Data processing agreement.

1. Parties and scope

This data processing agreement (DPA) forms part of the terms of service and is entered into between Orbitrain (the processor) and you, the learner (the controller of your personal data). Where a sponsoring organisation provides access to learners, that organisation is the controller and Orbitrain is the processor.

This DPA applies to all processing of personal data carried out by Orbitrain in providing the apprenticeship service.

2. Controller and processor roles

You (the learner) are the controller

You decide what context to share, which rooms to enter, and what evidence to submit. You control the purpose and means of processing your personal data within the apprenticeship.

Orbitrain is the processor

Orbitrain processes your personal data on your behalf to deliver, secure, and improve the apprenticeship. Orbitrain processes data only as described in the privacy notice and this DPA, and does not process data for its own independent purposes beyond legitimate interests in securing and operating the service.

Sponsoring organisations

If an employer or organisation sponsors your access, that organisation may act as a joint controller for limited purposes, such as verifying participation. Orbitrain does not share your learning content, evidence, or mentor observations with any employer. The privacy notice describes the exact visibility boundaries.

3. Purposes of processing

Orbitrain processes personal data for the following purposes:

• Providing the apprenticeship, including sessions, rooms, missions, and evidence tracking.
• Authenticating your identity and securing your account.
• Sending transactional emails related to your apprenticeship.
• Monitoring and improving service performance, reliability, and security.
• Complying with legal obligations.

Orbitrain does not process your personal data for automated decision-making, profiling for marketing, or sale to third parties.

4. Sub-processors

Orbitrain uses the following sub-processors to deliver the service. Each is bound by written agreements providing equivalent data protection:

Orbitrain will notify you of any new sub-processor before it begins processing your data. You may object to a new sub-processor on reasonable data-protection grounds.

5. Security measures

Orbitrain implements the following technical and organisational measures:

• Encryption in transit. All connections use TLS 1.2 or higher.
• Encryption at rest. Database and storage providers encrypt data at rest.
• Access control. Row-level security policies restrict data access to the owning learner. Service-role keys are used only for background processing and are not exposed to the client.
• Authentication. Email OTP and passkey authentication. No passwords are stored.
• Anti-bot. Cloudflare Turnstile protects authentication endpoints.
• Audit logging. Security-relevant events are logged with retention periods defined in the retention policy.
• Rate limiting. Authentication and email endpoints are rate-limited to prevent abuse.
• Regular reviews. Access permissions and security configurations are reviewed periodically.

6. Data subject rights

You have the following rights regarding your personal data:

• Access. Request a copy of your data via export.
• Rectification. Correct inaccurate data through the product or by request.
• Erasure. Request deletion of all your data.
• Portability. Receive your data in a structured, machine-readable JSON format.
• Objection. Object to processing for specific purposes.
• Restriction. Request temporary restriction of processing.

To exercise these rights, use the controls in the product settings or contact [email protected]. Orbitrain responds within 30 days.

7. Breach notification

If Orbitrain becomes aware of a personal data breach, it will assess the severity and notify affected learners without undue delay. Notification will include the nature of the breach, the likely consequences, and the measures taken or planned to address it.

Where required by law, Orbitrain will also notify the relevant supervisory authority.

8. Termination

Upon termination of your account, Orbitrain will delete all your personal data in accordance with the retention policy. Data retained for legal compliance will be deleted when the legal obligation expires.

You may request immediate deletion at any time. The process is described in the retention policy.

9. Changes

This DPA may change as the service evolves and legal requirements develop. Material changes will be reflected by a new effective date. Changes to the sub-processor list will be communicated before the new processor begins handling data.