Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between Alistair Hynes, trading as Admiration Media ("Processor," "we," "us") and the business or organisation using TrainConfirm ("Customer," "you"). It applies wherever we process personal data on your behalf as part of providing TrainConfirm, and reflects our obligations under UK GDPR and the Data Protection Act 2018.

1. Definitions

• Controller — the party that determines the purposes and means of processing personal data. For staff/recipient data sent through TrainConfirm, you (the Customer) are the Controller.
• Processor — the party that processes personal data on the Controller's behalf. We act as Processor for the staff data your organisation submits to TrainConfirm.
• Personal Data — any information relating to an identified or identifiable natural person, including the staff data described in Section 3 (names, email addresses, confirmation records, IP addresses).
• Sub-processor — a third party engaged by us to assist in processing Personal Data, as listed in Section 6.
• Data Protection Laws — UK GDPR, the Data Protection Act 2018, and any applicable successor legislation.

2. Scope and roles

This DPA applies to Personal Data processed by us in connection with providing the TrainConfirm service — specifically, staff/recipient data you submit (names, email addresses) and the confirmation records generated when that data is sent training videos (IP addresses, timestamps, signatures).

You remain the Controller for this data at all times. We process it only as your Processor, strictly to provide the contracted service, and never for our own independent purposes.

3. Processing only on your instructions

We will only process staff Personal Data to the extent necessary to operate TrainConfirm as you direct — sending training videos, recording confirmations, generating reports, and related support. We will not use this data for marketing, sell it, or share it with third parties beyond the sub-processors listed below, unless required by law.

4. Confidentiality

Anyone we authorise to process Personal Data under this DPA (currently, this means Alistair Hynes personally, as a sole trader with no other staff) is bound by confidentiality obligations consistent with this Agreement.

5. Security measures

We maintain reasonable technical and organisational measures appropriate to the risk, including:

• Encrypted connections (HTTPS) throughout the platform
• Access to customer data restricted to authenticated account holders
• One-time, expiring confirmation links for staff training videos
• Payment data handled directly by Stripe — we never store full card details

6. Sub-processors

We use the following sub-processors to operate TrainConfirm. Each is contractually bound to handle data securely and only for the purpose described:

We will give you reasonable notice if we intend to add or replace a sub-processor that would handle staff Personal Data, so you have the opportunity to raise concerns before the change takes effect.

7. International data transfers

Some sub-processors above may process data outside the UK or European Economic Area. Where this occurs, those providers maintain their own appropriate safeguards (such as Standard Contractual Clauses or the UK International Data Transfer Addendum) to ensure data remains protected to UK GDPR standards.

8. Assistance with data subject rights

If a staff member contacts us directly to exercise a data subject right (such as access, correction, or deletion), we will inform you and assist you in responding, since you remain the Controller responsible for that decision. We will not respond to such requests independently except to direct the individual to you.

9. Personal data breach notification

If we become aware of a Personal Data breach affecting staff data processed on your behalf, we will notify you without undue delay, and in any event within 72 hours of becoming aware, providing what information we reasonably can to help you meet your own notification obligations under Data Protection Laws.

10. Data retention and deletion

Staff confirmation records are retained for up to 6 years after your account is closed, consistent with our Privacy Policy, to support compliance evidence you may need to retain or produce. Upon request, or at the end of our agreement, we will delete or return staff Personal Data, except where we are required to retain it to comply with a legal obligation.

11. Audits and compliance information

On reasonable request, we will provide you with information reasonably necessary to demonstrate compliance with this DPA. As Admiration Media currently operates as a sole trader with no dedicated compliance or audit infrastructure, on-site or formal third-party audits are not available at this time; we are happy to discuss alternative ways to provide assurance as our business grows.

12. Liability

Liability under this DPA is governed by the limitation of liability provisions set out in our Terms & Conditions.

13. Term

This DPA remains in effect for as long as we process Personal Data on your behalf under our service agreement, and the obligations in Sections 8 through 10 survive termination to the extent necessary to fulfil them.

14. Governing law

This DPA is governed by the laws of England and Wales.

15. Contact

For questions about this DPA, or to request a signed copy for your own records, contact us at support@admiration.media.