Privacy notice

Who provides the service?

RAP Dashboard is provided by Primary ICT Support Ltd, registered in England and Wales, company number 05682565. Our registered office is Nelson House, George Mann Road, Leeds, England, LS10 1DJ. For privacy questions or requests, contact support@primaryictsupport.co.uk or call 0113 426 4264.

When your school, trust or other organisation provides the dashboard, it generally decides why its users' information is processed and Primary ICT Support Ltd generally processes that information on its instructions. Primary ICT Support Ltd may also act as a controller for its own business purposes, such as responding to an enquiry. The roles depend on the activity and applicable agreements. Contact us if you need help identifying who to ask about your information.

Information we use

Depending on your organisation's settings and the features you use, information may include:

• Your name, email address, sign-in identity, organisation, account status, permissions and session information.
• Dashboard content and settings, such as links, labels, appearance, personal notes, tasks and photos you or your organisation add.
• The provider, account identifier, permissions, connection status and authorisation information needed to connect a Google or Microsoft account.
• Calendar details made available by your connected provider, including calendar names, event titles, times, locations and links needed to display events. If you choose and grant permission to create an event, RAP also sends the event details you enter to your provider.
• Information you give us when requesting support, and records used to operate, secure and troubleshoot the service.

We receive information from you, your organisation, its administrators and, where you connect a service, the relevant provider. The legal bases for each activity, including any legitimate interests, are being reviewed with our privacy information.

How we use connected Google and Microsoft accounts

If your organisation permits it, you can choose to connect an eligible Google or Microsoft account. The provider presents the permissions requested. RAP uses the information made available by the account to provide the connected features you request, such as displaying your calendar or creating an event. Your organisation may need to approve a connection. Your provider also handles information under its own terms and privacy notice.

Connected email is in development and is not currently available for general use. The planned feature is intended to let you view messages and attachments, choose an account and send email through that account's provider. The information involved may include senders, recipients, subjects, message text, dates, status and attachments. We will update this notice with the actual storage, sharing and deletion arrangements before enabling this feature for users.

Google's API Services User Data Policy, including its Limited Use requirements, applies to our use of Google API data. Our review of the completed email feature against those requirements is ongoing.

Disconnecting an account

To disconnect a connected account in RAP, open Connections, find the account under Your connected accounts, choose Disconnect and confirm. You can also review and remove access in Google or Microsoft. For a Microsoft work or school account, an administrator may need to manage permissions granted for your organisation.

Disconnecting in RAP and removing permission with the provider are separate actions. They may affect other features using the same connection, including Calendar. Disconnecting does not delete messages or events held by your provider, or recall files already downloaded. To request deletion of information held by RAP, contact support@primaryictsupport.co.uk.

Who receives information?

Information is shared with Google or Microsoft when needed for a connection or feature you request. Service providers used to operate RAP include Vercel for hosting, Supabase for database and storage services, and Amazon Web Services for service emails. Your organisation's authorised administrators can manage access and configuration according to their permissions.

The current RAP application deployment and its primary database are configured in the London region. This does not establish where every provider or support service processes information. We are completing a review of the full supplier list, support access, secondary uses and any processing outside the UK. Where information is transferred internationally, we are reviewing the applicable safeguards and will add the confirmed details to this notice.

Retention and deletion

We retain information for the period needed for the service and its security, legal and contractual purposes. Periods differ by type of information. RAP's recorded user-removal process includes a 14-day recovery period for a removed user's profile and personal dashboard before permanent removal. Removing a provider connection removes the connection record from RAP; providers and backups have separate retention arrangements.

We are confirming the applicable periods and deletion procedures for backups, operational and security records and any future email drafts, content or send records. If you need information about a particular record or wish to request deletion, please contact us. Removing information from RAP does not automatically delete it from Google or Microsoft.

Security, cookies and local storage

RAP is designed to restrict access to authorised users and protect connected-account credentials. Sign-in and session technologies help maintain access to the service. Personal dashboard editing can use storage on your browser or device for an unsaved draft. We are completing our review of production security measures, cookies and other storage technologies.

If you believe an account or connected service has been compromised, contact us and your organisation's administrator where appropriate.

Your rights

Depending on the circumstances and applicable law, you may have rights to request access to, correction or deletion of personal information, to restrict or object to processing, or to receive or transfer information you have provided. If processing relies on consent, you may withdraw it. Contact support@primaryictsupport.co.uk to make a request. Where your organisation is responsible, we may need to refer the request to it or work with it to respond.

You can also complain to the UK's Information Commissioner's Office at ico.org.uk/make-a-complaint.

Changes to this notice

We will update this notice as the service and our review develop. The date above shows when this version was last updated. We will review how to notify users of material changes before releasing connected email.