Data Processing & Subprocessors

Where an employer buys the games for its workforce, the employer is the data controller and we act as processor, processing worker data only on the employer's documented instructions. For our own marketing and demo enquiries we act as controller.

• Worker ID and authentication credentials (PIN, stored hashed).
• Optional display name and department entered for certificates.
• Game activity: scores, turns, completions, leaderboard entries.
• Supervisor role assignments.
• Demo enquiry details submitted by business contacts.

We do not ask for special category data, and workers should not enter any.

Data is processed to provide the training games, produce completion certificates and leaderboards, and support accounts. Processing lasts for the term of the customer's subscription plus our stated retention period.

• Application hosting and database — hosts the app, authentication and game data.
• Video hosting — YouTube (Google) serves embedded training videos in privacy-enhanced mode.
• Optional sign-in provider — Google, only where a user chooses Google sign-in.

We will give customers notice of new subprocessors before they start processing.

• Encryption in transit (HTTPS) and at rest by our hosting provider.
• Row-level access rules so workers can only read their own records.
• Administrative functions restricted to accounts holding a supervisor role.
• Credentials stored hashed; weak or breached PINs rejected at sign-up.
• No payment card data stored by us.

Our app and database are hosted on Lovable Cloud. Application hosting runs on a global network operated by Cloudflare (a US-headquartered company), and embedded training videos are served by YouTube (Google). This means some personal data may be processed outside the UK and the European Economic Area.

Where personal data is transferred internationally, we rely on the safeguards permitted under UK GDPR and EU GDPR, such as:

• the UK International Data Transfer Addendum to the European Commission's standard contractual clauses;
• the European Commission's standard contractual clauses; or
• an adequacy decision covering the destination country.

We keep a record of international transfers and review them whenever we add or change a subprocessor. Customers can request the current list of transfers at any time by writing to us using the contact details below.

To complete: Confirm the database hosting region and record which safeguard (UK Addendum, EU SCCs or adequacy) applies to each provider.

We assist controllers with access, correction, deletion and portability requests, notify them without undue delay if we become aware of a personal data breach, and delete or return data on termination.

Data protection contact: [CONTACT EMAIL] — [COMPANY], [REGISTERED ADDRESS].