Data Processing Agreement

Last updated: 25 October 2026

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between you (the “Customer”) and Growth Training & Consulting Ltd, trading as Practopro (“Practopro”, “we”, “us”), a company registered in England and Wales (company number 13174612) with its registered office at 1 Fairface Way, Woburn Sands, Milton Keynes, MK17 8FJ, United Kingdom.

It records how we handle personal data on your behalf, and applies whenever we process personal data for which you are the controller. Where this DPA and the Terms of Service conflict on the handling of personal data, this DPA takes precedence.

In this DPA, “UK GDPR”, “controller”, “processor”, “data subject”, “personal data” and “processing” have the meanings given to them in the UK General Data Protection Regulation and the Data Protection Act 2018 (together, the “Data Protection Legislation”).

1. Roles of the parties

You are the controller of the personal data you and your users put into Practopro. We are your processor for that data, and we process it only to provide the service described in the Terms of Service and on your documented instructions.

We act as a controller in our own right for a limited set of data: the account and billing details of the person who contracts with us, our own records of support correspondence, and the aggregated anonymised data described in section 11. That processing is governed by our Privacy Policy, not by this DPA.

2. Subject matter, duration, nature and purpose

• Subject matter. Provision of an AI-powered sales and interview training platform, including training modules, spoken role-play practice, automated coaching feedback and management reporting.
• Duration. For as long as your subscription is in effect, and thereafter only for the retention period set out in section 9.
• Nature and purpose. Hosting, storage, transcription, AI-assisted analysis and scoring, recording and playback, email notification, and the production of progress and performance reporting for your managers and administrators.

3. Types of personal data and categories of data subject

Categories of data subject

• Your employees, workers and contractors who use the platform as learners, managers, curators or administrators.

Types of personal data

• Identity and contact data: name, work email address, job title, profile photograph.
• Account data: organisation membership, role, reporting line, and activity timestamps.
• Training and performance data: module completion, quiz answers, assignments, scores against your organisation’s scoring criteria, and coaching feedback generated about a user’s performance.
• Voice and transcript data: audio of role-play sessions, transcripts of those sessions, and video recordings where recording is enabled.
• Manager commentary: review notes written about a user by their manager or administrator.

We do not require, and the platform is not designed to collect, special category data as defined in Article 9 of the UK GDPR. You should not upload special category data, and you are responsible for the content your users place into free-text fields and spoken practice.

4. Our obligations

• Instructions. We process personal data only on your documented instructions, including as to international transfers, unless required to do otherwise by law — in which case we will tell you before processing, unless the law prohibits it. Your use of the platform and its settings constitutes your instructions.
• Lawfulness of instructions. If we consider that an instruction infringes the Data Protection Legislation, we will tell you without undue delay.
• Confidentiality. We ensure that anyone authorised to process your personal data is subject to an appropriate duty of confidence.
• Security. We implement appropriate technical and organisational measures as set out in section 5.
• Assistance. Taking into account the nature of the processing, we assist you by appropriate measures in responding to requests from data subjects exercising their rights, and in meeting your obligations under Articles 32 to 36 of the UK GDPR, including data protection impact assessments and prior consultation.
• Information and audit. We make available the information necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate. Audits are limited to once in any twelve-month period unless a personal data breach has occurred, must be on reasonable notice, during business hours, and must not compromise the confidentiality of our other customers.

5. Security measures

Taking into account the state of the art, the cost of implementation, and the nature, scope, context and purposes of processing, we implement and maintain the following measures:

• Tenant isolation.Every table holding customer data enforces row-level security scoped to the owning organisation, so one organisation cannot read another’s data.
• Access control.Access within an organisation is governed by role (learner, manager, curator, administrator). A manager can see only their own direct reports. A learner’s practice session marked private is not visible to their manager unless the learner shares it or the session was formally assigned.
• Encryption. Data is encrypted in transit using TLS, and at rest by our hosting and storage providers.
• Recordings. Session recordings are held in private storage and served only through short-lived signed links.
• Credential management. Secrets are held in managed environment configuration, never in source code, and are rotated on a defined schedule and immediately on any suspected exposure.
• Separation of duties.Platform administrators at Practopro can administer accounts and content. They can read aggregated, anonymised statistics across customers; they do not have a facility to browse an individual customer’s recordings or transcripts for analytics purposes.
• Monitoring. Vendor and dependency changes are reviewed on a recurring schedule so that security updates and deprecations are acted on rather than discovered late.
• Resilience and restoration. The database is backed up daily by our hosting provider and retained for seven days, so that availability of and access to personal data can be restored in a timely manner following a physical or technical incident.

