Everyone

Privacy notice

What information we collect, why we collect it, how long we keep it, and the difference between buying training yourself and being enrolled by an employer.

This notice explains what information we collect, why we collect it, how long we keep it and what rights you have. It covers rTraining, the training platform on this website, run by rTriibe.

Who is responsible for your data

The platform sits on two different legal footings, depending on how you came to it. Which one applies to you decides who makes the decisions about your data, and therefore who you should ask about it.

If you buy training yourself

rTriibe is responsible for your personal data. We are the data controller: you chose to come here, you paid us, and we decide what we do with your information within the limits of this notice. Ask us directly about anything on this page.

If your employer or agency enrols you

Two organisations are responsible for your data, each for a different part of it.

Your employer or agency is the data controller for its view of your training: that it enrolled you, the courses it assigned you and by when, whether you are in date, and the evidence it keeps that you were trained. It decided you should be trained and chose us, and for that part we are its data processor and act only on its instructions.
rTriibe is a data controller in its own right for your own training record: your account, your certificates and the attempts behind them. That record belongs to you and stays with you if you leave, so it is not your employer's to decide about. We are also a controller for a few uses of our own, listed under "Our own uses" below.

So ask us about your own record, including deleting it, and we will deal with it ourselves. Ask your employer about its copy of the evidence; if you ask us, we will pass your request on to them and tell you that we have.

Your training record works the same way in both situations. The certificates you earn belong to you and stay with you. Your employer holds its own copy of the evidence that it trained you, on its own lawful basis, and you hold your own record. Both records are real and one does not cancel the other, which is why you do not start again when you change jobs.

Where a paragraph below applies to only one of the two situations, it says so.

Who to contact

Us: RTRIIBE LTD, registered in England and Wales with company number 12065235. Email training@rtriibe.com with "privacy" in the subject line, or write to Level One Basecamp Liverpool, 49 Jamaica Street, Liverpool, England, L1 0AH.
Who is responsible for data protection: a director of rTriibe. We have not appointed a data protection officer, because the law does not require us to.
The Information Commissioner's Office: we pay the data protection fee, and our entry can be found on the ICO's register of fee payers under RTRIIBE LTD.
If your employer enrolled you: ask us about your own record, and your employer's data protection contact about its copy of the evidence. We will pass on anything that belongs with them and tell you that we have.

You can complain to the Information Commissioner's Office at ico.org.uk. We would rather you came to us first, but you do not have to.

What we collect

Everyone

Account information: your name, email address, and when the account was created. There is no password: you sign in with a link we email to you.
A profile photo, if you add one, or our staff add one at your request. It is kept in a file store that anyone holding the file's web address can open, so that it can be shown beside your name. You can remove it from your profile at any time, or ask us to.
Training activity: which courses you were given access to, which sections you have opened and completed, where you got to in a section so you can resume, assessment attempts and their results, and the certificates issued to you.
Certificates: the certificates we issue to you.
Where you sat an assessment. When you start an assessment and when you hand it in, we record the network address (IP address) your connection came from, and the country, region and city our host, Vercel, estimates from that address as part of delivering the page. We also keep the approximate coordinates of that network, from the same estimate, rounded to about a kilometre. We look nothing up anywhere else. The place is an estimate of where a network is, usually the nearest city and often wrong at that level, and never your precise location.
Your device's location, only if you allow it. When you set up your account, or the first time you start a course, we ask whether you will share your location, and explain why, before your browser asks. If you say yes and your browser allows it, we record your device's location when you start an assessment and when you hand it in, rounded to about 100 metres, with how accurate your device said it was. We never record it at any other time: not while you read a section, not between questions, and never to follow where you go. If you say not now, or your browser does not allow it, nothing is recorded, we do not ask again, and nothing about your training changes. You can turn it on or off on your Profile page at any time.
How long a section was on screen. When you leave a section of a course or press Next, your browser tells us how long the section's page was open in a visible tab since you opened it or last left it. We keep it in 15-second steps, at most 30 minutes at a time. It is not a measure of reading, nothing waits on it, and no result depends on it. Nothing is stored on your device for it.
How long each assessment question was on screen. When a question comes up we record the time, and when you answer it we record the time again and how many seconds it was on screen in a visible tab before you answered, to the second and at most 30 minutes. No result depends on it, and you can see it in your data export.
Technical information: the pages you requested, security logs, and the kind of browser you used, used to keep the service running and secure. When a page breaks on our servers, a report of the error and where in our code it happened is sent to PostHog, carrying the internal id of your account if you were signed in, and nothing else about you: no name, email address, cookie or anything you typed. With your consent, errors in your browser are reported too; see "Analytics and what we do not measure".
Which links in our emails you follow: the first link in an email we sent you that was followed and when, and how many times its links were followed. See "Links in our emails" below.
When you were last online: the time of your last visit while signed in, to within five minutes, kept for security and so our staff can help you. Only the time is kept, not where you were or what device you used.
Your time zone, from your browser or network, so times show in your local time. The name of the zone your device says it is in, such as Asia/Dubai, or until it has said, the zone our host, Vercel, estimates from your connection. One value, replaced when it changes, kept while your account exists. It is a zone, which covers a country or more, and never where you are within it. When you start and hand in an assessment we also keep the zone our host estimates for that connection, with the rest of where you sat it, so a report on the attempt can give the local time it was sat. The lawful basis is our legitimate interest in showing you, and our staff, times you can rely on.
Your country, once. On your first visit our host tells us which country your connection appears to come from, and we use it to choose the region, and so the currency, the site shows you. We keep only the region it chose, in a cookie on your device; see cookies.
The region you choose, if you choose one. If you pick a region, the United Kingdom or the United Arab Emirates, on your profile or in the footer while signed in, we keep that choice on your account, so the same prices follow you to any browser you sign in on. Only the region is kept, never where you are. It is empty until you choose, and it does not change a plan you already pay for: a subscription keeps billing in the currency it was taken out in. The lawful basis is performance of our contract with you: it decides which prices you are shown.
Support requests: what you asked for under Help in your account, or wrote to us by email, and what we replied. Only you and our staff can read a Help request; an employer never can, and never learns that you made one.
Questions you ask Ask and the section tutor: what you typed, the answer it gave, which section you were reading, and whether you marked the answer helpful. See "Ask and the section tutor" below.

If you buy training yourself

Payment information: what you bought, when, how much, the last four digits and card type as our payment provider reports them, and the invoice. We never see or store your full card number; payment is handled by Stripe.
Your start choice at checkout: whether you chose to start straight away or to keep your 14-day cancellation right, and the exact time you chose to start, at checkout or later with Start now on your billing page. We hold this because it decides your cancellation rights, and because you are entitled to be told what you agreed to. See cancellation and refunds.
Course updates. At checkout you can tick "Send me an email when a course I hold is updated." We record the answer. The email itself, sent once when a course you have taken or started has a new edition, is one of the reminders below, and the Reminders switch is what turns it on or off.
Your email preferences. We send three kinds of email. Essential emails (sign-in links, receipts, payment problems, certificates, and notices about your account or our terms) cannot be switched off. Reminders (the short follow-up a few weeks after a course, a note when a course you have taken or started has a new edition, and, where an organisation has assigned you training, reminders about what is due or due for renewal) start on. News and offers are explained in "News and offers by email" below. You change the last two under Emails in your account, or from the link at the foot of any reminder or marketing email. That link is a short address on our site, works without signing in and shows only those settings. We keep a scrambled copy of each link, which cannot be turned back into the link, so that it keeps working.
Your subscription's terms and whether you have started a course. We record which version of the terms a subscription was taken out on, so you can see what you agreed to. We also work out from your progress whether you have opened a course or started an assessment in the last 12 months, because that decides whether cancelling takes 3 months' notice. See cancellation and refunds.
The discount offered when you cancel. If you press Cancel plan and we offer you the 50% discount, we record that it was offered, against you and against your customer record with Stripe, and whether you took it. It is offered once per person, ever, and this record is how we keep to that.

