Data processing agreement

When an organisation buys seats and puts its people into training, that organisation is the data controller for its view of their training and rTriibe is its data processor. For that part we act on your documented instructions and for no purpose of our own. This page summarises the terms that govern that arrangement, and the parts we hold as a controller ourselves. The full agreement can be downloaded below and signed.

If you bought training for yourself, this page does not apply to you: we are the controller for your data and the privacy notice is what you want.

What you need from this page

Most procurement questionnaires ask the same eight questions. Here they are, with the answers, so you can fill the form in without reading a contract.

1. Roles

You are the controller, and we are your processor, for your view of your people's training: enrolment, assignments and deadlines, compliance status, and your evidence that they were trained.

We are a controller in our own right, under our own privacy notice rather than this agreement, for:

• Each learner's own training record: their account, certificates and the attempts behind them, which stays with them if they leave you.
• Their conversations with Ask and the section tutor. These are the learner's, kept for 90 days, and never shown to you.
• A few uses of our own: analytics, only with the person's consent and, for your learners, only as far as the agreement allows; statistics on how our questions perform, which an accrediting body can ask for; finding and correcting results affected by a faulty question; our complaints and appeals log; security, including reports of errors on our servers, which carry an account's internal id and nothing else about the person; and a weekly report to rTriibe's own admins of the certificates due for renewal, which is not sent to you.
• Marketing, only to people who signed up or bought for themselves. We never send marketing to a learner who came to rTraining through you, even after they leave.
• People who buy from us directly, and our own accounts and logs.

Our privacy notice tells your learners this directly, so you do not have to explain our part for us.

2. Subject matter and duration

The subject matter is the provision of online compliance training and the maintenance of training records for your people. The processing lasts for the term of your subscription and then for the record retention period you instruct, which is longer, because training evidence has to survive the contract.

3. Categories of data and data subjects

• Data subjects: your employees, workers and candidates whom you enrol.
• Data: name, work email address, role, site or team, membership dates, course access and progress, assessment attempts and results, and certificates.
• Not yours to see: questions a learner asks Ask or the section tutor. They are the learner's, kept for 90 days, and never shown to you, in keeping with our rule that an employer sees pass or fail and the certificate and nothing of how the person learned.
• Special category data: none is required and none should be sent. Do not put health, disability or any other special category data into free-text fields. Where a reasonable adjustment is needed, tell us in a support request rather than in a learner record.

4. Your instructions to us

We process only to provide the service described in the organisation terms: giving your people access, recording what they did, marking assessments, issuing certificates, keeping the records, and producing evidence for you on request. Anything else needs a written instruction from you. If we think an instruction breaks data protection law we will tell you before acting on it.

5. Sub-processors

We use a small number of suppliers, each under a written contract with the same obligations we owe you. The current list, with roles and locations, is on the sub-processors page and in the full agreement. We will tell you at least 30 days before adding or replacing one, and you may object on reasonable data protection grounds. Ask and the section tutor use OpenAI for the text a learner types into them and, on the Ask page, a summary of that learner's own account; the full agreement says what is and is not sent.

6. Where data is held

Your account, records and certificates are held in the United Kingdom, in Supabase's London region (AWS eu-west-2). The application runs in Vercel's London region. Analytics, if enabled, and error reports are held in the European Union. Where a provider handles personal data outside the UK and the country does not have UK adequacy, the transfer is covered by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or by the UK Extension to the EU-US Data Privacy Framework where the provider is certified, and we assess the risk of each transfer before we make it.

7. Security, breach and audit

• Encryption in transit, and our database and file storage are encrypted at rest by Supabase. Access to production data is limited to the staff who need it and reviewed at least once a year, and every change our staff make is logged.
• Database row-level rules key on user identity first and on your organisation's grant second, so no customer can reach another customer's data.
• Certification: we do not yet hold a security certification such as ISO 27001 or Cyber Essentials, and we have not yet commissioned an independent penetration test.
• Breach notification: we will tell you without undue delay and in any event within 48 hours of becoming aware of a personal data breach affecting your data, with what we know, what we are doing, and what we recommend you do.
• Audit: you may audit our compliance once a year on 30 days' notice, or more often after a breach. We will always offer written answers to your questions first, and most customers find that enough.

8. What happens at the end

On termination you choose: we return your data in a machine-readable form, or we delete it. You have 30 days after termination to tell us. There are two exceptions:

• Training records are retained for the period you instruct, because deleting the evidence that your staff were trained is rarely what an organisation wants. You set the period; the default is 6 years from the end of your subscription, and you can read and export the records for that time at no cost.
• The individual keeps their own record. A person's certificates belong to them, and your instruction to delete your copy does not delete theirs. In the same way, a learner who asks us to delete their own account erases their own record, and their certificates stop verifying. The evidence packs you have already exported keep the person's name, the course, the date and the certificate number as they stood on the day. The live record you see in rTraining, and the certificate's verification, go with the person's account. The agreement states this plainly, because it is what allows a candidate registered with three agencies to hold one record rather than three.

Analytics on your learners

We would like to know where learners get stuck in a lesson, because it tells us which sections to rewrite. That is our purpose rather than yours, so on your people it needs your instruction.

Unless this agreement expressly covers behavioural analytics, your learners are masked: no identity is attached to any event, nothing persists between visits, and events describing an individual's progress through a lesson are not sent at all. Assessment data is never sent for anybody, under any setting. The switch, and exactly which events survive masking, are documented in a separate document written for your data protection officer, which we send on request.

If you are content for it to be covered, it is an option in the agreement rather than a default, and you can withdraw it at any time, with effect within 5 working days.

The full agreement

The complete agreement, including the schedules of processing operations, sub-processors and technical measures, is available to download:

• Download the full data processing agreement (Markdown)

To sign it, fill in your organisation's details, choose an analytics option, sign it and send it to training@rtriibe.com. We will countersign it and send it back. If your procurement process needs its own paper instead, email the same address and we will look at it with you.