tradroom

Data Processing Agreement

Last updated 4 August 2026

This Data Processing Agreement (the “DPA”) forms part of, and is subject to, the Terms of Use between Tradroom and the organisation or independent tutor that holds a Tradroom account (the “Controller”). “Tradroom” means Gearóid Keane, trading as Tradroom (a business name registered in Ireland). It sets out the terms on which Tradroom (the “Processor”) processes personal data on the Controller’s behalf, as required by Article 28 of the UK/EU General Data Protection Regulation (“GDPR”) as applicable in Ireland. Where this DPA and the Terms of Use conflict on the processing of personal data, this DPA prevails.

1. Roles and scope

For the personal data described in Annex 1, the Controller is the data controller and Tradroom is the data processor. Each party will comply with its own obligations under data-protection law. The Controller is responsible for the lawfulness of the data it puts into Tradroom, including having a valid legal basis and, where applicable, the necessary consents (for example a parent or guardian’s consent for a child — see the Terms and Privacy Policy).

2. Processing on documented instructions

Tradroom will process personal data only on the Controller’s documented instructions, including as to international transfers, unless required to do otherwise by law — in which case Tradroom will tell the Controller first, unless the law prohibits it. The Controller’s instructions are given by its use of the service in accordance with the Terms of Use, its account settings, and this DPA. Tradroom will inform the Controller if, in its opinion, an instruction infringes data-protection law.

3. Confidentiality

Tradroom ensures that the people it authorises to process personal data are bound by an appropriate duty of confidentiality and only access personal data as needed to provide the service.

4. Security

Taking account of the state of the art, the costs of implementation and the risks to individuals, Tradroom implements appropriate technical and organisational measures to protect personal data, including:

  • encryption of data in transit (TLS) and encryption of sensitive personal data at rest;
  • role-based access control, so each user reaches only the data their role permits, with access mediated by a single access layer and logged;
  • presigned, time-limited links for file downloads rather than public URLs;
  • hosting with reputable infrastructure providers within the EU/EEA where practical (see Annex 2);
  • separation of tenants so one organisation or tutor cannot access another’s data.

5. Sub-processors

The Controller gives Tradroom general authorisation to engage the sub-processors listed in Annex 2 to help provide the service. Tradroom imposes data-protection obligations on each sub-processor that are no less protective than this DPA, and remains responsible to the Controller for their performance. Tradroom will give the Controller reasonable notice of any intended addition or replacement of a sub-processor (for example by updating Annex 2 and notifying account holders), and the Controller may object on reasonable data-protection grounds; if a resolution cannot be found, the Controller may terminate the affected part of the service.

6. Assistance with data-subject rights

Taking account of the nature of the processing, Tradroom will assist the Controller by appropriate technical and organisational measures, so far as possible, to respond to requests from individuals exercising their rights (access, rectification, erasure, restriction, portability and objection). Much of this is available to the Controller directly within the service. If Tradroom receives such a request directly, it will refer the individual to the Controller and will not respond itself except on the Controller’s instructions.

7. Assistance with security, breaches and impact assessments

Tradroom will assist the Controller, taking account of the nature of the processing and the information available to it, to meet its obligations to keep data secure, to notify personal-data breaches, and to carry out data protection impact assessments and prior consultations (Articles 32–36 GDPR). Tradroom will notify the Controller without undue delay after becoming aware of a personal-data breach affecting the Controller’s data, and will provide the information the Controller reasonably needs to meet its own notification duties.

8. Return or deletion of data

On the end of the service, and at the Controller’s choice, Tradroom will delete or return the personal data it processes on the Controller’s behalf and delete existing copies, unless the law requires it to keep them. This is subject to the export opportunities and the short backup-retention and recovery windows described in the Terms of Use.

9. Audits and information

Tradroom will make available to the Controller the information reasonably necessary to demonstrate compliance with Article 28, and will allow for and contribute to audits, including inspections, conducted by the Controller or an auditor it mandates. Audits are on reasonable prior notice, no more than once a year (except where required by a supervisory authority or following a breach), during business hours, and subject to confidentiality, so as not to disrupt the service or other customers’ data.

10. International transfers

Tradroom will not transfer the Controller’s personal data outside the EEA except where a valid transfer mechanism under the GDPR applies (for example an adequacy decision or Standard Contractual Clauses with any additional safeguards required). Where a sub-processor in Annex 2 processes data outside the EEA, the applicable mechanism is noted there.

11. Liability, term and governing law

This DPA takes effect when the Controller accepts the Terms of Use and continues for as long as Tradroom processes personal data on the Controller’s behalf. Each party’s liability under this DPA is subject to the limitations and exclusions in the Terms of Use. This DPA is governed by the laws of Ireland.

Annex 1 — Details of the processing

  • Subject matter: providing the Tradroom music-education platform to the Controller.
  • Duration: for the term of the Controller’s account, plus the retention windows in the Terms of Use.
  • Nature and purpose: hosting, storage, organisation and retrieval of personal data so the Controller can manage classes and share notation and recordings with its students.
  • Categories of data subjects: the Controller’s students, their parents/guardians, and its tutors and administrators.
  • Types of personal data: names and contact details; hashed login credentials; where applicable a student’s date of birth, contact details, class enrolments, attendance and assigned resources; guardian contact details and recorded consent choices; Comhaltas membership details; and billing references. Uploaded teaching materials may incidentally contain personal data.
  • Special-category data: not intentionally collected. The processing routinely concerns children’s personal data, which is treated as sensitive.

Annex 2 — Authorised sub-processors

  • Vercel — application hosting; serverless functions run in Dublin, Ireland (EEA).
  • Amazon Web Services — file storage (S3, eu-west-1, Ireland; EEA).
  • Neon — PostgreSQL database hosting, London, United Kingdom (covered by the UK adequacy decision).
  • AhaSend — transactional email (invites, verification, resource notifications and account emails). EU-based (AhaSend is incorporated in the Netherlands): recipient email addresses and message content are processed and stored on European (EU/EEA) infrastructure and are not stored outside the EU/EEA. Processing is governed by AhaSend’s Data Processing Agreement (ahasend.com/dpa) and the list of sub-processors set out in its Annex; where any onward transfer outside the EEA occurs, the EU Standard Contractual Clauses (Commission Decision 2021/914) apply.
  • Stripe — subscription payment processing. Contracted through Stripe’s Irish entities, with personal data transferred to Stripe, LLC in the United States under Standard Contractual Clauses and the EU–US Data Privacy Framework.
  • Sentry provides application error monitoring, aggregating server and browser error reports so faults can be diagnosed and fixed. Error data is stored in Sentry’s European (EU) data region, and personal data in error reports is minimised before an event is sent: request bodies, cookies, authentication headers, URL query strings and direct identifiers (email, name and IP address) are stripped. Sentry is operated by Functional Software, Inc. (trading as Sentry); processing is governed by Sentry’s Data Processing Addendum and, where any processing or access occurs outside the EEA, the EU Standard Contractual Clauses (Commission Decision 2021/914) apply.
  • Matomo (self-hosted) — optional website analytics, loaded only where the visitor has consented. Matomo runs on infrastructure operated by Tradroom in Ireland (EEA); the analytics data stays within the EEA and is not shared with any third party. Page addresses are stripped of identifiers before being recorded, so no student or account data is processed.

This list, and each provider’s processing location, is maintained here. Where a provider processes data outside the EEA, the transfer mechanism noted above applies.

Contact

Questions about this DPA: privacy@tradroom.ie.