Version 2026-11-07
Data Processing Terms
These terms apply where the customer is controller and Paul Weller traing as Masterplan is processor of personal data in the Masterplan service.
Processing details
Subject matter: workplace standards, learning, assignments, knowledge checks, practical assessments, competence/skills visibility, team learning, improvement records and related administration.
Duration: for the trial/service term plus the agreed return/deletion period and unavoidable backup lifecycle.
Purpose: to provide, secure, support and maintain the Masterplan service on the customer's documented instructions.
Data subjects: customer personnel, contractors and authorised users.
Data types: identity/contact data, company/team/access data, training and competence records, uploaded workplace content, support/feedback and service-security metadata. The founding beta is not intended for special-category data without prior written agreement.
Documented instructions
Masterplan will process customer personal data only on the customer's documented instructions, including these terms and normal authorised use of the service, unless UK law requires otherwise. If legally permitted, Masterplan will inform the customer of such a legal requirement.
Confidentiality and security
People authorised to process customer personal data must be subject to appropriate confidentiality obligations. Masterplan will maintain proportionate technical and organisational measures designed to protect confidentiality, integrity, availability and resilience, including authenticated access, tenant scoping, HTTPS in production, controlled permissions, backups appropriate to the service and security incident procedures.
Subprocessors
The customer gives general written authorisation for subprocessors needed to operate Masterplan. Current core providers may include Railway for application/database infrastructure, Cloudflare Stream where customer video upload is enabled, and the configured transactional email provider. Masterplan will maintain an up-to-date subprocessor list and provide reasonable notice of material additions or replacements so the customer can raise a legitimate data-protection objection. Equivalent data-protection obligations will be imposed on subprocessors as required.
International transfers
Where personal data is transferred outside the UK, Masterplan will rely on an applicable lawful transfer mechanism and contractual safeguards. Customers should review the current subprocessor information and hosting configuration for their requirements.
Individual rights and controller assistance
Taking into account the nature of processing, Masterplan will provide reasonable assistance for the customer's handling of data-subject rights requests and, where applicable, security obligations, breach notifications, DPIAs and regulatory consultation.
Personal data breaches
Masterplan will notify the customer without undue delay after becoming aware of a personal data breach affecting customer personal data and will provide available information reasonably needed for the customer's assessment and notification duties.
Return and deletion
At the end of processing, at the customer's choice and subject to applicable law, Masterplan will return/export or delete customer personal data and delete remaining copies as they age out of controlled backup systems. Legal retention obligations may require limited continued storage.
Audit and information
Masterplan will provide information reasonably necessary to demonstrate compliance with these processor obligations and will allow reasonable audits/inspections subject to appropriate confidentiality, security, scope and frequency safeguards.
Customer obligations
The customer is responsible for having a lawful basis and appropriate transparency for its workforce processing, issuing lawful instructions, configuring users/access appropriately and ensuring the information it places in Masterplan is lawful and proportionate.