Data processing terms

These terms apply when a venue or tour operator (the business) in the European Economic Area, Switzerland or the United Kingdom uses PicTrainer to train its staff or guides. They form part of the Terms and are accepted with them when a team is created. They follow Article 28 of the GDPR and the UK GDPR.

1. Roles

For its team’s training records, the business is the controller and PicTrainer is its processor. PicTrainer processes that data only to run the service for the business, on its documented instructions, which are these terms and the business’s use of the dashboard.

The business alone decides what it collects through PicTrainer and what it does with it, and is responsible for doing so lawfully where it operates: in particular, for any permission needed to take, keep or publish photos of people, including its guests or travelers. PicTrainer doesn’t check those permissions.

PicTrainer is itself the controller for the app’s own users outside any team (their lessons stay on their phones), for owners’ and managers’ sign-in accounts, and for billing; the privacy notice covers those.

2. What is processed

People	The business’s staff or guides who join its team; its owners and managers
Data	First name, the lessons finished for the team and when, the date of the final practical; an anonymous ID for each phone; owners’ and managers’ email addresses; the team’s own content (spots or photo stops, their photos and locations, rules, welcome)
Purpose	Showing the business its team’s training, and giving the team the business’s own lessons
Duration	While the team exists; see section 7 for deletion
Special categories	None. The service isn’t designed for them, and the business mustn’t upload them

3. PicTrainer’s commitments

PicTrainer will:

• process the data only on the business’s instructions, and tell the business if it believes an instruction breaks the law;
• make sure everyone who can access it is bound to confidentiality;
• keep it secure with the measures in section 5;
• use subprocessors only as in section 4;
• help the business answer people who use their rights (to see, correct or delete their data), mostly through the dashboard itself, where the business sees and can remove any team member;
• help the business with security, breach notices and impact assessments, as far as the information PicTrainer holds allows;
• delete the data as in section 7;
• give the business the information needed to show these terms are met, and allow audits as in section 8.

4. Subprocessors

The business authorizes the subprocessors listed on the Subprocessors page. PicTrainer will give at least 30 days’ notice of a new or replaced subprocessor there and by email to owners; the business may object on reasonable data protection grounds, and if we can’t resolve it, may end its plan and get a refund of prepaid, unused time. PicTrainer holds each subprocessor to data protection terms no less protective than these, and remains responsible for them.

5. Security

• Data stored in the EU (Frankfurt, Germany), encrypted in transit (TLS) and at rest.
• Each business sees only its own team: every table is protected by database row-level security, tested for each role (staff, owners, managers, other businesses).
• Sign-in by one-time email code or link; no passwords to steal.
• A team member is known to the business only by the first name they choose; the app keeps their practice photos on their phone and never uploads them.
• Photos uploaded to a team are re-encoded, which removes their location and camera data.
• Access to production systems is limited to the people who run the service.
• Backups under the database provider’s retention window.

6. Personal data breaches

PicTrainer will tell the business without undue delay, and within 48 hours of becoming aware, of a breach affecting its team’s data, with what is known then and more as it’s learned, so the business can meet its own 72-hour duty.

7. Deletion

• A team member who leaves a team, or is removed, is deleted from it at once.
• When a business deletes its team, everything under it is deleted at once, including photos.
• When a plan ends, the data is kept for 90 days in case the business returns, then deleted, with a warning to owners at least a week before.
• Backups roll off within the provider’s retention window.

The business can export its team (a CSV) from the dashboard at any time before deletion.

8. Audits

PicTrainer will answer the business’s reasonable written questions about its processing, once a year or after a breach. Where that isn’t enough to show compliance, the business may audit, at its own cost, with 30 days’ notice, during business hours, and under confidentiality.

9. International transfers

Where data leaves the EEA, Switzerland or the UK (see the subprocessors list), the transfer relies on an adequacy decision (including the EU–US Data Privacy Framework for certified companies) or the European Commission’s standard contractual clauses, module 3 (processor to processor), with the UK addendum. PicTrainer is a company in the United States; its own access to the data relies on the standard contractual clauses, module 2 (controller to processor), with the UK addendum.

10. Precedence and liability

If these terms and the Terms conflict on data protection, these terms win. Each side’s liability under these terms is as set out in the Terms, except where the law doesn’t allow it to be limited.

Contact

Data protection questions: [email protected].