If your employer or agency enrols you

The link to that organisation: which organisation, which site or team, your role, and the dates you joined and left. Membership is recorded as a relationship with dates rather than as a permanent label, so leaving is a fact we record rather than a record we delete.
Assignments: which courses your employer has required you to do and by when.
Your employer chooses what it sends us. It should send only what is needed: name, work email, role, site. It should not send anything sensitive, and our data processing agreement says so.

If you write or review a course for us

Your name, qualifications or profession, and professional registration with the registry that holds it, and your email address. A course that carries or is applying for an accreditation names its author and an independent reviewer, and so does any other course that credits named people, so your name, your qualifications and your registration are published on the course page. Your email address is not published.
These details can also be read by the Claude connector our staff use to work on draft courses; see "Who else is involved".
The lawful basis for holding and publishing them is our contract with you where there is one, and otherwise our legitimate interest in showing who wrote and checked each course.

What your employer can and cannot see

This is built into the platform rather than being a setting, and it does not change:

Your employer can see whether you passed, the date, and your certificate.
Your employer cannot see your answers, your score, how many attempts you took, where you sat an assessment from, your device's location if you shared it, how long you spent on a section, or how long each question was on screen. The platform will not show it to them.
Your employer cannot see anything you asked Ask or the section tutor, or whether you used them at all.

Ask and the section tutor

Inside a course, Ask about this section answers questions about the section you are reading. The Ask page in your account answers questions across the courses you hold, and about rTraining and your own account. Both answer from the text they are given and point you to where the answer came from. They are automated and can be wrong. Ask and AI use explains them in full.

What is sent to answer you: your question, the published text of the courses you hold and the list of guidance they cite, the rTraining help pages that match your question, and your last three questions and answers in the same conversation. On the Ask page, a summary of what your own account shows is sent too: your plan, the courses you can open, how far through each you are, the dates of your latest certificate for each and when it needs renewing, any due dates your employer has set, and which catalogue courses your plan does not include. Your name, email address, employer and any identifier for you are not sent. Nothing from your assessments is ever sent: no questions, answers, scores or attempts.
Who answers it: OpenAI, as our processor, using one of its models, in the United States. Your question alone is also sent to OpenAI's moderation check. When a new chat on the Ask page is given its name, your first question and the start of the answer are sent once more, with nothing about you. We use OpenAI's API with storage switched off (store: false), and under OpenAI's API terms it does not use data sent through the API to train its models. OpenAI may keep API data for a limited period to detect abuse, as its API terms allow, and then deletes it.
What we keep, and why: your question, the answer, the section and your rating, for 90 days, so that the people who write the course can see which parts confuse people and improve them. Authors see the question and the answer, never who asked. Our staff can read your questions and the answers, with your name, to check the tutor is answering safely, to deal with misuse, and to help when you contact support; your employer never can. Only staff who need to do that work can read them. After 90 days the words are deleted. You can delete a conversation yourself before then: it leaves your history at once, and we keep the record until the 90 days are up, so that our staff can still check for safeguarding concerns and misuse, and then it is deleted with the rest. We keep how much text was sent and received and what each question cost, with no words in it, because your monthly tutor allowance is counted from them.
Misuse is logged and can pause the tutor: a question asking for other people's data, the tutor's instructions or keys, or to get round its rules, or one that OpenAI's moderation check (sent the question alone) finds abusive, is refused and logged with what you typed and the kind of request, for the same 90 days; three in 24 hours pause the tutor for your account for 24 hours, and our staff are told. The tutor tells you it is paused and until when. A pause affects only the tutor, never your courses or your record, and if you think it was wrong, write to us and a person will look at it and can lift it.
Please do not type a child's name or anything about a real person's health. The tutor does not need it, and it would then sit in the conversation for 90 days.
Lawful basis: performance of our contract with you if you bought your own training, and our legitimate interest in offering the tutor if an employer enrolled you. Either way we are the controller for your conversations: they are yours, and your employer never sees them.
We have assessed the risks of the tutor, including the risk that somebody types a child's details or a health matter into it, which is why we ask you not to and why the words go after 90 days.

Why we hold it, and our lawful basis

Where we are the controller (you bought your own training):

To provide the training you paid for: performance of our contract with you. Without this we cannot give you access, mark your assessment or issue your certificate.
To take payment and keep financial records: performance of the contract, and legal obligation for the tax records that follow.
To keep your training record and let you prove it: performance of the contract, and our legitimate interest in a record that remains verifiable.
To let a certificate be verified by someone you show it to: legitimate interest. A certificate that cannot be checked is of little use to you.
To keep the service secure and working: legitimate interest.
To count which links in our emails are followed: legitimate interest. See "Links in our emails" below.
To send you reminders, including that a course you hold has a new edition: our legitimate interest in helping you keep your training in date. They start on and you can switch them off at any time.
Marketing: the soft opt-in, explained in "News and offers by email" below.
To measure how the site is used: your consent, given through the cookie banner. Declining changes nothing about your training.
To find and fix errors on our servers: legitimate interest. These reports carry your account's internal id, if you were signed in, so that we can see whether one fault keeps hitting the same person, and nothing else about you. They are an error log rather than a measurement of you, so they are sent whatever you chose in the cookie banner, and no analytics profile is made from them.

Where your employer or agency enrolled you:

Your employer's view of your training: the enrolment, assignments, deadlines, compliance status and its evidence. We process this as its processor, on its documented instructions, under Article 28 of the UK GDPR and the data processing agreement. The lawful basis is your employer's to identify: usually its legal obligation to train its staff, or its legitimate interest in a competent workforce.
Your own training record: we hold it as a controller, so that it stays yours, you can take it to your next job, and anyone you show a certificate to can check it. The lawful basis is our legitimate interest, and yours, in a training record that belongs to the person who earned it.
We never send you marketing. See "News and offers by email" below.

Our own uses

Whoever enrolled you, we are a controller for these. Each rests on our legitimate interest, or on a legal obligation where a rule requires it:

Checking that our assessments work. An accrediting body can ask us to show that our questions are fair and do their job. We do that with statistics about how each question was answered, worked out from our own database. They are about the questions rather than about you, and they never go to an analytics service.
Putting right a faulty question. If a question turns out to be wrong, we use the attempt records to find everybody it affected and correct their results, without waiting for them to notice.
Checking how an assessment was sat. The network address and approximate place an attempt was started and handed in from, how long each section was on screen before it, and how long each question was on screen, are kept so that we can look into an appeal, or a concern that an assessment was not sat honestly, under our assessment policy and malpractice policy. A certificate is only worth something if it can be shown to have been earned by the person named on it, and that is our legitimate interest, and yours. Apart from you, only our staff can see this record, each time they open it is written to our audit log, it is never sent to an analytics service, and your employer never sees it. None of it proves on its own who sat a paper, and we do not treat it as if it did: it is a reason to ask you, and we ask before we decide anything.
Your device's location, if you share it. Unlike the rest of this list, this rests on your consent. We keep where your device was when you started and handed in an assessment, rounded to about 100 metres, for the same reason as the network's place above: to help show that a certificate was earned by the person named on it. It is more trustworthy than the network's estimate, which a VPN or a school's network can move. It is optional, and saying no costs you nothing. It is kept with the attempt, only you and our staff can see it, it is never sent to an analytics service or anyone else, and your employer never sees it. You can withdraw your consent on your Profile page at any time: nothing more is recorded from then on, and you can choose there to delete what was already recorded as well. Withdrawing does not undo what was recorded before unless you ask for that.
Our complaints and appeals log. What was raised, what we decided and why. Accrediting bodies ask to see it.
Knowing whose certificates are due for renewal. Every Friday our admins are emailed a spreadsheet, from our training mailbox, of the learners whose latest certificate for a course is due for renewal in the next 30 days or ran out in the 30 days before: your name, email address, organisation, the course, the certificate number and its dates, whether you can currently retake it and whether you have started to. It goes to rTriibe's own admins who have signed in to the back office, and to no one outside rTriibe; your employer is not sent it. Our staff can also download the same list from the back office, and each download is recorded. It contains no answers, scores or attempt history. Our admins delete their copies once they have acted on them, and within 3 months at most.
Keeping the service secure and working.

