Data Processing Agreement

In short

1. Roles

You are the controller of the personal data you put into Maple Edge Training. We process it on your behalf as your processor. You are responsible for having a lawful basis for that data and for the emails you send through the application.

2. What we do

• Process your data only to provide the application and on your instructions. We never sell your data or use it to train AI. We will tell you if we think an instruction breaks data protection law.
• Make sure anyone who can access your data is bound by confidentiality.
• Keep your data secure with appropriate technical and organisational measures.
• Help you, where reasonable, to respond to people exercising their data rights, and with your other obligations such as keeping data secure, reporting breaches and assessing the risks of new processing.
• Give you the information you reasonably need to show we keep to this agreement, and allow reasonable audits.
• When you leave, give you a copy of your data if you ask, then delete it within 90 days unless the law requires us to keep it. Backups and logs are deleted as they expire.

3. Sub-processors

• You agree to us using sub-processors to provide the application. The current list is below.
• We will tell you before adding or replacing one, so you can object. If we can't resolve an objection, you can stop using the application.
• Each sub-processor is bound by data protection terms equivalent to these, and we remain responsible for them.
• We only transfer data outside the UK where a lawful safeguard is in place.

4. Breaches

We will tell you without undue delay after becoming aware of a breach affecting your data, and give you the information we reasonably can to help you deal with it.

5. General

• This agreement lasts as long as we process your data for you.
• Our total liability under this agreement is limited to the fees you paid us in the 12 months before the claim.
• We may update this agreement and will tell you about significant changes.
• The law of England and Wales applies.

Details of processing

• Purpose: providing Maple Edge Training, a training management application.
• Nature: the processing needed to run the application's features, for example storing and showing your records, reading documents you upload, creating certificates and sending emails on your behalf.
• Duration: while you use the application, then as set out in section 2.
• People: your staff, trainers, customers and their contacts, course bookers, delegates and certificate holders.
• Data: contact details, the training, attendance and certificate records you keep in the application, and documents you upload.
• Special category data: the application may hold health information, such as a delegate's medical or learning support needs. This includes notes you add and answers delegates give in your booking forms. You are responsible for having a lawful condition to collect and record it, and for telling delegates why you ask for it. We only use it to provide the application to you.

Security

Our current security measures:

• You and your staff log in with one-time email links. There are no passwords.
• Each customer can only access their own data, never another customer's.
• Your staff only see what their role allows.
• Data is encrypted in transit and at rest.
• Files are stored privately and shared only through unguessable links that expire.
• We record who changed what and when.
• Third-party services don't keep your data longer than they need to. For example, handwritten registers are deleted from the reading service as soon as they have been read.
• The database can be restored to any point in the recent past.
• Automated security tests run before every release.

Sub-processors