Data retention schedule

This schedule lists each kind of record rTraining holds and how long it is kept. For each one it says how the period is kept to. Enforced by a scheduled job means a job or the database deletes or clears the record without anybody having to remember. Deleted by hand means a member of rTriibe's staff carries out the deletion, when the period ends or when a person asks. Where a provider keeps the record, the entry says so.

Why a training record is kept so long: an inspection, a serious case review or an insurance claim can reach back years, and the question is always whether the person was trained on the day. The privacy notice explains why we hold each record and on what basis.

Training records

Certificates

• Kept: for as long as the account exists, including after it is archived. An archived account's certificates still verify.
• Enforced: no timer deletes a certificate, and a certificate cannot be deleted while the account exists. A certificate that should no longer stand is withdrawn, not deleted, and the withdrawal is recorded.
• Deleted by hand: when the holder asks for their account to be deleted. The certificate then stops verifying.

Assessment attempts

• What: the paper drawn, the answers chosen, how each was marked, and when the attempt started and was submitted. Also, for each attempt, the network address it was started from and handed in from, the country, region and city our host estimated from each address, and the approximate coordinates of each network, rounded to about a kilometre. Where the learner chose to share it, their device's location at the start and at hand-in, rounded to about 100 metres, with the accuracy the device reported. For each question, when it first came on screen, when it was answered, and how many seconds it was on screen before the answer, at most 30 minutes.
• Kept: as certificates. An attempt is voided with a reason rather than deleted when it has to be set aside. The addresses and places are part of the attempt and are kept exactly as long as it is, never longer.
• Deleted by hand: when the account is deleted, the addresses and places with the attempt. The device's location also when the learner withdraws their consent and chooses, on their Profile page, to delete what was recorded; the deletion is written to the audit log with how many attempts it cleared.

Sharing a device's location

• What: the learner's answer to whether they will share their device's location during assessments, yes or no, and when they gave it. Every answer, given or withdrawn, is also written to the audit log as it is given.
• Kept: for as long as the account exists. Consent is the basis for the location on an attempt, so the answer has to be kept as long as anything recorded under it could be.
• Deleted by hand: with the account.

Section progress and saved place

• What: which sections were opened and completed and when, and where the person was in each so they can resume. Also, each time the person leaves a section or presses Next, how long its page was on screen since they opened it or last left it, in 15-second steps and at most 30 minutes at a time.
• Kept: for as long as the account exists.
• Deleted by hand: when the account is deleted.

Uploaded copies of other certificates

• Kept: for as long as the account exists, in private storage.
• Deleted by hand: when the account is deleted. Deleting the account takes the files out of storage in the same step.

Share links

• Kept: for the period the learner chose when making the link: 7, 30, 90 or 365 days, or with no end date. The learner can withdraw a link at any time.
• Enforced: yes. An expired or withdrawn link stops working at once, and answers exactly as a link that never existed.

Organisations

Membership and assignments

• What: which organisation, site or team a person belonged to, their role, when they joined and left, and the courses assigned to them with their due dates, with the history of reminders about them.
• Kept: for 6 years from the end of the organisation's subscription, unless its data processing agreement sets another period. The organisation can still read and export them for that time, at no cost.
• Deleted by hand: when that period ends.
• A leaver's membership is closed with a date, not deleted.

Invitations

• Kept: an invitation can be accepted for 30 days, then it expires. An expired invitation is kept with the organisation's records for the same period as those records.
• Enforced: the expiry is enforced by the platform. The expired invitation is deleted by hand with the organisation's records.

Accounts

Account and profile

• Kept: while the account is open.
• Archived account: the person can no longer sign in and their email address is released, so it can be used again. Their training record is kept, as above, and their certificates keep verifying.
• Deleted account: the account, training record, certificates, attempts and appeals are erased, and the certificates stop verifying. The email log loses the address, subject and words of each email. The Stripe customer is deleted, unless it is also used for something else the person bought from rTriibe. Orders are kept without the name, for the accounts. A running plan must be ended first.
• Deleted by hand: the person asks under Help in their account (Ask us to close your account) or at training@rtriibe.com, and our staff carry it out. The same step removes the profile photo and any uploaded copies of other certificates from file storage. A deletion happens as soon as we carry it out and cannot be undone. Copies in our database provider's backups are overwritten within 7 days.