These uses are about keeping our assessments sound and your certificates current. They are not about studying how you or your colleagues work, and none of them is used to sell to anyone an employer enrolled.

News and offers by email

What we send, and to whom. News about our training and courses, including changes to the guidance they cover, and occasional offers on them. We send it to people who signed up or bought from us for themselves, unless they have told us not to.
If your employer or agency gave you access, we never send you marketing. We hold your details on their behalf, and they are not ours to use for our own marketing. This stays true if you later leave that organisation.
Saying no. When you first set up your account, and again at checkout, we offer a box that reads "Don't send me news and offers from rTraining." Ticking it stops them. You can also turn off News and offers under Emails in your account at any time, and every marketing email has a link at its foot that stops them in one click. We keep a record of where your details were collected and when, and of every change you make, with where you made it and when.
Lawful basis: the soft opt-in for existing customers under the Privacy and Electronic Communications Regulations, regulation 22(3), and our legitimate interest in telling our customers about similar training (UK GDPR Article 6(1)(f)). You can object at any time, and we will stop.
Stopping changes nothing else: not your training, your certificates or the account emails you need, such as receipts and sign-in links.
Who sends them. Microsoft 365, through Microsoft Graph, from the same training@rtriibe.com mailbox as our account emails. If we move marketing to a dedicated sending service, it will be named on the sub-processors page first, and organisation customers told as the data processing agreement requires.
Clicks. Each link in a marketing email goes through a short address on our own site, which records which link was followed and when, the kind of device (a phone or a computer) and the first part of the network address, so that the automatic link checks made by mail filters can be told apart from people. We use this to judge which emails are useful and to count a plan started or a course bought within 7 days of a click. Click records are kept for 24 months and then deleted. None of it goes to an analytics service. The lawful basis is our legitimate interest in sending emails people find useful. It applies to everyone we send news and offers to, whatever you have chosen about opens.
Opens, only if you allow it. Our emails carry no tracking image unless you turn on "Let rTraining know when I open emails" under Emails in your account, or on the page the link at the foot of an email opens. It is off until you do. With it on, each email we send you carries a tiny image from our own site, and opening the email tells us when; we keep the first time and how many times, with our record of that email. Nothing goes to anyone else. Because the image is read from your device, the Privacy and Electronic Communications Regulations need your consent for it, and agreeing to news and offers does not give it. You can turn it off at any time. See our cookies policy. The switch covers opens only. Which links you follow is counted either way, as "Links in our emails" explains.
Your employer never sees any of this: not whether you get our news, not which emails you were sent, not what you clicked.
Messages from our staff. Our staff can write to you one to one about your account or your training, from the same mailbox. Those are not marketing and are never used to sell to you. Each one is kept with your account's emails and recorded in our audit log with the name of the person who sent it.
How long we keep the record. For as long as your account exists, so that we can show where your details came from and when you said no. If you delete your account the record goes with it.

Analytics and what we do not measure

We use PostHog, hosted in the European Union, to understand how the site is used: which course pages people read, where in a lesson they stop, whether a player control is being found. It runs only if you accept it in the cookie banner and nothing is loaded before then. See cookies.

With your consent it also does two more things.

Recordings of visits to the public site. A visit to our public pages, the catalogue, sign-in, checkout or sign-up may be recorded so we can see where people get stuck. Everything you type is masked, and the console and network are not recorded. Lessons, assessments, Ask, your account and any screen showing somebody's name are never recorded, and if your employer enrolled you nothing is recorded at all.
Error reports from your browser, with any email address or id removed from the message. None are sent from an assessment screen.

Errors on our servers are reported to PostHog whatever you choose, with your account's internal id if you were signed in and no name, email address, cookies or headers, and on an assessment screen, in a lesson or in Ask without the error's message.

These limits are enforced in the code rather than left as a promise:

We identify you by a user id and nothing else. No name, no email address, no employer name ever goes to the analytics service.
Assessment data is never sent to analytics. No answers, no scores, no pass or fail, no question references, and not where an assessment was sat from, your device's location, how long a section was on screen or how long a question was, which stay in our own database. Item statistics are accreditation evidence and they have to be reproducible from our own records years later, so they are a query against our database and never a figure on a dashboard. Automatic event capture is switched off entirely on assessment screens.
If your employer enrolled you, your behaviour is masked unless that employer's data processing agreement expressly covers behavioural analytics. Masked means no identity is attached, nothing persists between visits, and events describing your progress through a lesson are not sent at all. How you use the platform is part of what we handle for your employer, and your employer has not instructed us to study how its staff behave.

Links in our emails. The links in the emails we send you, in a receipt, a reminder, a certificate notice or news and offers, and in the text as well as on the buttons, go through a short address on our own site. When you follow one, we note against our record of that email the first link followed and when, count how many times its links are followed, and send you straight on. This happens whatever you have chosen about opens.

What it does not do. Nothing is stored on your device. We read nothing from it beyond what any web request carries, such as the kind of browser, which for our account emails we use only to tell a mail filter's automatic check from a person and do not keep. For news and offers we keep a little more, as "News and offers by email" describes. Nothing goes to an analytics service, and your employer never sees it.
Links that never go this way. Sign-in, sharing, invitation, payment and unsubscribe links, and links that write to or ring us, go straight to where they point. A sign-in or sharing link is a key, and we do not keep a copy of it; the unsubscribe link has to work in one step, with nothing in between. The web address written out under a button, for copying, is not counted either.
Why this is not the same as opens. Counting opens uses an image fetched from your device, which the Privacy and Electronic Communications Regulations treat like a cookie, so it needs your consent. A link that passes through our site stores nothing on your device, so we do not ask for consent for it; we rely on our legitimate interest instead.
Lawful basis: our legitimate interest in knowing whether our emails are useful and are acted on, for example whether a reminder that a certificate is running out led anyone to renew it, so that we can improve them. We think the effect on you is small: it records only what happened to an email we sent you, it stays in our own database, and it is used for nothing else. You have the right to object to it; see "Your rights".

Who else is involved

We use a small number of suppliers to run the service. Each is bound by contract to process data only on our instructions. The current list is:

Supabase: the database, authentication and file storage that hold your account, your records and any profile photo. Hosted in London, in the United Kingdom.
Vercel: hosting and delivery of the website itself, including telling us the country a first visit comes from and the approximate place an assessment is sat from, and running our scheduled jobs. The application runs in Vercel's London region. Static files are served from Vercel's network nearest you, which can be outside the UK, and Vercel may process request logs outside the UK, including in the United States.
Stripe: payments, in the United Kingdom, the European Union and the United States. Stripe is a controller in its own right for card data and payment fraud checks. We never receive your card number.
PostHog: product analytics, recordings of visits to the public site and error reports, hosted in the European Union. Analytics, recordings and browser errors only with your consent; server errors, identified only by your account's internal id, always.
ElevenLabs: generating audio from our course text: the narration of each section, and the read-aloud of assessment questions and their options. Course text and question text are sent; no learner data is ever sent. Location: the United States and the European Union.
OpenAI: answering questions in Ask and the section tutor, which means your question, the courses' text, your recent questions in that conversation and, on the Ask page, a summary of your own account are sent, but never your name, email address, employer or anything from an assessment; checking your question for abuse; and naming a new Ask chat from its first question and the start of the answer. See "Ask and the section tutor" above. For our own course production it also generates cover images from our own descriptions and transcribes our narration recordings to check them, with no learner data in either. Location: the United States.
Anthropic: its Claude models draft course sections and assessment questions from the sources we give them, for the course's author and reviewer to check. Our staff also use Claude, through a connector, to work on draft courses, which lets it read the names, qualifications, registration numbers and email addresses of the authors and reviewers on our register. No learner data is ever sent. Location: the United States.
Microsoft: Microsoft 365 sends our emails from training@rtriibe.com through Microsoft Graph: order and billing emails, certificates, share links, invitations, assignments and reminders, and alerts and reports to our own staff, including the weekly renewals report. A copy of each email is kept in that mailbox's sent items. Sign-in links are sent by Supabase until our sign-in emails move to Microsoft 365 too. Location: Microsoft's data centres, which may be outside the United Kingdom, including in the European Union and the United States.

