Data processing agreement.

Parties and scope

This DPA forms part of the terms of service and is entered into between Orbitrain (the processor) and you, the learner (the controller of your personal data). Where a sponsoring organisation provides access, that organisation is the controller and Orbitrain is the processor.

Controller and processor roles

You decide what context to share, which rooms to enter, and what evidence to submit. Orbitrain processes your personal data on your behalf to deliver, secure, and improve the apprenticeship. Orbitrain does not process data for its own independent purposes beyond legitimate interests in securing and operating the service. No employer can see your learning content, evidence, or mentor observations.

Purposes of processing

Providing the apprenticeship, authenticating your identity, sending transactional emails, monitoring and improving service performance, and complying with legal obligations. Orbitrain does not process your personal data for automated decision-making, profiling for marketing, or sale to third parties.

Security measures

Encryption in transit (TLS 1.2+), encryption at rest, row-level security policies, email OTP and passkey authentication (no passwords), Cloudflare Turnstile anti-bot, audit logging, rate limiting, and periodic access reviews.

Data subject rights

Access, rectification, erasure, portability, objection, and restriction. Exercise through product settings or privacy@orbitrain.com. Orbitrain responds within 30 days.

Breach notification

If Orbitrain becomes aware of a personal data breach, it will assess severity and notify affected learners without undue delay, including the nature of the breach, likely consequences, and measures taken.

Termination

Upon account termination, Orbitrain deletes all your personal data per the retention policy. Data retained for legal compliance is deleted when the obligation expires.

Sub-processors