Last updated: 6 September 2026
Terrant Security Limited ("Terrant", "we", "us" or "our") provides compliance training and learning management services. This notice explains how personal data is handled through our website at terrant.co and the application known as Terrant, including its mobile app. We are the data controller for the login credentials used to access the Terrant application.
We are a business-to-business company. If you use Terrant as an employee of one of our clients, your employer is the data controller for your employee information and training records. Your employer decides why that information is processed and how it is used. We process it on your employer's behalf as a data processor, following its instructions under our data processing agreement with your employer. The separate arrangements for login credentials are explained below.
We process the login credentials needed to authenticate you and give you access to Terrant. This includes the sign-in details and authentication information needed to verify your identity. We act as the data controller for this processing and use Kinde to provide authentication services.
We process your login credentials on the basis of legitimate interests under Article 6(1)(f) of the UK GDPR. Our interests, and those of your employer, are to provide authorised employees with secure access to Terrant and prevent unauthorised access to accounts and personal data. We limit this processing to the authentication information necessary for those purposes. You have the right to object to this processing, as explained in section 9.
On your employer's instructions, we process information needed to provide its training service, including:
This information is provided by your employer or generated as you use Terrant. We process it to deliver assigned training, record progress and results, make those records available to your employer's authorised users, and operate the service on your employer's behalf.
We act as a data processor for this information. We do not use it for our own independent purposes. Your employer determines the applicable lawful basis and is responsible for explaining its use of your employee information in its own privacy notice.
Employee accounts are created by your employer's administrator. Employees cannot create their own accounts. The employee app does not collect personal photographs or provide a facility for employees to upload them.
We act as a data controller for information you provide when you contact us about our services. This may include your name, email address, telephone number, organisation, role and the contents of your correspondence.
We use this information to respond to your enquiry, assess whether we can assist you, communicate about our services and manage the resulting business relationship. For enquiries, we rely on our legitimate interests in responding to people who contact us and evaluating potential client engagements. Where you personally enter into a contract with us, we may also process information necessary to perform that contract.
Our website uses essential technologies for security and reliable delivery, including Cloudflare services. We do not use website analytics or advertising cookies. Further information about cookies appears below.
We use service providers to help deliver Terrant. They process personal data on our instructions. Where we are the controller, they act as our processors; where we act on behalf of your employer, they act as subprocessors under the applicable arrangements with your employer.
Our service providers include:
| Provider | Service |
|---|---|
| Convex | Application backend and data storage |
| Kinde | Authentication |
| Brevo | Email delivery |
| Sentry | Error monitoring |
| IONOS | Hosting and infrastructure |
| Cloudflare | Website delivery and security |
| bunny.net | Training video hosting and delivery |
We do not disclose employee information to external organisations for their own independent use. Our use of service providers is limited to delivering the relevant services under our instructions. Your employer's authorised users can access employee information and training records as part of the service provided to your employer.
Our hosting and processing arrangements include the European Union and the United Kingdom. Kinde, our authentication provider, is based in Australia.
Where personal data is transferred outside the UK or the European Economic Area, we ensure that the transfer is covered by an applicable adequacy decision or appropriate contractual safeguards. These include the European Commission's Standard Contractual Clauses and, where required for transfers subject to UK data protection law, the UK Addendum.
You can contact [email protected] for information about the safeguards applicable to your personal data and how to obtain a copy.
Login credentials: We retain credentials while the account is active and delete the associated personal data within 30 days after the account is no longer active.
Employee information and training records: Your employer determines the retention schedule while an active account remains in place. We retain and delete this information in accordance with its instructions. Where there is no longer an active account in place, the associated employee information and training records are deleted within 30 days.
Logs: Logs are retained for three months.
Business enquiries: If an enquiry does not lead to a client engagement, we delete the enquiry information within 12 months of our last meaningful contact. Where an engagement follows, the applicable retention arrangements are set out in our engagement terms.
Uninstalling the app does not itself close your account or delete records held for your employer. Contact your employer's administrator about account closure and the retention of your training records.
We employ appropriate technical and organisational measures to protect personal data. These include policies and procedures, access controls, firewalls and other security technologies. We regularly conduct security testing and static code security audits, which examine application code for potential security weaknesses.
Our website uses strictly essential cookies for its operation and security. It does not use non-essential analytics, advertising or tracking cookies.
| Cookie | Purpose | Duration |
|---|---|---|
| _cfuvid | Cloudflare security cookie used to apply rate-limiting protections and support reliable access | Session |
Depending on the circumstances and applicable law, you may have rights to access your personal data, correct inaccurate information, request erasure, restrict processing, receive your data in a portable format, and object to processing based on legitimate interests. These rights are subject to the applicable legal conditions.
You may object to processing based on legitimate interests on grounds relating to your particular situation by contacting [email protected]. We will stop that processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for the establishment, exercise or defence of legal claims.
For employee information and training records, contact your employer as the data controller. Your employer decides how to respond, and we assist it in accordance with its instructions and our obligations as a processor.
For login credentials, or information we hold as controller in connection with a business enquiry, contact us at [email protected].
You can also contact us at that address about an employee-data request. Where your employer is the controller, we will help direct the request to it and assist it as appropriate.
You can raise concerns with us at [email protected]. You also have the right to complain to the UK's Information Commissioner's Office at ico.org.uk, or to another competent data protection supervisory authority where applicable.
We may update this notice to reflect changes to our services or processing arrangements. The current version will be available on our website with its last-updated date.
For questions about this notice or the processing of your personal data, contact Terrant Security Limited at [email protected].