Legal
Privacy notice
In force from
For triolms.com, its client accounts and every TrioLMS site.
Who we are
TrioLMS is run by Keith Taynton, at Unit 174162, PO Box 7169, Poole, Dorset BH15 9EL, United Kingdom. For anything about your data, write to privacy@triolms.com.
Two roles
- When we decide why your data is used, we are the controller. That covers visitors to triolms.com, people who use its contact form, and our clients’ TrioLMS administrators and billing contacts.
- When you use a site your employer or training provider runs on TrioLMS, they are the controller and we are their processor. We only use your data to run the site for them, under a Data Processing Agreement. Questions about your training record go to them first; we will help them answer.
The website (triolms.com)
- The website sets no cookies and stores nothing about you.
- Contact form: your name, email address, organisation, what you’re interested in and your message are sent to us by email, so we can reply. They are not stored on the website. Cloudflare Turnstile checks that a person, not a bot, sent the form.
- Prices are read from Stripe, and nothing about you is sent to Stripe while you browse.
TrioLMS administrators and billing contacts
- What we hold: your email address, your name if you give it, your language, your sign-in method (an authenticator app or a passkey, never a password), the orders, invoices and changes made on your account, and which version of the terms and the Data Processing Agreement your organisation accepted, and who accepted them.
- Why: to run the contract with your organisation, to sign you in securely, and to bill for the plan.
- Payments: Stripe handles checkout, card details, tax and invoices as merchant of record, under its own privacy policy. We never see full card numbers.
- Where: in your organisation’s home region, UK/EU or US.
- Free trials: so each person, company and card has one free trial, we keep a keyed fingerprint of the email address you start it with, its company’s domain (not for free email services like Gmail) and the card’s fingerprint from Stripe. It can’t be turned back into the address or card, only matched when the same one is used again. We keep it for as long as we offer free trials, even after the account is deleted, because that is what stops a second trial.
People in a site (learners, managers, authors and site admins)
Your organisation decides who is added and why. TrioLMS holds only:
| What | Why | Kept until |
|---|---|---|
| Company ID (for staff) | Matching imports and single sign-on to the right person | End of the audit period |
| Email address | Verification links, sign-in codes and reminders | 7 days after removal for good |
| Name (optional for staff, required for externals) | Reports, certificates, the name a course shows, the audit log | End of the audit period |
| Organisation and notes (externals only) | Telling site admins who an external works for | 7 days after removal for good |
| Language | Pages and emails in your language | 7 days after removal for good |
| Training records: courses, attempts, scores, certificates, and the xAPI statements courses send | The training record your organisation needs to keep | End of the audit period |
We never store a birthdate, photo, phone number, home address or password. Courses see a random ID of ours, never your company ID or email address, and SCORM courses see only your name (or “Learner”). The audit log records who changed what and the network address it came from, and is kept for the audit period.
The audit period is 3 years unless your organisation chooses between 1 and 10. An account in the bin keeps its details for 90 days by default, so it can be restored.
Where your data is kept
A site’s data stays in its region: the UK/EU region (Cloudflare’s EU jurisdiction) or the US region. A small global directory holds only routing data, our own staff accounts, plans and the course catalogue, and no one’s personal data. Requests are handled at the Cloudflare location nearest you, so data passes through other countries on its way to its region, but it is only stored in that region.
Cookies
We use only the cookies needed to sign you in: one session cookie for each address you sign in at, and short-lived ones used while you sign in (tying a code to the browser that asked for it, or a single sign-on back to where it started). They are never used for tracking or advertising, never shared between addresses, and never sent to the address that serves course files. There are no analytics or advertising cookies, so we don’t ask for consent.
Who else processes it
Cloudflare (hosting, storage, email and bot checks), WorkOS (only when your organisation uses single sign-on or directory sync), and Stripe (billing contacts only).
The list of subprocessors, in the Data Processing Agreement
How long we keep it
As in the table above. When a client’s account ends, its sites are paused for 60 days so site admins can export their records, then archived, and deleted 6 months after the account ended. A free trial that ends unbought is paused for 14 days, then deleted with everything in it, its sites and their addresses included; only the trial’s fingerprints are kept, as above. Deleting a site destroys its encryption key, so even backups (kept 30 days) can no longer be read.
Your rights
Under UK and EU GDPR you can ask for a copy of your data, its correction or deletion, to restrict or object to its use, and to take it elsewhere. For a site, ask your organisation: its site admins can download everything held about you, or erase you early. For anything we control, write to privacy@triolms.com. We answer within one month. You can also complain to the Information Commissioner’s Office (ico.org.uk) or your local supervisory authority.
Changes
We will post changes here, and tell TrioLMS administrators by email before a change that affects them.