced at the database level so that each user can only access their own data; administrators can access all records only within their authorized scope
- Password hashing — passwords are encrypted using bcrypt via Supabase Auth and are never stored or transmitted in plain text
- HTTPS encryption — all data transmitted between your browser and our servers is encrypted in transit using TLS
- Rate limiting — login attempts are limited to five (5) per window; accounts are temporarily locked after repeated failures to prevent brute-force attacks
- Access controls — administrative access to data is restricted to authorised BT Simulations staff only
While we implement industry-standard security measures, no system is perfectly secure. We encourage you to use a strong, unique password and to notify us immediately if you suspect your account has been compromised.
International Data Transfers
Business Today Simulations serves clients and partners in 50+ countries. As a result, your personal data may be accessed by BT Simulations staff or authorized partners located outside your country of residence, including outside the European Economic Area (EEA).
All data is stored on Supabase infrastructure in the United States. For users in the EEA, UK, or other jurisdictions with data transfer restrictions:
- Transfers to the United States are governed by Standard Contractual Clauses (SCCs) as established by the European Commission
- Supabase complies with applicable data protection requirements; see supabase.com/privacy for details
- We do not transfer your personal data to countries that do not provide an adequate level of data protection without appropriate safeguards
By using our services, you acknowledge and consent to the transfer and processing of your personal data in the United States and other countries where BT Simulations or its service providers operate.
Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:
| Data Type | Retention Period |
|---|---|
| IBP Portal account profile | Duration of active account + 3 years after last login or account closure |
| CCR submissions and financial data | 7 years from submission date (financial audit requirement) |
| Inquiry form submissions | 2 years from date of submission |
| Authentication logs (login timestamps) | 12 months rolling |
| Deleted accounts | Personal data anonymized within 30 days of approved deletion request (financial records retained per legal obligation) |
After the applicable retention period, personal data is securely deleted or anonymized so that it can no longer be associated with an individual.
Your Rights
Depending on your location, you may have the following rights regarding your personal data:
Right of Access
Request a copy of the personal data we hold about you.
Right to Rectification
Correct inaccurate or incomplete personal data. Portal users can update most data directly in their account settings.
Right to Erasure
Request deletion of your personal data, subject to legal retention requirements (e.g., CCR financial records may be retained for audit purposes).
Right to Portability
Request your personal data in a structured, machine-readable format (e.g., JSON or CSV).
Right to Restrict Processing
Request that we limit how we process your data in certain circumstances.
Right to Object
Object to processing based on legitimate interests. We will assess whether our grounds override your rights.
Right to Withdraw Consent
Withdraw consent at any time where consent is the legal basis for processing, without affecting prior lawful processing.
Right to Lodge a Complaint
EU/UK users may lodge a complaint with their national data protection authority (e.g., ICO in the UK, or the relevant EU supervisory authority).
To exercise any of these rights, please contact us at info@btsimulations.com. We will respond within 30 days. We may ask you to verify your identity before processing your request.
Cookies & Local Storage
Our website uses browser localStorage (not traditional cookies) for limited purposes. We do not use advertising cookies, cross-site tracking, or third-party analytics platforms such as Google Analytics, Meta Pixel, or similar.
| Name | Type | Purpose | Duration |
|---|---|---|---|
cookie_consent |
localStorage | Stores your Accept/Decline preference for our cookie notice. Never transmitted to our servers. | Until browser data cleared |
bts_auth_attempts |
localStorage | Client-side rate-limiting counter to prevent brute-force login attempts. Never transmitted externally. | Clears after 5-minute lockout window |
Third-party content that may set cookies:
- Google Fonts CDN — fonts on our website are loaded from Google's servers. Google may set its own cookies as described in Google's Privacy Policy.
- YouTube (youtube-nocookie.com) — video content on our website uses YouTube's privacy-enhanced embed mode. YouTube may still collect limited viewing data per YouTube's Privacy Policy.
You can manage or clear localStorage data through your browser settings. Clearing this data will reset your cookie consent preference and login rate-limit state.
Third-Party Services
We use the following third-party services to operate our platform. Each has its own privacy policy governing how they handle data:
| Service | Purpose | Data Shared |
|---|---|---|
| Supabase | Database, authentication, and storage infrastructure for the IBP Portal | All portal account and CCR data. See supabase.com/privacy |
| Google Fonts | Font delivery CDN for website typography | IP address (transient, for font delivery). See Google Privacy Policy |
| YouTube | Embedded video content on the public website | Viewing activity (privacy-enhanced mode). See YouTube Privacy |
| GoHighLevel (GHL) | CRM — receives and stores inquiry form submissions from the referral funnel | Name, email, organization, phone, program interest, team size, goals, referrer. See GHL Privacy Policy |
We do not sell, rent, or lease your personal data to any third parties for marketing or advertising purposes.
Children's Privacy
BT Simulations' services are designed exclusively for business professionals and organizations. We do not knowingly collect personal data from individuals under the age of 18.
If you believe that a person under 18 has submitted personal data through our platform, please contact us at info@btsimulations.com and we will promptly delete that information.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the "Effective Date" at the top of this page.
For registered IBP Portal users, we will send an email notification to your registered email address when significant changes are made. We encourage you to review this page periodically.
Your continued use of our services after any changes to this policy constitutes your acceptance of the updated terms. If you do not agree with the changes, please discontinue use and contact us to request account closure.
Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us:
1315 Walnut St. Ste 801
Philadelphia, PA 19107, USA
Email: info@btsimulations.com
Phone: +1 267 391 6410
Website: btsimulations.com
We aim to respond to all privacy-related requests within 30 days. For complex requests, we may require additional time and will notify you of any extension.
EU/UK residents who are not satisfied with our response have the right to lodge a complaint with their national supervisory authority. In the UK, this is the Information Commissioner's Office (ICO).
For Terms & Conditions, see our Terms & Conditions page.