Terms for handling participant information.

For participant information collected in a workbook, the facilitator, or the organisation the facilitator works for, decides what is collected and why, and is the controller. Leargas acts as the processor and only handles that information to provide the service.

For facilitator account information, such as name, email address, the role given at sign up and usage records, Leargas is the controller and the privacy policy applies.

Subject matter: running interactive workbooks before, during and after a training session. Duration: for as long as the account is open, or until the workbook or its participant data is deleted.

Types of information: participant display names, answers typed into exercises, group and room membership, completion status, requests for help, and technical records such as timestamps.

Categories of people: session participants and any co-facilitators invited by the account holder.

Special category information must not be collected through Leargas. The product is not designed for health, financial, credential or other sensitive records, and controllers agree not to ask participants for them.

We process participant information only on the controller's documented instructions, which are the actions taken through the product itself and any written request to us. We do not use participant answers to develop or train models, and we do not use them for our own purposes.

Everyone with access is bound by confidentiality. Access to participant answers is limited to the account holder, the co-facilitators they invite, and the small number of our staff who need it to resolve a fault, with those internal accesses recorded.

Access rules are enforced by the database itself, so a participant can only reach their own answers and a facilitator only their own workbooks. Information is encrypted in transit and at rest, sign in is handled by a managed provider, and important actions are recorded in a log the facilitator can view. Our security overview describes the measures in more detail.

We use the providers listed on our subprocessor page, each under a written agreement with equivalent obligations. That page is updated before a new provider handling personal information is added, and controllers may object on reasonable data protection grounds.

Participant information is held in managed cloud hosting in the European Union. Where any transfer outside the UK or EEA is needed we rely on an adequacy decision or Standard Contractual Clauses.

If a participant contacts us directly we will refer them to the facilitator running the session. We will help the controller answer access, correction, deletion and portability requests, including by exporting or clearing a workbook's participant data.

If we become aware of a breach affecting participant information we will notify the affected account holders without undue delay, and in any case within 72 hours of confirming it, with what we know about the cause, scope and remedy.

A facilitator can clear a workbook's participant data at any time, set it to clear automatically after a session, or delete the workbook entirely. On account closure participant information is removed within 30 days, apart from anything we must keep for legal reasons. Exports in spreadsheet form are available at any time while the data is present.

On reasonable written request we will provide the information needed to show we are meeting these terms, including our security overview and answers to a due diligence questionnaire. On site audits are not offered.

Leargas is a trading name of TWS Training Ltd. Company number 15950678. VAT number GB 475 8050 70. Registered office: 47 Woodville Road, Barnet, England, EN5 5HB. Email hello@leargas.co.uk.

For anything covered by these terms, email hello@leargas.co.uk.