Profile photo

• Kept: until the person removes it, or our staff do at their request, or the account is deleted. It is stored where anybody with the file's address can open it.
• Deleted: by the person, by our staff at their request, or with the account, whose deletion takes it out of storage in the same step.

When the person was last online

• What: the time of the person's last visit while signed in, to within five minutes. One time, overwritten each visit, with no address, device or page.
• Kept: while the account exists. Each visit replaces the last one, so there is never a history of visits.
• Deleted: with the account.

The person's time zone

• What: the name of the time zone their browser reports, or the host's estimate from their connection until it has, so times are shown in their local time. One value, overwritten when it changes. The zone an assessment was started and handed in from is kept on the attempt.
• Kept: while the account exists; on an attempt, as long as the attempt.
• Deleted: with the account, and with the attempt.

The record that an account was deleted

• Kept: our audit log records the deleted account's id, who deleted it, when, and counts of what was removed. It does not keep the name or email address the account had. The audit log cannot be edited or deleted from, so this record has no end date.

Support requests

Requests made under Help, and our replies

• What: what a person asked for under Help in their account (a question, a problem with a course, a reasonable adjustment, a complaint, a copy of their data, or closing their account), what they wrote, and every reply from our staff.
• Kept: for as long as the account exists, so that a person can see what they asked and what we told them, and so that an agreed adjustment is on record the next time it is needed. No timer deletes them.
• Deleted: with the account. Our audit log keeps only that a request of a kind was made or answered, never what was written, so it holds nothing of a complaint's or an adjustment's words after the account has gone.

Copies of a person's data

• What: the file made when a person asks for a copy of their data on Your data, or our staff prepare one from their request under Help: a ZIP of everything the account holds about them. Beside it, a record of the request: when it was asked for and by whom, when the file was ready, how big it was, whether the email with its link went, and when it was downloaded.
• Kept: the file for 7 days from when it is ready, which is as long as the emailed link works. The record of the request for as long as the account exists.
• Enforced by a scheduled job: each day, every file whose 7 days are up is deleted from storage, and so is anything older left there, including a file still waiting when its account was deleted. The record stays, marked as run out.
• Deleted: the record with the account. Our audit log keeps that a copy was asked for, made and downloaded, and how big it was, never what was in it.

Emails to our mailbox

• What: anything sent to training@rtriibe.com rather than through Help.
• Kept: up to 2 years after the last message about the matter, unless it belongs to a complaint, appeal or malpractice matter, which is kept as those are.
• Deleted by hand.

Ask and the section tutor

Questions and answers

• What: the question, the answer, the section, and any rating.
• Kept: 90 days, then the words are deleted.
• Enforced: yes, by a daily job. A learner who deletes a conversation removes it from their history at once; the record is kept until the same daily job deletes it at 90 days, for safeguarding and misuse review.

Misuse records

• What: a refused message, what was typed and the kind of request.
• Kept: 90 days, then deleted with the questions.
• Enforced: yes, by the same daily job.

Usage records

• What: how much text each question sent and received and what it cost, with no words in it. Used to count the monthly allowance.
• Kept: no end date is set.
• Deleted by hand: when the account is deleted.

Email

What each email said

• What: the text of each email we sent, with its sign-in, sharing, invitation and payment links taken out before it is stored.
• Kept: 12 months, then the text is cleared.
• Enforced: yes, by a daily job.

The record that an email was sent

• What: the address, the kind of email, the subject, the date and whether it was delivered. With it, the ordinary links in the email that we count, which of them was first followed, when, and how many times, and, for a person who turned on "Let rTraining know when I open emails", when it was first opened.
• Kept: no end date is set.
• Deleted by hand: when an account is deleted, the address, subject and words are removed from these records.

Copies in our mailbox

• What: every email is sent from training@rtriibe.com through Microsoft 365, and a copy is kept in that mailbox's sent items.
• Kept: for up to 12 months, then deleted.
• Deleted by hand.