An up-to-date list, with each supplier's role, what it is sent and its location, is on the sub-processors page and in the data processing agreement. Organisation customers are told before a new sub-processor is added, as that agreement requires.

We do not sell personal data, and we do not share it with anyone for their own marketing.

Where your data is held

Your account, your training records and your certificates are held in the United Kingdom, in our database provider's London region. Analytics is held in the European Union. Where a provider handles personal data outside the UK and the country does not have UK adequacy, the transfer is covered by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or by the UK Extension to the EU-US Data Privacy Framework where the provider is certified, and we assess the risk of each transfer before we make it.

We cannot promise that no data ever leaves the United Kingdom: the suppliers above that are outside it are part of how the service works. If your procurement requires UK-only processing with no exceptions, tell us before you buy and we will tell you in writing exactly what would leave the UK.

How long we keep it

A training record has to outlast almost everything else we hold, because an inspection, a serious case review or an insurance claim can reach back years and the question is always whether the person was trained on the day.

Certificates and the attempt that produced them: for as long as your account exists, including after it is archived. No timer deletes them. A record survives you leaving the employer that paid for it. It survives that employer leaving us. The network address and place an attempt was sat from, and how long each of its questions was on screen, are part of the attempt and are kept exactly as long as it is.
Your device's location, if you shared it: with the attempt it was recorded on, exactly as long as the attempt is kept, unless you delete it sooner on your Profile page. Your answer to whether you will share it, and when you gave it, are kept for as long as your account exists, because we have to be able to show that you agreed.
How long each section was on screen: with your progress through the course, for as long as your account exists.
If you archive your account, your certificates are kept and still verify, so a certificate you have already given to somebody can still be checked. The check shows the number, the name it was issued to, the course, the dates and whether it is valid, and no contact details. They are kept for as long as the archived account exists. If you delete your account, your certificates are deleted with it and stop verifying.
Account and profile data: while your account is open. Archiving it closes it and releases your email address; deleting it erases it. A deletion happens as soon as we carry it out and cannot be undone. Copies in our database provider's backups are overwritten within 7 days.
Purchase and financial records: six years from the end of the financial year they fall in, as tax law requires.
Your immediate-access consent record: kept with the order, for as long as the order record is kept.
Support requests made under Help, and our replies: for as long as your account exists; they are deleted with it. Emails sent to our mailbox instead: up to 2 years after your last message about the matter.
When you were last online: one time, replaced on each visit, kept while your account exists.
Your time zone: one value, replaced when it changes, kept while your account exists. The zone an assessment was sat in is kept with the attempt, as long as the attempt is.
Emails we send you: what each email said, with its sign-in, sharing, invitation and payment links taken out before it is stored, is kept for 12 months so our staff can answer a question about what you were told. Then the words are deleted. Only our staff can read them; your employer cannot. The record that an email was sent (the address, the kind of email, its subject, the date and whether it was delivered) has no set end date, because it is how we show that a notice or a certificate reached you. It is kept with what we know of what happened next: which counted link was first followed, when, and how many times, and, if you allowed us to count opens, when the email was first opened. If you delete your account, your address is removed from that record. A copy of each email also stays in the sent items of our training mailbox for up to 12 months. The lawful basis for keeping these is our legitimate interest in answering questions about what we told you.
Ask and section tutor questions and answers: 90 days, then deleted, and any misuse record with them. A conversation you delete leaves your history at once and is kept for those 90 days for safeguarding and misuse review. The record of what each question cost, with no words in it, has no set end date and is deleted with your account. Tutor top-ups you buy are purchase records, kept as those are.
Security and hosting logs: no more than 30 days.
Analytics, recordings and error reports: we keep analytics for up to 12 months, and then PostHog deletes them.
Marketing link clicks: 24 months.
The full schedule, record by record, is on the data retention page.
Organisation membership history: for as long as the organisation's own evidence obligation lasts, which is the organisation's decision to make and is recorded in its data processing agreement.

Your employer's copy of the evidence is kept for the period its data processing agreement sets, which is its decision. Your own record is kept for the periods above, which are ours. Neither decides the other: your employer ending its copy does not end yours, and closing your account does not end its copy.

Your rights

You can ask us to:

Give you a copy of your data (a subject access request). Free. You can take most of it yourself: press Email me my data on Your data on your profile and we put together a copy of everything your account holds about you, usually within a few minutes, and email you a link to download it. The link takes you to our site, where you sign in as yourself to download the file; it works for 7 days, and then the file is deleted. That is your profile, your email settings, the history of your choices about news and offers and a list of the emails we have sent you, your plans, invoices and purchases, your courses and progress with how long each section was on screen, every attempt with your answer to each question and where it was started and handed in from, including your device's location if you shared it, your appeals, your certificates and any you uploaded, your CPD log, your share links, your questions to Ask that are still held, your Help requests and our replies, and the feedback you gave. It comes as a page you can read in any browser, with the same data as spreadsheets and a JSON file. You can ask for a copy once an hour; we record when you asked, when the copy was made and downloaded and how big the file was, and nothing about what was in it. If you ask us under Help instead, our staff prepare the same copy and it is emailed to the address on your account in the same way. For anything the copy does not answer, ask under Help in your account (Something else about your data) or by email, and we reply within one month. If an organisation enrolled you, we answer for your own record ourselves and pass anything about the organisation's copy to it, telling you that we have.
Correct something that is wrong. Names on certificates are the common one; tell us and our staff will correct the certificate and send you the corrected copy.
Delete your data. The next section explains what we cannot delete.
Restrict or object to processing, including objecting to anything we do on the basis of legitimate interest.
Withdraw consent or say no to marketing at any time, with no effect on your training.
Take your data elsewhere in a machine-readable form. The copy from Your data is in that form.
Have a person look at an automated decision. Assessment marking is automatic, but it is marking against a published pass mark and a published blueprint. You can challenge a result within 28 days, and a person at rTriibe who was not involved in writing the course or the question will look at it under the appeals policy.

To exercise any of these, use Help in your account or write to training@rtriibe.com with "privacy" in the subject line. We may ask you to confirm who you are, and we will not use that check to delay your request.

Deletion, and what cannot be deleted

Choose Ask us to close your account under Help in your account, or write to training@rtriibe.com. Our staff carry out the closure. There are two ways to close an account, and the form asks which you want.

Archive. Your account is closed and you can no longer sign in to it. Your email address is released, so you can use it again. Your training record and certificates are kept, and your certificates still verify.
Delete. You are erased. We delete your account, your profile and contact details, your marketing preferences, your progress through course material, your saved place in a lesson, your share links, your questions to Ask and the section tutor, your support requests and our replies, your appeals, your attempts and your certificates. A certificate you have already given to somebody stops verifying. The same step removes your profile photo and any copies of other certificates you uploaded from our file storage. We remove your address from our log of the emails we sent you, and we delete your customer record with Stripe unless it is also used for something else you buy from us. A plan that is still running, including one working through its notice period, must have ended before an account can be deleted.

What we keep after a delete, and why:

The record that we deleted your account. Our audit log records that the account was deleted, by whom and when, and how much was removed. It identifies the account by an internal id only, not by your name or email address. Nobody can edit or delete from that log.
An organisation's evidence that it trained you, while it still has a lawful claim to hold it. Evidence packs an organisation has already exported keep your name, the course, the date and the certificate number as they stood on the day. The live record it sees in rTraining, and the certificate's verification, go with your account. If a school has a statutory duty to show that its staff were trained in safeguarding, the record of your training is part of its evidence, held on its lawful basis and not on ours. We cannot erase somebody else's compliance evidence on the instruction of a third party. This applies only for as long as that claim genuinely lasts: when the organisation's retention period ends, or when it tells us the claim has ended, the record goes. If you think an organisation is keeping your record with no lawful reason, tell us and tell them. You can also complain to the ICO about them, which is the right route because they are the controller.
Financial records, for as long as tax law requires. Your orders are kept, no longer linked to your account.
Anything needed for an ongoing legal claim or investigation, until it ends.
Analytics events already sent, until PostHog deletes them. Ask us and we will have them deleted.

