Privacy Policy

This Privacy Policy explains how TrainConfirm collects, uses, and protects personal data. It applies to:

• Customers — businesses who sign up for a TrainConfirm account ("you," "your organisation")
• Staff members — individuals who receive training videos sent via TrainConfirm by one of our customers ("staff," "recipients")

1. Who we are

TrainConfirm is operated by Alistair Hynes, trading as Admiration Media ("we," "us," "our"), a sole trader based in the United Kingdom.

Contact: support@admiration.media

Admiration Media is currently operated as a sole trader. This section will be updated if the business becomes a registered limited company.

2. Two roles we play with your data

Because of how TrainConfirm works, we act in two different capacities depending on whose data is involved:

• As a data controller — for our direct customers' account information (your name, email address, company name, payment details). We decide how and why this data is processed.
• As a data processor — for staff/recipient data (names, email addresses, video confirmation records, IP addresses) that our customers upload or enter into TrainConfirm to send training videos to their own staff. In this case, your organisation is the data controller for your staff's data, and we process it only on your instructions, to provide the service.

If you are a staff member who received a training video link and have questions about how your data is used, please contact the organisation that sent it to you in the first instance, as they are the data controller responsible for that data. You're also welcome to contact us directly and we will assist or direct your query appropriately.

3. What data we collect

From customers (account holders)

• Name and email address
• Company/organisation name
• Payment information (processed directly by Stripe — we do not store full card details)
• Usage data (videos uploaded, login activity)

From staff members (training recipients)

When a customer sends a training video to a staff member, we collect:

• Name and email address (provided by the customer, or entered by the staff member)
• A unique one-time confirmation link/token
• Confirmation status (whether the video was watched and confirmed)
• IP address, captured at the moment of confirmation
• Date and timestamp of confirmation
• Digital signature (the typed full name provided at confirmation)

Why we collect IP addresses: IP addresses are recorded as part of the confirmation process to provide an audit trail that supports our customers' regulatory and compliance obligations (for example, demonstrating that a specific individual, from a specific location, confirmed they watched a piece of mandatory training). This is treated as personal data under UK GDPR and is handled with the same care as any other personal data described in this policy.

4. Legal basis for processing

• Customer account data — processed under contract (to provide the service you've signed up for) and legitimate interest (to operate and improve TrainConfirm).
• Staff/recipient data — processed by us under the instruction of our customer (the data controller for that data), who is responsible for establishing their own legal basis for collecting and sending this data (typically legitimate interest or legal obligation, where training compliance is a regulatory requirement in their industry).

5. How we use this data

• To operate the service: sending training videos, recording confirmations, generating compliance reports
• To process payments and manage subscriptions
• To communicate with customers about their account (billing issues, support)
• To maintain security and prevent misuse of the platform

We do not sell personal data to third parties, and we do not use staff/recipient data for marketing purposes.

6. Third parties we use

We use the following third-party services to operate TrainConfirm. Each processes a limited set of data, only as needed to perform their specific function:

These providers are contractually bound to handle data securely and only for the purposes we've instructed. Some of these providers may process data outside the UK/EEA; where this happens, they maintain their own appropriate safeguards (such as Standard Contractual Clauses) for international data transfers.

This list will be updated if we introduce additional tools (for example, website analytics) that process personal data.

7. Data retention

• Customer account data is retained for as long as your account is active, and for a reasonable period after closure to comply with legal and accounting obligations (e.g. tax records).
• Staff confirmation records (name, email, IP address, timestamp) are retained for up to 6 years after an organisation's account is closed, to support compliance evidence that our customers may need to retain or produce (e.g. in the event of a workplace incident, audit, or legal claim related to training history). This period reflects standard UK limitation periods for contract-related claims.

Customers wishing to delete specific staff records earlier should contact us at support@admiration.media.

8. Data security

We take reasonable technical and organisational measures to protect personal data, including:

• Access to customer data restricted to authenticated account holders
• One-time, expiring confirmation links for staff training videos
• Secure, encrypted connections (HTTPS) throughout the platform
• Payment data handled directly by Stripe — we never see or store full card numbers

No system is 100% secure, but we take data protection seriously and review our practices as the platform grows.

9. Your rights (UK GDPR)

Depending on your role, you have the right to:

• Access the personal data we (or our processors) hold about you
• Correct inaccurate personal data
• Request deletion of your personal data, subject to our legal retention obligations described in Section 7
• Object to or restrict certain processing
• Data portability, where applicable

If you are a staff member, please direct these requests to the organisation that sent you the training video in the first instance, as they are the data controller. If you're unsure who that is, or they're unresponsive, contact us at support@admiration.media and we will assist.

If you are a customer, contact us directly at support@admiration.media.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has been mishandled.

10. Changes to this policy

We may update this policy as TrainConfirm evolves — for example, if we introduce new features or third-party tools that process personal data. We'll update the "Last updated" date at the top of this page when changes are made. Significant changes affecting how staff/recipient data is handled will be communicated to our customers.

11. Cookies

TrainConfirm uses only essential cookies — small files needed to make the platform work. We do not use cookies for advertising, tracking, or analytics.

• Authentication cookies (set by Supabase) keep you securely logged in to your account.
• Checkout cookies (set by Stripe) are used only during payment to process your subscription securely.

Because these cookies are strictly necessary for the platform to function, we don't need to ask for your consent to use them under UK cookie law (PECR). If we ever introduce non-essential cookies, such as analytics, we'll update this section and ask for your consent first.

12. Contact us

For any questions about this policy or how your data is handled:

Email: support@admiration.media