Privacy Policy

1. Who we are

Transforming Training Teams Ltd ("we", "us", "our") is the data controller for personal data processed in connection with the CapCore platform. We are a Private LImited registered in England & Wales (company number 16504628).

You can contact us about privacy matters at Mike@capcore.app.

2. What personal data we collect

Account data — name, work email, role, organisation, password (hashed).

Workforce evidence — appraisal entries, performance cases, training records, capability grades and supporting notes you and your colleagues upload.

Operational telemetry — log-in timestamps, IP address (used to detect anomalous access), audit-log records of in-product actions.

Public-site analytics — anonymous session identifiers and traffic-source metadata (UTM parameters, referrer host, approximate country). No cookies are set on the public website.

3. Why we process it (lawful basis)

Contractual necessity — to operate the Service for your organisation under our subscription contract.

Legitimate interests — to keep the Service secure, prevent abuse, improve features and provide support.

Legal obligation — to comply with applicable law (e.g. tax, retention, court orders).

4. Sharing

We do not sell personal data. We share it only with: (a) our vetted sub-processors providing infrastructure (cloud hosting, email delivery, payment processing); (b) competent authorities when legally required; (c) successors in a corporate transaction, subject to equivalent confidentiality.

A current list of sub-processors is available on request.

5. International transfers

Where personal data is transferred outside the UK / EEA, we rely on approved transfer mechanisms (UK Addendum + Standard Contractual Clauses, adequacy decisions, or equivalent safeguards).

6. Retention

Workforce evidence is retained for the duration of your subscription, plus a buffer period for audit and tax purposes (typically 6 years following the end of the relevant accounting period) or as instructed by you.

Operational and security logs are retained for up to 12 months.

Anonymous marketing analytics are retained for 24 months for trend analysis, then deleted.

7. Security

CapCore is engineered to ISO 27001-aligned controls: multi-tenant isolation, field-level encryption of personally identifying attributes at rest, role-based access control, audit logging of data mutations, and a Subject Access Request workflow built into the product. Full detail at /security.

8. Your rights

Under UK-GDPR you have the right to access, rectify, erase, restrict, port and object to processing of your personal data. To exercise any of these rights, contact Mike@capcore.app. We will respond within one month.

You also have the right to complain to the Information Commissioner's Office (ico.org.uk).

9. Changes to this policy

We will post any material changes to this policy at this URL with an updated "last modified" date and, where appropriate, notify you by email.