1.0 Scope

All data subjects whose personal data is collected, is done so in line with the requirements of the UKGDPR/Data Protection Act 2018.

2.0 Responsibilities

The Data and Safeguarding Manager is responsible for ensuring that this notice is made available to data subjects prior to the school/client organisation collecting/processing their personal data. All Employees/Staff of the school/client organisation who interact with data subjects are responsible for ensuring that this notice is drawn to the data subject’s attention and that they are aware of the lawful grounds for the processing of their data in relationship to the system.

3.0 Who are we?

InVentry has been the driving force in visitor management systems since 2010. What started out as the answer to an outdated paper-based system, has now become the market leading sign in and visitor management system in the UK.

There are now over 8,000 schools and businesses using InVentry. Every week we handle more than 9.9 million sign in and out events (that’s up to 85 every second) and capture over 255,000 visitor images.

More than 10 years on and we’re still pushing the technology we use and the industry as a whole. This constant drive to keep moving forward was recently captured by InVentry being named in the 21^st Fastest Growing Technology Business in the North and being named in the Deloitte Fast 500.

We have now extended our sign in solution beyond education, serving customers in the private and public sectors as well as local government.

InVentry speeds up the sign in process, keeps identity information secure, and leaves schools feeling confident that their students and staff are safe.

Our Data Protection Officer and data protection representatives can be contacted directly here:

dpo@InVentry.co.uk

0113 322 9253

4.0 Data being processed

4.1  As the Data Controller, the personal data we would like to process on your behalf is:

Above fields marked with * are required for system functionality, fields marked with a ** are optional.

4.2         The data listed above is processed for the following purposes:

• Creation of a Passport account
• To enable signing in to an organisations on-premise InVentry system through the use of the Passport App
• Synchronisation of the Anywhere App with the users account which has been created on the on-premise system.
• Facilitate the location-based sign-in feature for staff.
• Sign into Audit and Compliance
• Assist in identify and location of item audited.

4.3         Our legal basis for processing for the personal data:

• Article 6(1a) – the data subject has given consent to the processing of his or her personal data for one or more specific purposes.
• Article 6(1b) – processing is necessary for the performance of a contract to which the data subject is party

5.0 Consent

5.1 The data subject is consenting to this privacy notice through the affirmative action required in the app to create. As the data subject, you are giving InVentry Ltd permission to process the personal data supplied specifically for the purposes identified.

You may withdraw consent at any time by contacting the Data Protection Officer at InVentry using the contact details above.

6.0 Disclosure

6.1 InVentry Ltd will not process the information to any unauthorised third party unless the request is subject to legal obligation without obtaining the express written authority of the partner who provided the information with the following exceptions

Data	Organisation	Purpose	Lawful grounds
Passport App Profile data	The InVentry system under the control of organisation into which the data subject is signing in	To facilitate the signing in of a visitor to an organisation when attending site and the transfer of the data is agreed via consent of the data subject.	Article 6(1a) – Consent
Car registration number	Driver and Vehicle Licensing Agency (DVLA)	Compare vehicle registration entered and provide these to the data subject to ensure they have entered correct details on the day. Data is only used for comparison and not retained by the DVLA and would normally exist within their system.	Article 6(1a) – Consent

7.0 Retention period

7.1  InVentry will process your data for the following period:

• Until the application is deleted from your device
• Until consent is withdrawn
• After 12 months of account inactivity.

7.2 Data transferred to an organisation system during a sign in will be subject to the Data Retention and Protection policies of that organisation.

8.0 IP Addresses and Cookies

8.1 In the course of using our site, we automatically track certain information about users, including what browser you they are using and their IP address.

8.2  The cookies used on our website have been categorised based on information provided by the International Chamber of Commerce UK Cookie Guide.

8.3 For more information please read our cookies policy which can found at  https://inventry.co.uk/cookie-policy/

9.0 As the Controller

9.1 All data hosted by InVentry Ltd is done so in compliance with the requirements laid in Data Protection Act 2018/GDPR.

9.2 InVentry will takes all possible steps to ensure the security of the data. However, it cannot be held responsible or liable for the any breach of data that is beyond its control. All requests for additional assistance will be subject to the agreement of the Directors.

9.3 Should InVentry choose to change a 3rd party service, we will complete appropriate impact assessments, alter our privacy statement where appropriate and notify you of this change.  Where additional services are being provided, consent will be sought.

10.0 Your rights as a data subject

10.1 At any point while we are in possession of or processing your personal data, you, the data subject, have the following rights:

• Right of access – you have the right to request a copy of the information that we hold about you.
• Right of rectification – you have a right to correct data that we hold about you that is inaccurate or incomplete.
• Right to be forgotten – in certain circumstances you can ask for the data we hold about you to be erased from our records.
• Right to restriction of processing – where certain conditions apply to have a right to restrict the processing.
• Right of portability – you have the right to have the data we hold about you transferred to another organisation.
• Right to object – you have the right to object to certain types of processing such as direct marketing.
• Right to object to automated processing, including profiling – you also have the right to be subject to the legal effects of automated processing or profiling.
• Right to judicial review: in the event that InVentry Ltd refuses your request under rights of access, we will provide you with a reason as to why. You have the right to complain as outlined in clause 11 below.

All of the above requests will be dealt with in line InVentry Ltd’s Subject Access Procedure and will shared with the customer should a request come from directly a subject.

11.0 Complaints

11.1 In the event that you wish to make a complaint about how your personal data is being processed by InVentry Ltd or how your complaint has been handled, you have the right to lodge a complaint directly us, with the supervisory authority or the school/organisation’s data protection representatives.

The details for each of these contacts are:

	Supervisory authority contact details	Data and Safeguarding Manager contact details
Contact Name:	Information Commissioners Office	InVentry Limited
Address line 1:	Wycliffe House	Visitor House
Address line 2:	Water Lane	Gelderd Road
Address line 3:	Wilmslow	Gildersome
Address line 4:	Cheshire	Leeds
Address line 5:	SK9 5A	LS27 7JN
Email:	registration@ico.org.uk	dpo@InVentry.co.uk
Telephone:	0303 123 1113	0113 322 9253

12.0 Document Owner and Approval

The Data Protection Officer is the owner of this document and is responsible for ensuring that this record is reviewed in line with the review requirements of the UKGDPR.

Signature: David Tidman                                          Date: 12/01/2021

Appendix 1 – InVentry Processing

The following InVentry data hosting and processing locations are utilised for the purposes described below:

Service	System	Processing provider	Purpose/Justification	Location	Article 44 compliance (where required)
Signing in	Passport	Microsoft Azure	Providing processing for visitor signing in	UK	Legally binding contract
Evacuation/Sign-in for staff	Anywhere	IBM Cloudant	Providing evacuation and signing in	UK	Legally binding contract

Please contact DPO@inventry.co.uk for more details.

Document dated: March 2021