Data processing

RODMENA as controller

For this wabsteid and oor ain business correspondence, as set oot in oor Privacy Policy.

RODMENA as processor

Whaur we operate or support seestems haudin yer uisers’ personal data unner contract, the wark is governed by a signed Data Processing Agreement (Article 28 UK GDPR).

Role

A processor acting for the learning management system customer, which is the controller. Article 28 terms are on the Data Processing Agreement page.

Whit is processed

The learner identifier the customer’s system supplies, as an xAPI account of home page and name, and the learning records a course sends, including results and scores. Email-style identifiers are refused.

Hou it is haudit

Ilka customer’s data is separatit by rules the database enforces. Records are encryptit at rest, learner identifiers are stored anely as keyed tokens, and client IP addresses are never stored.

Keepin

Per tenant and contractual. The defaults are 1,095 days for registrations and statement bodies, configurable down to one day.

Optional flows

Aw inside RODMENA, wi nae new sub-processor. Whan a customer switches it on, saved-state and learner-preference documents, that can haud onything a course stores, includin free-text answers, are copied ae way tae the RODMENA LRS and deleted there wi the original or at retention. On request, statements are cross-checked against the LRS copy for the evidence pack. Statements cmi5 writes itsel can cairry RODMENA’s xAPI signature, removed wi the statement at retention or erasure.

Wabhooks

Sent anely tae HTTPS endpoints the customer registers, signed wi HMAC-SHA256, cairryin ids the customer awready hauds and timestamps. Nae learner identifier and nae learning record is sent. Events are keepit for 30 days.

Delytion

A learner’s records are pseudonymised in cmi5 straucht awa, their document copies in the LRS are stappit and taen awa, and the erasure is haundit tae the RODMENA LRS wi a recordit receipt, sae ae request reaches baith systems. Efter a database restore, ilka erasure is reapplied frae sealed records keepit ootside the database, as a step o the restore procedure. The reason recordit for it is a ticket reference or a code, never free text aboot a person.

Return and deletion

Under Article 28(3)(g), a customer’s export runs only efter a second person approves it, is encrypted tae the customer’s ain key and cairies a signed manifest o ilka table the customer awns. At the end o the contract ilka record and stored object version is remuived, and the customer receives a signed, timestamped deletion certificate statin whit wis deleted, whit is keepit and why, and whit it disna cover: backups and logs within thair retention, and LRS data, whit has its ain erasure hand-off.

Location

The same database tier stated abuin, in the Unitit Kinrick, France and Germany, wi nae ither transfer. Course packages and erasure records are encrypted on oor host afore they are uplaidit tae object storage.

RODMENA is based in the Unitit Kinrick. Oor ain seestems an their data are hostit in Unitit Kinrick, France and Germany. Some providers in the register process data elsewhere: Ireland, Unitit States and ither Google locations. Customer deployments rin whauriver the customer chooses, commonly on the customer’s ain infrastructure.

Ilka provider that processes data ootside the Unitit Kinrick, and the safeguard for that transfer, is shawn in the register abuin: OVHcloud, Google Workspace, Anthropic and GitHub. Oor Terms are govrened by the law o England and Wales.

We help controllers respond tae data-subject richts requests (access, rectification, erasure, restriction, portability, objection) within the statutory ae-month period. Requests aboot data we control gang tae gdpr@rodmena.co.uk.