Data processing

RODMENA as controller

For this wabsteid an oor ain business correspondence, as set oot in oor Privacy Policy.

RODMENA as processor

Whaur we operate or support seestems haudin yer users' personal data unner contract, the wark is governed by a signed Data Processing Agreement (Article 28 UK GDPR).

Role

A processor acting for the learning management system customer, which is the controller. Article 28 terms are on the Data Processing Agreement page.

Whit is processed

The learner identifier the customer’s system supplies, as an xAPI account o hame page an name, an the learnin records a coorse sends, includin results an scores. Email-style identifiers is refused.

Hou it is haud

Ilka customer’s data is separatit by rules the database enforces. Records is encryptit at rest, learner identifiers is stored only as keyed tokens, an client IP addresses is niver stored.

Keepin

Per tenant an contractual. The defaults is 1,095 days fur registrations an statement bodies, configurable doon tae ae day.

Optional flows

Aa inside RODMENA, wi nae new sub-processor. Whan a customer switches it on, saved-state an learner-preference documents, that can haud onythin a coorse stores, includin free-text answers, are copied yin wye tae the RODMENA LRS an deleted there wi the oreeginal or at retention. On request, statements are cross-checked agin the LRS copy for the evidence pack. Statements cmi5 writes itsel can cairry RODMENA’s xAPI signature, remuived wi the statement at retention or erasure.

Webhooks

Sent onlie tae HTTPS endpoints the customer registers, signed wi HMAC-SHA256, cairryin ids the customer already haes an timestamps. Nae learner identifier an nae learning record is sent. Events is keepit for 30 days.

Erasure

A learner’s records are pseudonymised in cmi5 straucht awa, their document copies in the LRS are stapped and taen oot, and the erasure is haunded tae the RODMENA LRS wi a recordit receipt, sae ae request reaches baith systems. Efter a database restore, ilka erasure is reapplied frae sealed records keepit ootside the database, as a step o the restore procedure. The reason recordit for it is a ticket reference or a code, never free text aboot a person.

Return and deletion

Under Article 28(3)(g), a customer’s export runs only efter a second person approves it, is encrypted tae the customer’s ain key an cairries a signed manifest o ivery table the customer awns. At the end o the contract ivery record an stored object version is remuived, an the customer gets a signed, timestamped deletion certificate statin whit wis deleted, whit is keepit an why, an whit it disna cover: backups an logs within their retention, an LRS data, whilk haes its ain erasure hand-off.

Location

The same database tier statit abune, in the Unitit Kinrick, France an Germany, wi nae ither transfer. Course packages an erasure records are encryptit on oor host afore they are uplaidit tae object storage.

RODMENA is based in the Unitit Kinrick. Oor ain systems an their data are hostit in Unitit Kinrick, France and Germany. Some providers in the register process data elsewhere: Ireland, Unitit States and ither Google locations. Customer deployments run whauriver the customer chooses, commonly on the customer's ain infrastructure.

Ilka provider that processes data ootwi the Unitit Kinrick, an the safeguard fur that transfer, is shawn in the register abuin: OVHcloud, Google Workspace, Anthropic and GitHub. Oor Terms are govrened bi the law o England an Wales.

We help controllers respond tae data-subject rights requests (access, rectification, erasure, restriction, portability, objection) within the statutory one-month period. Requests aboot data we control gang tae gdpr@rodmena.co.uk.