We will always tell you specifically what we have kept and why.

If you are outside the United Kingdom

We also sell in the United Arab Emirates, priced in dirhams, and the checkout does not stop a buyer from another country. Wherever you are, your data is held in the places and by the suppliers listed above, and this notice applies to you.

We handle your data to the UK standard described here wherever you are. The law of the country you live in may give you further rights, and nothing in this notice takes them away. Ask us and we will help you use them.
Your data comes to us in the United Kingdom, and goes to the suppliers above, because you use a service run from here. Where the law of your country requires something more for that transfer, we will do it.

Children

This platform is for adults at work. We do not knowingly hold data about anyone under 18. Course content may concern children, as safeguarding training does, but that is course content rather than personal data about a child.

Automated decisions and profiling

We do not profile you for advertising. Assessment marking is automated, as described above. The compliance status you and your employer see (in date, due soon, overdue) is computed from facts we hold rather than stored as a judgement, which means it can be recalculated as at any past date and shown to be right.

Security

Data is encrypted in transit and at rest. Access to production data is limited to the people who need it and is logged. How sign-in, access and logging work is set out in our information security statement. Row-level access rules in the database key on who you are first and on an organisation's grant second, so a customer cannot reach another customer's data even if our application code has a bug. Our security contact is training@rtriibe.com, with "security" in the subject line, and our breach notification commitment to organisation customers is in the data processing agreement.

Changes to this notice

We will update this page when what we do changes, and we will tell you by email before a material change takes effect. The version and the date of the last review are shown beside this notice.

Everyone

Privacy notice

What information we collect, why we collect it, how long we keep it, and the difference between buying training yourself and being enrolled by an employer.

This notice explains what information we collect, why we collect it, how long we keep it and what rights you have. It covers rTraining, the training platform on this website, run by rTriibe.

Who is responsible for your data

If you buy training yourself

If your employer or agency enrols you

Two organisations are responsible for your data, each for a different part of it.

Your employer or agency is the data controller for its view of your training: that it enrolled you, the courses it assigned you and by when, whether you are in date, and the evidence it keeps that you were trained. It decided you should be trained and chose us, and for that part we are its data processor and act only on its instructions.
rTriibe is a data controller in its own right for your own training record: your account, your certificates and the attempts behind them. That record belongs to you and stays with you if you leave, so it is not your employer's to decide about. We are also a controller for a few uses of our own, listed under "Our own uses" below.

Where a paragraph below applies to only one of the two situations, it says so.

Who to contact

Us: RTRIIBE LTD, registered in England and Wales with company number 12065235. Email training@rtriibe.com with "privacy" in the subject line, or write to Level One Basecamp Liverpool, 49 Jamaica Street, Liverpool, England, L1 0AH.
Who is responsible for data protection: a director of rTriibe. We have not appointed a data protection officer, because the law does not require us to.
The Information Commissioner's Office: we pay the data protection fee, and our entry can be found on the ICO's register of fee payers under RTRIIBE LTD.
If your employer enrolled you: ask us about your own record, and your employer's data protection contact about its copy of the evidence. We will pass on anything that belongs with them and tell you that we have.

You can complain to the Information Commissioner's Office at ico.org.uk. We would rather you came to us first, but you do not have to.

What we collect

Everyone

Account information: your name, email address, and when the account was created. There is no password: you sign in with a link we email to you.
A profile photo, if you add one, or our staff add one at your request. It is kept in a file store that anyone holding the file's web address can open, so that it can be shown beside your name. You can remove it from your profile at any time, or ask us to.
Training activity: which courses you were given access to, which sections you have opened and completed, where you got to in a section so you can resume, assessment attempts and their results, and the certificates issued to you.
Certificates: the certificates we issue to you.
Where you sat an assessment. When you start an assessment and when you hand it in, we record the network address (IP address) your connection came from, and the country, region and city our host, Vercel, estimates from that address as part of delivering the page. We also keep the approximate coordinates of that network, from the same estimate, rounded to about a kilometre. We look nothing up anywhere else. The place is an estimate of where a network is, usually the nearest city and often wrong at that level, and never your precise location.
Your device's location, only if you allow it. When you set up your account, or the first time you start a course, we ask whether you will share your location, and explain why, before your browser asks. If you say yes and your browser allows it, we record your device's location when you start an assessment and when you hand it in, rounded to about 100 metres, with how accurate your device said it was. We never record it at any other time: not while you read a section, not between questions, and never to follow where you go. If you say not now, or your browser does not allow it, nothing is recorded, we do not ask again, and nothing about your training changes. You can turn it on or off on your Profile page at any time.
How long a section was on screen. When you leave a section of a course or press Next, your browser tells us how long the section's page was open in a visible tab since you opened it or last left it. We keep it in 15-second steps, at most 30 minutes at a time. It is not a measure of reading, nothing waits on it, and no result depends on it. Nothing is stored on your device for it.
How long each assessment question was on screen. When a question comes up we record the time, and when you answer it we record the time again and how many seconds it was on screen in a visible tab before you answered, to the second and at most 30 minutes. No result depends on it, and you can see it in your data export.
Technical information: the pages you requested, security logs, and the kind of browser you used, used to keep the service running and secure. When a page breaks on our servers, a report of the error and where in our code it happened is sent to PostHog, carrying the internal id of your account if you were signed in, and nothing else about you: no name, email address, cookie or anything you typed. With your consent, errors in your browser are reported too; see "Analytics and what we do not measure".
Which links in our emails you follow: the first link in an email we sent you that was followed and when, and how many times its links were followed. See "Links in our emails" below.
When you were last online: the time of your last visit while signed in, to within five minutes, kept for security and so our staff can help you. Only the time is kept, not where you were or what device you used.
Your time zone, from your browser or network, so times show in your local time. The name of the zone your device says it is in, such as Asia/Dubai, or until it has said, the zone our host, Vercel, estimates from your connection. One value, replaced when it changes, kept while your account exists. It is a zone, which covers a country or more, and never where you are within it. When you start and hand in an assessment we also keep the zone our host estimates for that connection, with the rest of where you sat it, so a report on the attempt can give the local time it was sat. The lawful basis is our legitimate interest in showing you, and our staff, times you can rely on.
Your country, once. On your first visit our host tells us which country your connection appears to come from, and we use it to choose the region, and so the currency, the site shows you. We keep only the region it chose, in a cookie on your device; see cookies.
The region you choose, if you choose one. If you pick a region, the United Kingdom or the United Arab Emirates, on your profile or in the footer while signed in, we keep that choice on your account, so the same prices follow you to any browser you sign in on. Only the region is kept, never where you are. It is empty until you choose, and it does not change a plan you already pay for: a subscription keeps billing in the currency it was taken out in. The lawful basis is performance of our contract with you: it decides which prices you are shown.
Support requests: what you asked for under Help in your account, or wrote to us by email, and what we replied. Only you and our staff can read a Help request; an employer never can, and never learns that you made one.
Questions you ask Ask and the section tutor: what you typed, the answer it gave, which section you were reading, and whether you marked the answer helpful. See "Ask and the section tutor" below.

If you buy training yourself

Payment information: what you bought, when, how much, the last four digits and card type as our payment provider reports them, and the invoice. We never see or store your full card number; payment is handled by Stripe.
Your start choice at checkout: whether you chose to start straight away or to keep your 14-day cancellation right, and the exact time you chose to start, at checkout or later with Start now on your billing page. We hold this because it decides your cancellation rights, and because you are entitled to be told what you agreed to. See cancellation and refunds.
Course updates. At checkout you can tick "Send me an email when a course I hold is updated." We record the answer. The email itself, sent once when a course you have taken or started has a new edition, is one of the reminders below, and the Reminders switch is what turns it on or off.
Your email preferences. We send three kinds of email. Essential emails (sign-in links, receipts, payment problems, certificates, and notices about your account or our terms) cannot be switched off. Reminders (the short follow-up a few weeks after a course, a note when a course you have taken or started has a new edition, and, where an organisation has assigned you training, reminders about what is due or due for renewal) start on. News and offers are explained in "News and offers by email" below. You change the last two under Emails in your account, or from the link at the foot of any reminder or marketing email. That link is a short address on our site, works without signing in and shows only those settings. We keep a scrambled copy of each link, which cannot be turned back into the link, so that it keeps working.
Your subscription's terms and whether you have started a course. We record which version of the terms a subscription was taken out on, so you can see what you agreed to. We also work out from your progress whether you have opened a course or started an assessment in the last 12 months, because that decides whether cancelling takes 3 months' notice. See cancellation and refunds.
The discount offered when you cancel. If you press Cancel plan and we offer you the 50% discount, we record that it was offered, against you and against your customer record with Stripe, and whether you took it. It is offered once per person, ever, and this record is how we keep to that.