6. Sub-processors

You give general authorisation for us to engage the sub-processors listed below. Each is engaged under a written contract imposing data protection obligations no less protective than those in this DPA, and we remain fully liable to you for their performance.

We will give you at least 30 days’ notice before adding or replacing a sub-processor. If you have a reasonable objection on data protection grounds, tell us within that period and we will work with you in good faith to find a resolution; if none can be found, you may terminate the affected part of the service without penalty for the remainder of the paid period.

7. International transfers

The application database, file storage and product analytics are hosted in the European Union. Several of the sub-processors listed above are established in the United States, and avatar video content may be served from Asia-Pacific infrastructure. Processing of personal data therefore takes place outside the United Kingdom.

Where personal data is transferred outside the United Kingdom, we rely on the UK International Data Transfer Agreement, or the UK Addendum to the European Commission’s Standard Contractual Clauses, or another transfer mechanism recognised under the Data Protection Legislation, together with a transfer risk assessment and any supplementary measures that assessment identifies as necessary.

8. Personal data breaches

We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting personal data we process on your behalf. The notification will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Where we cannot provide all of that at once, we will provide it in phases without further undue delay.

Notification is not an admission of fault or liability. Reporting to the Information Commissioner’s Office and to affected data subjects remains your responsibility as controller, and we will assist you in doing so.

9. Retention, return and deletion

• We retain personal data for as long as your subscription is in effect, and in accordance with any retention period configured for your organisation.
• On termination or expiry, we will delete or return the personal data at your choice, and delete existing copies, within 90 days — unless we are required by law to retain it, in which case we will tell you what we must keep and why.
• Backups are deleted on the ordinary backup cycle, which is seven days. Until that cycle completes, data in backups remains protected by the measures in section 5 and is not restored to live use.

10. Your obligations as controller

• You are responsible for establishing a lawful basis for the processing you instruct, and for providing your users with the information required by Articles 13 and 14 of the UK GDPR.
• Role-play sessions are recorded and transcribed. You are responsible for telling your users that this happens, that their managers and administrators can see the results, and what that means for them.
• You are responsible for the accuracy of the personal data you upload, for the content your users place into free-text and spoken input, and for managing your users’ roles and access within the platform.
• Scores and coaching feedback are generated by AI, are indicative, and can be wrong. You are responsible for any decision you take about a person, and should not make a decision with legal or similarly significant effect based solely on automated processing within Practopro.

11. Aggregated and anonymised data

We produce aggregated, anonymised data from use of the platform — for example how much practice is done, how scores are distributed, and which coaching themes recur — and use it to improve the service and for our own analytics, including benchmarking as described in our Privacy Policy.

This excludes customer content: it never includes recordings, transcripts, coaching notes or uploaded material, and it never identifies a data subject, a customer organisation, or any figure attributable to one. Once anonymised in this way the data is no longer personal data, and we process it as controller. Statistics are suppressed where the underlying group is too small for the result to be anonymous.

Your organisation takes part in benchmarking by default. An administrator may switch it off at any time in the organisation settings; an organisation that opts out neither contributes to benchmarks nor receives them.

12. Liability

Each party’s liability under this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service.

13. Contact

For any question about this DPA, to make a data protection request, or to exercise the audit rights in section 4, contact us at customersupport@practopro.com, or by post to Growth Training & Consulting Ltd, 1 Fairface Way, Woburn Sands, Milton Keynes, MK17 8FJ, United Kingdom.

If you require a countersigned copy of this DPA for your records, or your own DPA template reviewed, please contact us using the details above.