Privacy policy

Last updated: 2026-10-25

Who we are

TrainingDue is operated by Jose Lopez Garcia, a sole trader based in Spain ([BUSINESS ADDRESS]). Contact: jose@trainingdue.com. Because we operate from Spain, the EU General Data Protection Regulation (GDPR) applies to the personal data we handle, wherever you are.

What we collect

• Account details you give us: your name, company, email address, the ZIP code and radius for your alerts and the services you sell.
• Billing details: handled by Paddle, our merchant of record. We receive your name, email, country, the plan you bought and the payment status. We never see or store your card details.
• Messages you send us by email.
• Email delivery data from our email provider: whether an alert was delivered, bounced or marked as spam.

We set no cookies of our own and use no analytics or advertising trackers. The home page loads Paddle's checkout script (Paddle.js) from Paddle's servers, so Paddle receives your IP address and browser details when you open it, and may use cookies or local storage for checkout and fraud prevention; see Paddle's privacy policy. Our hosting provider keeps standard server logs (such as IP address and pages requested) for security.

Why we use it and on what legal basis

• To send the alerts you subscribed to and run your account (performance of a contract).
• To bill you and keep invoices and tax records (legal obligation).
• To answer your messages and keep the service secure (legitimate interest).

We do not sell your personal data and we do not use it for advertising.

Who processes it for us

• Paddle (checkout script on the home page, payments, invoicing and taxes, as merchant of record).
• Resend (sending email).
• Cloudflare (website hosting and the service's servers and database).

Some of these providers process data in the United States. Where they do, transfers rely on safeguards such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.

The data in the alerts

The alerts contain public records of OSHA enforcement published by the US Department of Labor: employer names, addresses, standards cited, dates and penalties. They describe businesses, not you.

How long we keep it

We keep your account data while you are a customer and delete it within 90 days after you leave, except billing records, which we keep as long as tax law requires.

Your rights

You can ask to access, correct, delete or export your data, to restrict or object to its use, and to withdraw consent where we rely on it. Write to jose@trainingdue.com; we answer within 30 days. California residents have equivalent rights under the CCPA, and we do not sell or share personal information as that law defines it. You can also complain to the Spanish data protection authority (Agencia Española de Protección de Datos, aepd.es).

Changes

If we change this policy in a way that matters, we tell customers by email before it takes effect.