If your employer or agency enrols you

The link to that organisation: which organisation, which site or team, your role, and the dates you joined and left. Membership is recorded as a relationship with dates rather than as a permanent label, so leaving is a fact we record rather than a record we delete.
Assignments: which courses your employer has required you to do and by when.
Your employer chooses what it sends us. It should send only what is needed: name, work email, role, site. It should not send anything sensitive, and our data processing agreement says so.

If you write or review a course for us

Your name, qualifications or profession, and professional registration with the registry that holds it, and your email address. A course that carries or is applying for an accreditation names its author and an independent reviewer, and so does any other course that credits named people, so your name, your qualifications and your registration are published on the course page. Your email address is not published.
These details can also be read by the Claude connector our staff use to work on draft courses; see "Who else is involved".
The lawful basis for holding and publishing them is our contract with you where there is one, and otherwise our legitimate interest in showing who wrote and checked each course.

What your employer can and cannot see

This is built into the platform rather than being a setting, and it does not change:

Your employer can see whether you passed, the date, and your certificate.
Your employer cannot see your answers, your score, how many attempts you took, where you sat an assessment from, your device's location if you shared it, how long you spent on a section, or how long each question was on screen. The platform will not show it to them.
Your employer cannot see anything you asked Ask or the section tutor, or whether you used them at all.

Ask and the section tutor

What is sent to answer you: your question, the published text of the courses you hold and the list of guidance they cite, the rTraining help pages that match your question, and your last three questions and answers in the same conversation. On the Ask page, a summary of what your own account shows is sent too: your plan, the courses you can open, how far through each you are, the dates of your latest certificate for each and when it needs renewing, any due dates your employer has set, and which catalogue courses your plan does not include. Your name, email address, employer and any identifier for you are not sent. Nothing from your assessments is ever sent: no questions, answers, scores or attempts.
Who answers it: OpenAI, as our processor, using one of its models, in the United States. Your question alone is also sent to OpenAI's moderation check. When a new chat on the Ask page is given its name, your first question and the start of the answer are sent once more, with nothing about you. We use OpenAI's API with storage switched off (store: false), and under OpenAI's API terms it does not use data sent through the API to train its models. OpenAI may keep API data for a limited period to detect abuse, as its API terms allow, and then deletes it.
What we keep, and why: your question, the answer, the section and your rating, for 90 days, so that the people who write the course can see which parts confuse people and improve them. Authors see the question and the answer, never who asked. Our staff can read your questions and the answers, with your name, to check the tutor is answering safely, to deal with misuse, and to help when you contact support; your employer never can. Only staff who need to do that work can read them. After 90 days the words are deleted. You can delete a conversation yourself before then: it leaves your history at once, and we keep the record until the 90 days are up, so that our staff can still check for safeguarding concerns and misuse, and then it is deleted with the rest. We keep how much text was sent and received and what each question cost, with no words in it, because your monthly tutor allowance is counted from them.
Misuse is logged and can pause the tutor: a question asking for other people's data, the tutor's instructions or keys, or to get round its rules, or one that OpenAI's moderation check (sent the question alone) finds abusive, is refused and logged with what you typed and the kind of request, for the same 90 days; three in 24 hours pause the tutor for your account for 24 hours, and our staff are told. The tutor tells you it is paused and until when. A pause affects only the tutor, never your courses or your record, and if you think it was wrong, write to us and a person will look at it and can lift it.
Please do not type a child's name or anything about a real person's health. The tutor does not need it, and it would then sit in the conversation for 90 days.
Lawful basis: performance of our contract with you if you bought your own training, and our legitimate interest in offering the tutor if an employer enrolled you. Either way we are the controller for your conversations: they are yours, and your employer never sees them.
We have assessed the risks of the tutor, including the risk that somebody types a child's details or a health matter into it, which is why we ask you not to and why the words go after 90 days.

Why we hold it, and our lawful basis

Where we are the controller (you bought your own training):

To provide the training you paid for: performance of our contract with you. Without this we cannot give you access, mark your assessment or issue your certificate.
To take payment and keep financial records: performance of the contract, and legal obligation for the tax records that follow.
To keep your training record and let you prove it: performance of the contract, and our legitimate interest in a record that remains verifiable.
To let a certificate be verified by someone you show it to: legitimate interest. A certificate that cannot be checked is of little use to you.
To keep the service secure and working: legitimate interest.
To count which links in our emails are followed: legitimate interest. See "Links in our emails" below.
To send you reminders, including that a course you hold has a new edition: our legitimate interest in helping you keep your training in date. They start on and you can switch them off at any time.
Marketing: the soft opt-in, explained in "News and offers by email" below.
To measure how the site is used: your consent, given through the cookie banner. Declining changes nothing about your training.
To find and fix errors on our servers: legitimate interest. These reports carry your account's internal id, if you were signed in, so that we can see whether one fault keeps hitting the same person, and nothing else about you. They are an error log rather than a measurement of you, so they are sent whatever you chose in the cookie banner, and no analytics profile is made from them.

Where your employer or agency enrolled you:

Your employer's view of your training: the enrolment, assignments, deadlines, compliance status and its evidence. We process this as its processor, on its documented instructions, under Article 28 of the UK GDPR and the data processing agreement. The lawful basis is your employer's to identify: usually its legal obligation to train its staff, or its legitimate interest in a competent workforce.
Your own training record: we hold it as a controller, so that it stays yours, you can take it to your next job, and anyone you show a certificate to can check it. The lawful basis is our legitimate interest, and yours, in a training record that belongs to the person who earned it.
We never send you marketing. See "News and offers by email" below.

Our own uses

Whoever enrolled you, we are a controller for these. Each rests on our legitimate interest, or on a legal obligation where a rule requires it:

Checking that our assessments work. An accrediting body can ask us to show that our questions are fair and do their job. We do that with statistics about how each question was answered, worked out from our own database. They are about the questions rather than about you, and they never go to an analytics service.
Putting right a faulty question. If a question turns out to be wrong, we use the attempt records to find everybody it affected and correct their results, without waiting for them to notice.
Checking how an assessment was sat. The network address and approximate place an attempt was started and handed in from, how long each section was on screen before it, and how long each question was on screen, are kept so that we can look into an appeal, or a concern that an assessment was not sat honestly, under our assessment policy and malpractice policy. A certificate is only worth something if it can be shown to have been earned by the person named on it, and that is our legitimate interest, and yours. Apart from you, only our staff can see this record, each time they open it is written to our audit log, it is never sent to an analytics service, and your employer never sees it. None of it proves on its own who sat a paper, and we do not treat it as if it did: it is a reason to ask you, and we ask before we decide anything.
Your device's location, if you share it. Unlike the rest of this list, this rests on your consent. We keep where your device was when you started and handed in an assessment, rounded to about 100 metres, for the same reason as the network's place above: to help show that a certificate was earned by the person named on it. It is more trustworthy than the network's estimate, which a VPN or a school's network can move. It is optional, and saying no costs you nothing. It is kept with the attempt, only you and our staff can see it, it is never sent to an analytics service or anyone else, and your employer never sees it. You can withdraw your consent on your Profile page at any time: nothing more is recorded from then on, and you can choose there to delete what was already recorded as well. Withdrawing does not undo what was recorded before unless you ask for that.
Our complaints and appeals log. What was raised, what we decided and why. Accrediting bodies ask to see it.
Knowing whose certificates are due for renewal. Every Friday our admins are emailed a spreadsheet, from our training mailbox, of the learners whose latest certificate for a course is due for renewal in the next 30 days or ran out in the 30 days before: your name, email address, organisation, the course, the certificate number and its dates, whether you can currently retake it and whether you have started to. It goes to rTriibe's own admins who have signed in to the back office, and to no one outside rTriibe; your employer is not sent it. Our staff can also download the same list from the back office, and each download is recorded. It contains no answers, scores or attempt history. Our admins delete their copies once they have acted on them, and within 3 months at most.
Keeping the service secure and working.

