Traineron

GDPR overview

Implementation is real but light. The privacy policy names the controller — TRAINERON Sp. z o.o., ul. Matuszczaka 14, Rzeszów — cites Regulation (EU) 2016/679 explicitly and lists the rights it grants: access and a copy in a commonly used format, rectification, erasure, restriction, portability, objection, withdrawal of consent and a complaint to the supervisory authority. One channel handles all of them, biuro@traineron.com. Minors' data is processed with a legal guardian's consent, and for children under 13 the guardian carries out every step. Transfers outside the EEA to partners are possible, under an adequate country or Standard Contractual Clauses, and SSL encryption of exchanges is claimed. What is missing: no data protection officer is named, no data processing agreement is offered, and the policy carries neither an effective date nor a version number. No Article 27 representative is designated, which is normal for a company established in the EU.

Who owns the data?

The privacy policy states that information a user enters or imports remains that user's property, and that the publisher will neither use it nor make it public without the user's consent. The terms reserve every right over the System itself — its features, its service offering, its price list — to TRAINERON, but explicitly carve out the training plans, which belong to the users who wrote them. In return, §6 of the terms has the user grant the publisher the licence it needs to publish that content, plans and instructional videos included, inside the platform. Deleting an account removes all information attached to the user, except records administered by other users.

Reuse rights

Traineron collects a name or company name, an e-mail address, an IP address and browser information such as the referring page, the language and the time zone. It uses them to perform the contract and deliver the services, to invoice, to keep its records and to measure satisfaction. It also sends commercial content, a newsletter in practice, from which users can unsubscribe at any time, and it collects anonymous aggregated statistics that it may pass on and uses to improve the service. Financial data is out of scope: the publisher states it stores no card numbers or codes, ING Bank Śląski S.A. storing and processing them to execute payments. Internal access is limited to designated employees, the publisher cannot recover a user's password, and it undertakes not to monitor activity history except when resolving an incident. On the user's side, reuse is unrestricted: the content entered stays the user's property, no permission has to be asked to reuse it, and the GDPR section adds a right to obtain a copy of one's data in a commonly used format. Neither the terms nor the privacy policy say anything about training AI models on customer data — the subject is not raised at all, in either direction.

Data retention & training

Hosting summary

The privacy policy makes a single hosting statement: all data is stored by the publisher in secure hosting centres within the European Union ("Wszystkie dane przechowywane są przez Usługodawcę w bezpiecznych centrach hostingowym na obszarze Unii Europejskiej"). No country is named and no hosting provider is identified, so the declaration stops at the EU level. Transfers outside the EEA to partners remain possible, either towards a country recognised as adequate or under Standard Contractual Clauses. SSL encryption of the data exchanged is claimed. Payment data leaves the publisher's hands entirely: card numbers and codes are stored and processed by ING Bank Śląski S.A. The controller is established in Rzeszów and Polish law governs the contract. Two technical observations that the site does not claim, and which should not be read as publisher statements: media are served from traineronprod.blob.core.windows.net, an Azure Blob Storage endpoint, and the site's IP address resolves in Poland (185.204.216.13, AS41079 Cyber_Folks S.A., Poznań).