The weekly renewals report

• What: a spreadsheet emailed to rTriibe's admins every Friday, listing the learners whose certificates are due for renewal in the next 30 days or ran out in the 30 days before. Staff can also download it; each download is recorded with counts, not names.
• Kept: the report is not stored by the platform. Copies stay in the admins' mailboxes and wherever a download is saved. Admins delete their copies once they have acted on them, and within 3 months at most.
• Deleted by hand.

Marketing

Email preferences and marketing choices

• What: which kinds of email a person has switched on or off, and a record of every yes and no they have given to news and offers, with the wording they were shown, where they answered and when.
• Kept: for as long as the account exists, so we can show what a person agreed to and when.
• Deleted by hand: with the account.

Link clicks

• What: a click on a link in a marketing email. The links go through our own redirect so we can count clicks, for everyone we send them to, and we count purchases made within 7 days of a click. A click on a link in any other email is kept with the record that the email was sent, above. Whether an email was opened is recorded only for a person who has turned on "Let rTraining know when I open emails"; see the privacy notice.
• Kept: 24 months, then deleted.
• Enforced: yes, by a daily job.

Buying

Orders and financial records

• Kept: 6 years from the end of the financial year they fall in, as tax law requires. When an account is deleted, the order is kept and is no longer linked to the person.
• Includes: the time you ticked to start your access, and so gave up the 14-day cancellation right, which is kept with the order.
• Deleted by hand: when that period ends.

The payment provider's customer record

• Kept: by Stripe, for as long as the customer exists. When an account is deleted, the Stripe customer is deleted too, unless it is also used for something else the person buys from rTriibe. Stripe keeps payment records for as long as the law that applies to it requires, under its own privacy policy.

The discount offered at cancellation

• What: that we offered the 50% discount to a person and to their payment customer record, and whether they took it. It is offered once per person, ever, so the record is what makes that true.
• Kept: for as long as the account exists, because it is what makes the offer once only.
• Deleted by hand: with the account.

Complaints, appeals and malpractice

• Kept: 6 years from the date the matter is closed. Accrediting bodies can ask to see the log.
• Deleted by hand: when that period ends. Appeals are also erased when the account is deleted.

Staff actions

Audit log

• What: every change our staff make in the back office, and every change made through the course-authoring connector, with who made it and when.
• Kept: no end date. The log cannot be edited or deleted from by anybody, including the platform itself; changing that would be a deliberate and recorded change to the database.

Recently deleted

• What: a copy of something our staff deleted in the back office, or that was deleted through the course-authoring connector, so that a mistake can be undone: a draft course that was never on sale, with everything in it; a draft marketing campaign; a part of a course or of its accreditation record; a marketing list, segment or template. A course that has been on sale, published, attempted, bought or assigned cannot be deleted at all, so nobody's training record is ever in this copy.
• Kept: 30 days from the deletion, restorable by the account that runs the business until then.
• Enforced by a scheduled job: each night the database deletes every copy older than 30 days. A marketing list, segment or template is deleted with its copy then, together with the list's members, unless a campaign still refers to it, in which case it stays archived as that campaign's record. Each of these is recorded in the audit log.

Measurement and technical records

Analytics, recordings and browser errors

• Kept by PostHog: for up to 12 months. Sent only with consent.
• Deleted by hand: we remove anything older from PostHog.

Server errors

• Error alerts to our admins: a count of each kind of server error, with its scrubbed message and where it happened but no account id, used so that the admins are emailed about it at most once an hour. Kept: until 90 days after that error was last seen. Enforced: yes, by the database, which clears older rows each time it records an error.
• Kept by PostHog: for up to 12 months. Sent with the account's internal id where somebody was signed in, and no name or email address.
• Deleted by hand: as analytics.

Hosting and security logs

• Kept: no more than 30 days, by our hosting and database providers, who delete them.

Backups

• Taken: daily.
• Kept: for up to 7 days by our database provider, which overwrites them without anybody having to remember.

In your browser

• Cookies and local storage are listed, with their lifetimes, on the cookies page.

Your employer's copy

An organisation's copy of the evidence that it trained you is kept for the period its data processing agreement sets, which is its decision. Your own record is kept for the periods above, which are ours. Neither decides the other.