News and offers by email

What we send, and to whom. News about our training and courses, including changes to the guidance they cover, and occasional offers on them. We send it to people who signed up or bought from us for themselves, unless they have told us not to.
If your employer or agency gave you access, we never send you marketing. We hold your details on their behalf, and they are not ours to use for our own marketing. This stays true if you later leave that organisation.
Saying no. When you first set up your account, and again at checkout, we offer a box that reads "Don't send me news and offers from rTraining." Ticking it stops them. You can also turn off News and offers under Emails in your account at any time, and every marketing email has a link at its foot that stops them in one click. We keep a record of where your details were collected and when, and of every change you make, with where you made it and when.
Lawful basis: the soft opt-in for existing customers under the Privacy and Electronic Communications Regulations, regulation 22(3), and our legitimate interest in telling our customers about similar training (UK GDPR Article 6(1)(f)). You can object at any time, and we will stop.
Stopping changes nothing else: not your training, your certificates or the account emails you need, such as receipts and sign-in links.
Who sends them. Microsoft 365, through Microsoft Graph, from the same training@rtriibe.com mailbox as our account emails. If we move marketing to a dedicated sending service, it will be named on the sub-processors page first, and organisation customers told as the data processing agreement requires.
Clicks. Each link in a marketing email goes through a short address on our own site, which records which link was followed and when, the kind of device (a phone or a computer) and the first part of the network address, so that the automatic link checks made by mail filters can be told apart from people. We use this to judge which emails are useful and to count a plan started or a course bought within 7 days of a click. Click records are kept for 24 months and then deleted. None of it goes to an analytics service. The lawful basis is our legitimate interest in sending emails people find useful. It applies to everyone we send news and offers to, whatever you have chosen about opens.
Opens, only if you allow it. Our emails carry no tracking image unless you turn on "Let rTraining know when I open emails" under Emails in your account, or on the page the link at the foot of an email opens. It is off until you do. With it on, each email we send you carries a tiny image from our own site, and opening the email tells us when; we keep the first time and how many times, with our record of that email. Nothing goes to anyone else. Because the image is read from your device, the Privacy and Electronic Communications Regulations need your consent for it, and agreeing to news and offers does not give it. You can turn it off at any time. See our cookies policy. The switch covers opens only. Which links you follow is counted either way, as "Links in our emails" explains.
Your employer never sees any of this: not whether you get our news, not which emails you were sent, not what you clicked.
Messages from our staff. Our staff can write to you one to one about your account or your training, from the same mailbox. Those are not marketing and are never used to sell to you. Each one is kept with your account's emails and recorded in our audit log with the name of the person who sent it.
How long we keep the record. For as long as your account exists, so that we can show where your details came from and when you said no. If you delete your account the record goes with it.

Analytics and what we do not measure

With your consent it also does two more things.

Recordings of visits to the public site. A visit to our public pages, the catalogue, sign-in, checkout or sign-up may be recorded so we can see where people get stuck. Everything you type is masked, and the console and network are not recorded. Lessons, assessments, Ask, your account and any screen showing somebody's name are never recorded, and if your employer enrolled you nothing is recorded at all.
Error reports from your browser, with any email address or id removed from the message. None are sent from an assessment screen.

These limits are enforced in the code rather than left as a promise:

We identify you by a user id and nothing else. No name, no email address, no employer name ever goes to the analytics service.
Assessment data is never sent to analytics. No answers, no scores, no pass or fail, no question references, and not where an assessment was sat from, your device's location, how long a section was on screen or how long a question was, which stay in our own database. Item statistics are accreditation evidence and they have to be reproducible from our own records years later, so they are a query against our database and never a figure on a dashboard. Automatic event capture is switched off entirely on assessment screens.
If your employer enrolled you, your behaviour is masked unless that employer's data processing agreement expressly covers behavioural analytics. Masked means no identity is attached, nothing persists between visits, and events describing your progress through a lesson are not sent at all. How you use the platform is part of what we handle for your employer, and your employer has not instructed us to study how its staff behave.

What it does not do. Nothing is stored on your device. We read nothing from it beyond what any web request carries, such as the kind of browser, which for our account emails we use only to tell a mail filter's automatic check from a person and do not keep. For news and offers we keep a little more, as "News and offers by email" describes. Nothing goes to an analytics service, and your employer never sees it.
Links that never go this way. Sign-in, sharing, invitation, payment and unsubscribe links, and links that write to or ring us, go straight to where they point. A sign-in or sharing link is a key, and we do not keep a copy of it; the unsubscribe link has to work in one step, with nothing in between. The web address written out under a button, for copying, is not counted either.
Why this is not the same as opens. Counting opens uses an image fetched from your device, which the Privacy and Electronic Communications Regulations treat like a cookie, so it needs your consent. A link that passes through our site stores nothing on your device, so we do not ask for consent for it; we rely on our legitimate interest instead.
Lawful basis: our legitimate interest in knowing whether our emails are useful and are acted on, for example whether a reminder that a certificate is running out led anyone to renew it, so that we can improve them. We think the effect on you is small: it records only what happened to an email we sent you, it stays in our own database, and it is used for nothing else. You have the right to object to it; see "Your rights".

Who else is involved

We use a small number of suppliers to run the service. Each is bound by contract to process data only on our instructions. The current list is:

Supabase: the database, authentication and file storage that hold your account, your records and any profile photo. Hosted in London, in the United Kingdom.
Vercel: hosting and delivery of the website itself, including telling us the country a first visit comes from and the approximate place an assessment is sat from, and running our scheduled jobs. The application runs in Vercel's London region. Static files are served from Vercel's network nearest you, which can be outside the UK, and Vercel may process request logs outside the UK, including in the United States.
Stripe: payments, in the United Kingdom, the European Union and the United States. Stripe is a controller in its own right for card data and payment fraud checks. We never receive your card number.
PostHog: product analytics, recordings of visits to the public site and error reports, hosted in the European Union. Analytics, recordings and browser errors only with your consent; server errors, identified only by your account's internal id, always.
ElevenLabs: generating audio from our course text: the narration of each section, and the read-aloud of assessment questions and their options. Course text and question text are sent; no learner data is ever sent. Location: the United States and the European Union.
OpenAI: answering questions in Ask and the section tutor, which means your question, the courses' text, your recent questions in that conversation and, on the Ask page, a summary of your own account are sent, but never your name, email address, employer or anything from an assessment; checking your question for abuse; and naming a new Ask chat from its first question and the start of the answer. See "Ask and the section tutor" above. For our own course production it also generates cover images from our own descriptions and transcribes our narration recordings to check them, with no learner data in either. Location: the United States.
Anthropic: its Claude models draft course sections and assessment questions from the sources we give them, for the course's author and reviewer to check. Our staff also use Claude, through a connector, to work on draft courses, which lets it read the names, qualifications, registration numbers and email addresses of the authors and reviewers on our register. No learner data is ever sent. Location: the United States.
Microsoft: Microsoft 365 sends our emails from training@rtriibe.com through Microsoft Graph: order and billing emails, certificates, share links, invitations, assignments and reminders, and alerts and reports to our own staff, including the weekly renewals report. A copy of each email is kept in that mailbox's sent items. Sign-in links are sent by Supabase until our sign-in emails move to Microsoft 365 too. Location: Microsoft's data centres, which may be outside the United Kingdom, including in the European Union and the United States.

We do not sell personal data, and we do not share it with anyone for their own marketing.

