Privacy Policy

1. Who we are

W&I Studio Ltd, a company registered in England and Wales and trading as TrainedTeam (“we”, “us”, “our”), operates the TrainedTeam platform and website. We are the data controller for the personal data we collect through our services.

If you have questions about this policy, contact us at privacy@trainedteam.com.

2. What data we collect

We collect and process the following categories of personal data:

• Account data: name, email address, password (hashed), organisation name, role
• Profile data: display name, avatar, department, job title (if provided)
• Usage data: training completions, quiz scores, run execution data, content created
• Compliance data: e-signature records including typed name, timestamp, IP address, and document version
• Technical data: IP address, browser type, device information, pages visited
• Communication data: support requests, feedback

3. How we use your data

We process personal data for the following purposes and legal bases:

• Providing the service (contract): creating accounts, processing training completions, generating analytics, storing content
• E-signature records (legitimate interest): capturing typed name, timestamp, and IP address for compliance audit trails as requested by your organisation
• Service improvement (legitimate interest): understanding usage patterns, improving features, fixing issues
• Communication (legitimate interest / consent): sending service updates, responding to support requests, marketing communications (with consent only)
• Legal compliance (legal obligation): responding to legal requests, maintaining records as required by law

4. AI processing

When you use AI features (content generation, quiz creation, text transformation), the text you submit is sent to our AI provider, Anthropic, for processing. The content you submit may contain personal data (for example, employee names referenced in an SOP). Anthropic acts as a sub-processor under our data processing agreement, does not retain submitted content beyond the time needed to return a response, and does not use submitted content to train AI models. See section 6 on international transfers for the safeguards that apply.

5. Data sharing

We do not sell your personal data. We share data with:

• Your organisation: managers and owners in your organisation can see training completions, quiz scores, and e-signature records for their team members
• Sub-processors: hosting, database, authentication, email delivery, anti-bot, and AI providers that process data on our behalf under contractual data processing terms (UK GDPR Article 28). A current list of sub-processors is available on request from privacy@trainedteam.com.
• Law enforcement: if required by law, court order, or regulatory request

6. Data storage, security, and international transfers

Your training data, account data, and content are stored in European Union data centres. All data is encrypted at rest using AES-256 and in transit using TLS 1.3. We enforce row-level security at the database layer, ensuring users can only access data belonging to their organisation.

Some of our sub-processors are based outside the UK and EU. The most material example is Anthropic (United States), which processes content you submit to AI features. Where personal data is transferred outside the UK, we rely on the following safeguards under UK GDPR Articles 44 to 49:

• UK International Data Transfer Addendum to the EU Standard Contractual Clauses (the “UK Addendum”), or
• An adequacy decision made by the UK Government in respect of the destination country (for example the UK-US Data Bridge for certified US recipients), or
• Other appropriate safeguards permitted under UK GDPR.

You can request a copy of the safeguards in place for any specific sub-processor by emailing privacy@trainedteam.com.

7. Data retention

• Account data: retained while your account is active. Deleted within 30 days of account deletion request.
• Training records and e-signatures: retained for the duration of the organisation's subscription plus 6 years, in line with UK Limitation Act 1980 guidelines for employment records.
• Technical logs: retained for up to 90 days for security and debugging purposes.

8. Your rights

Under UK GDPR, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase your data (subject to legal retention requirements)
• Restrict processing in certain circumstances
• Data portability - receive your data in a structured format
• Object to processing based on legitimate interest
• Withdraw consent for marketing communications at any time

To exercise any of these rights, email privacy@trainedteam.com. We will respond within one calendar month.

9. Cookies

We use essential cookies for authentication and session management. See our Cookie Policy for details.

10. Children

TrainedTeam is not intended for use by individuals under 16. We do not knowingly collect personal data from children.

11. Changes to this policy

We may update this policy from time to time. We will notify registered users of material changes by email. The “last updated” date at the top of this page indicates when the policy was last revised.

12. Complaints

If you are unhappy with how we handle your data, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.