Privacy Policy
Effective date: 8 March 2026 | Last updated: 8 March 2026
1. Who We Are
One World Learning Ltd ("we", "us", "our") operates the following websites and services:
- traineerecords.com — compliance management platform
- pharmacycompliant.com — pharmacy compliance (powered by TraineeRecords)
- Any future industry-specific domains powered by the TraineeRecords platform
We are registered in Ireland and based at the National Software Centre, Mahon, Cork, Ireland.
For any data protection queries, contact us at: privacy@traineerecords.com
Our supervisory authority is the Data Protection Commission (DPC), 21 Fitzwilliam Square South, Dublin 2, Ireland — www.dataprotection.ie
2. Our Dual Role: Controller and Processor
We act in two distinct capacities depending on context:
When we are the Data Controller
We are the data controller when you interact with our websites directly — for example, when you request a demo, contact us, or browse our sites. We decide what data to collect and why.
When we are the Data Processor
When an organisation (a pharmacy, construction company, plant hire firm, etc.) subscribes to our platform and adds their staff, that organisation is the data controller for their employees' personal data. We process that data on their behalf and according to their instructions. If you are an employee or trainee whose employer uses our platform, your employer's privacy policy governs how your data is handled. We process it only to provide the service.
We will enter into a Data Processing Agreement (DPA) with each subscribing organisation as required under Article 28 of the GDPR.
3. What Data We Collect
Data we collect as Controller (website visitors and demo requests)
- Name and email address
- Phone number (if provided)
- Company/organisation name
- Industry sector
- Any information you provide in the free-text fields
- Usage data — IP address, browser type, pages visited, time and date of visit
- Cookies and tracking data (see Section 8)
Data we process on behalf of subscribing organisations (as Processor)
- Employee/trainee names and email addresses
- Role within the organisation
- Training records and completion data
- Certification details and expiry dates
- SOP read-and-sign-off records
- Compliance form submissions
- Uploaded documents (certificates, qualifications)
- Audit trail data (timestamps, actions taken)
4. Legal Basis for Processing
Under GDPR, we process personal data on the following legal bases:
| Purpose | Legal Basis |
|---|---|
| Responding to demo requests and enquiries | Legitimate interest (responding to your request) |
| Providing the platform to subscribing organisations | Performance of a contract |
| Processing employee/trainee data on behalf of subscribers | Legitimate interest of the data controller (the subscribing organisation) |
| Analytics and website improvement | Consent (via cookie consent) |
| Sending follow-up communications about our services | Legitimate interest (with opt-out available) |
| Complying with legal obligations | Legal obligation |
5. How We Use Your Data
As a data controller, we use the data we collect to:
- Respond to demo requests and enquiries
- Provide and maintain our services
- Notify you about changes to our services
- Provide customer support
- Monitor and analyse usage to improve the platform
- Detect, prevent, and address technical issues
- Send occasional communications about our services (with opt-out)
As a data processor, we use data only as instructed by the subscribing organisation and solely for the purpose of delivering the TraineeRecords platform services.
6. Data Retention
- Demo requests and enquiries: Retained for 24 months from date of submission, then deleted unless a business relationship is established.
- Subscriber account data: Retained for the duration of the subscription plus 90 days to allow for reactivation, then deleted.
- Employee/trainee data (processed on behalf of subscribers): Retained for the duration of the subscription. On termination, data is made available for export and then deleted within 90 days unless the subscriber requests earlier deletion.
- Audit trail data: Retained for the duration of the subscription plus 12 months for compliance purposes.
- Website analytics data: Aggregated and anonymised data is retained indefinitely. Identifiable analytics data is retained for 26 months.
7. International Data Transfers
Our servers are located in the United States. This means personal data collected from users in the European Economic Area (EEA) is transferred to and processed in the US.
We rely on the following safeguards for these transfers:
- The EU-US Data Privacy Framework where our service providers are certified participants
- Standard Contractual Clauses (SCCs) approved by the European Commission, where the Data Privacy Framework does not apply
We ensure that appropriate technical and organisational measures are in place to protect your data regardless of where it is processed.
8. Cookies and Tracking
We use cookies and similar technologies on our websites. Non-essential cookies are only set with your consent.
Essential Cookies
Required for the website and platform to function. These do not require consent.
- Session cookies for login and navigation
- Security cookies
Analytics and Marketing Cookies
Set only with your consent, these help us understand how visitors use our sites and measure the effectiveness of our advertising.
- Google Tag Manager (GTM): Manages the loading of other tracking scripts. GTM container ID: GTM-KLJQZG44.
- Google Analytics: Tracks and reports website traffic. Google may use collected data to contextualise and personalise ads. You can opt out by installing the Google Analytics opt-out browser add-on. Google's privacy policy: policies.google.com/privacy
- Google Ads: Tracks conversions from our advertising campaigns.
Third-Party Form Services
- Formspree: Processes demo request form submissions. Formspree's privacy policy: formspree.io/legal/privacy-policy
You can manage your cookie preferences through your browser settings. Note that disabling essential cookies may affect the functionality of our services.
9. Your Rights Under GDPR
If you are in the EEA, you have the following rights regarding your personal data:
- Right of access: Request a copy of the personal data we hold about you.
- Right to rectification: Request correction of inaccurate or incomplete data.
- Right to erasure: Request deletion of your personal data (subject to legal obligations).
- Right to restriction: Request that we limit how we process your data.
- Right to data portability: Request your data in a structured, machine-readable format.
- Right to object: Object to processing based on legitimate interest, including direct marketing.
- Right to withdraw consent: Where processing is based on consent, you can withdraw it at any time.
To exercise any of these rights, contact us at privacy@traineerecords.com. We will respond within 30 days.
If you are an employee/trainee whose employer uses our platform, please direct data access requests to your employer in the first instance, as they are the data controller for your information.
You also have the right to lodge a complaint with the Data Protection Commission at www.dataprotection.ie if you believe your rights have been infringed.
10. Data Security
We take the security of your data seriously and implement appropriate technical and organisational measures, including:
- SSL/TLS encryption for all data in transit
- Role-based access controls within the platform
- Regular security reviews and updates
- Secure password hashing
- Audit trails for all significant actions within the platform
No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your personal data, we cannot guarantee absolute security.
11. Third-Party Service Providers
We use third-party service providers to help deliver our services. These providers have access to personal data only to perform tasks on our behalf and are obligated not to disclose or use it for any other purpose.
- Hosting: US-based server infrastructure
- Google: Analytics, Tag Manager, Ads (see Section 8)
- Formspree: Form submission processing (see Section 8)
12. Links to Other Sites
Our services may contain links to other websites not operated by us. We have no control over and assume no responsibility for the content or privacy practices of third-party sites. We advise you to review the privacy policy of any site you visit.
13. Children's Privacy
Our services are not directed at anyone under the age of 18. We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at privacy@traineerecords.com and we will take steps to remove that information.
14. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page and updating the "Last updated" date at the top. For significant changes, we may also notify you by email or through a notice on our website.
We encourage you to review this policy periodically.
15. Contact Us
If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us:
- Email: privacy@traineerecords.com
- Post: One World Learning Ltd, National Software Centre, Mahon, Cork, Ireland