Where your data is held

How long we keep it

Certificates and the attempt that produced them: for as long as your account exists, including after it is archived. No timer deletes them. A record survives you leaving the employer that paid for it. It survives that employer leaving us. The network address and place an attempt was sat from, and how long each of its questions was on screen, are part of the attempt and are kept exactly as long as it is.
Your device's location, if you shared it: with the attempt it was recorded on, exactly as long as the attempt is kept, unless you delete it sooner on your Profile page. Your answer to whether you will share it, and when you gave it, are kept for as long as your account exists, because we have to be able to show that you agreed.
How long each section was on screen: with your progress through the course, for as long as your account exists.
If you archive your account, your certificates are kept and still verify, so a certificate you have already given to somebody can still be checked. The check shows the number, the name it was issued to, the course, the dates and whether it is valid, and no contact details. They are kept for as long as the archived account exists. If you delete your account, your certificates are deleted with it and stop verifying.
Account and profile data: while your account is open. Archiving it closes it and releases your email address; deleting it erases it. A deletion happens as soon as we carry it out and cannot be undone. Copies in our database provider's backups are overwritten within 7 days.
Purchase and financial records: six years from the end of the financial year they fall in, as tax law requires.
Your immediate-access consent record: kept with the order, for as long as the order record is kept.
Support requests made under Help, and our replies: for as long as your account exists; they are deleted with it. Emails sent to our mailbox instead: up to 2 years after your last message about the matter.
When you were last online: one time, replaced on each visit, kept while your account exists.
Your time zone: one value, replaced when it changes, kept while your account exists. The zone an assessment was sat in is kept with the attempt, as long as the attempt is.
Emails we send you: what each email said, with its sign-in, sharing, invitation and payment links taken out before it is stored, is kept for 12 months so our staff can answer a question about what you were told. Then the words are deleted. Only our staff can read them; your employer cannot. The record that an email was sent (the address, the kind of email, its subject, the date and whether it was delivered) has no set end date, because it is how we show that a notice or a certificate reached you. It is kept with what we know of what happened next: which counted link was first followed, when, and how many times, and, if you allowed us to count opens, when the email was first opened. If you delete your account, your address is removed from that record. A copy of each email also stays in the sent items of our training mailbox for up to 12 months. The lawful basis for keeping these is our legitimate interest in answering questions about what we told you.
Ask and section tutor questions and answers: 90 days, then deleted, and any misuse record with them. A conversation you delete leaves your history at once and is kept for those 90 days for safeguarding and misuse review. The record of what each question cost, with no words in it, has no set end date and is deleted with your account. Tutor top-ups you buy are purchase records, kept as those are.
Security and hosting logs: no more than 30 days.
Analytics, recordings and error reports: we keep analytics for up to 12 months, and then PostHog deletes them.
Marketing link clicks: 24 months.
The full schedule, record by record, is on the data retention page.
Organisation membership history: for as long as the organisation's own evidence obligation lasts, which is the organisation's decision to make and is recorded in its data processing agreement.

Your rights

You can ask us to:

Give you a copy of your data (a subject access request). Free. You can take most of it yourself: press Email me my data on Your data on your profile and we put together a copy of everything your account holds about you, usually within a few minutes, and email you a link to download it. The link takes you to our site, where you sign in as yourself to download the file; it works for 7 days, and then the file is deleted. That is your profile, your email settings, the history of your choices about news and offers and a list of the emails we have sent you, your plans, invoices and purchases, your courses and progress with how long each section was on screen, every attempt with your answer to each question and where it was started and handed in from, including your device's location if you shared it, your appeals, your certificates and any you uploaded, your CPD log, your share links, your questions to Ask that are still held, your Help requests and our replies, and the feedback you gave. It comes as a page you can read in any browser, with the same data as spreadsheets and a JSON file. You can ask for a copy once an hour; we record when you asked, when the copy was made and downloaded and how big the file was, and nothing about what was in it. If you ask us under Help instead, our staff prepare the same copy and it is emailed to the address on your account in the same way. For anything the copy does not answer, ask under Help in your account (Something else about your data) or by email, and we reply within one month. If an organisation enrolled you, we answer for your own record ourselves and pass anything about the organisation's copy to it, telling you that we have.
Correct something that is wrong. Names on certificates are the common one; tell us and our staff will correct the certificate and send you the corrected copy.
Delete your data. The next section explains what we cannot delete.
Restrict or object to processing, including objecting to anything we do on the basis of legitimate interest.
Withdraw consent or say no to marketing at any time, with no effect on your training.
Take your data elsewhere in a machine-readable form. The copy from Your data is in that form.
Have a person look at an automated decision. Assessment marking is automatic, but it is marking against a published pass mark and a published blueprint. You can challenge a result within 28 days, and a person at rTriibe who was not involved in writing the course or the question will look at it under the appeals policy.

Deletion, and what cannot be deleted

Archive. Your account is closed and you can no longer sign in to it. Your email address is released, so you can use it again. Your training record and certificates are kept, and your certificates still verify.
Delete. You are erased. We delete your account, your profile and contact details, your marketing preferences, your progress through course material, your saved place in a lesson, your share links, your questions to Ask and the section tutor, your support requests and our replies, your appeals, your attempts and your certificates. A certificate you have already given to somebody stops verifying. The same step removes your profile photo and any copies of other certificates you uploaded from our file storage. We remove your address from our log of the emails we sent you, and we delete your customer record with Stripe unless it is also used for something else you buy from us. A plan that is still running, including one working through its notice period, must have ended before an account can be deleted.

What we keep after a delete, and why:

The record that we deleted your account. Our audit log records that the account was deleted, by whom and when, and how much was removed. It identifies the account by an internal id only, not by your name or email address. Nobody can edit or delete from that log.
An organisation's evidence that it trained you, while it still has a lawful claim to hold it. Evidence packs an organisation has already exported keep your name, the course, the date and the certificate number as they stood on the day. The live record it sees in rTraining, and the certificate's verification, go with your account. If a school has a statutory duty to show that its staff were trained in safeguarding, the record of your training is part of its evidence, held on its lawful basis and not on ours. We cannot erase somebody else's compliance evidence on the instruction of a third party. This applies only for as long as that claim genuinely lasts: when the organisation's retention period ends, or when it tells us the claim has ended, the record goes. If you think an organisation is keeping your record with no lawful reason, tell us and tell them. You can also complain to the ICO about them, which is the right route because they are the controller.
Financial records, for as long as tax law requires. Your orders are kept, no longer linked to your account.
Anything needed for an ongoing legal claim or investigation, until it ends.
Analytics events already sent, until PostHog deletes them. Ask us and we will have them deleted.

We will always tell you specifically what we have kept and why.

If you are outside the United Kingdom

We handle your data to the UK standard described here wherever you are. The law of the country you live in may give you further rights, and nothing in this notice takes them away. Ask us and we will help you use them.
Your data comes to us in the United Kingdom, and goes to the suppliers above, because you use a service run from here. Where the law of your country requires something more for that transfer, we will do it.

Children

Automated decisions and profiling

Security

Changes to this notice

We will update this page when what we do changes, and we will tell you by email before a material change takes effect. The version and the date of the last review are shown beside this notice.

Who is responsible for your data

If you buy training yourself

If your employer or agency enrols you

Who to contact

What we collect

Everyone

If you buy training yourself

If your employer or agency enrols you

If you write or review a course for us

What your employer can and cannot see

Ask and the section tutor

Why we hold it, and our lawful basis

Our own uses

News and offers by email

Analytics and what we do not measure

Who else is involved

Where your data is held

How long we keep it

Your rights

Deletion, and what cannot be deleted

If you are outside the United Kingdom

Children

Automated decisions and profiling

Security

Changes to this notice

Cookies on rTraining

Who is responsible for your data

If you buy training yourself

If your employer or agency enrols you

Who to contact

What we collect

Everyone

If you buy training yourself

If your employer or agency enrols you

If you write or review a course for us

What your employer can and cannot see

Ask and the section tutor

Why we hold it, and our lawful basis

Our own uses

News and offers by email

Analytics and what we do not measure

Who else is involved

Where your data is held

How long we keep it

Your rights

Deletion, and what cannot be deleted

If you are outside the United Kingdom

Children

Automated decisions and profiling

Security

Changes to this notice