Privacy Policy – App Users
1.0 Scope
All data subjects whose personal data is collected, is done so in line with the requirements of the UKGDPR/Data Protection Act 2018.
2.0 Responsibilities
The Data and Safeguarding Manager is responsible for ensuring that this notice is made available to data subjects prior to the school/client organisation collecting/processing their personal data. All Employees/Staff of the school/client organisation who interact with data subjects are responsible for ensuring that this notice is drawn to the data subject’s attention and that they are aware of the lawful grounds for the processing of their data in relationship to the system.
3.0 Who are we?
InVentry has been the driving force in visitor management systems since 2010. What started out as the answer to an outdated paper-based system, has now become the market leading sign in and visitor management system in the UK.
There are now over 8,000 schools and businesses using InVentry. Every week we handle more than 9.9 million sign in and out events (that’s up to 85 every second) and capture over 255,000 visitor images.
More than 10 years on and we’re still pushing the technology we use and the industry as a whole. This constant drive to keep moving forward was recently captured by InVentry being named in the 21st Fastest Growing Technology Business in the North and being named in the Deloitte Fast 500.
We have now extended our sign in solution beyond education, serving customers in the private and public sectors as well as local government.
InVentry speeds up the sign in process, keeps identity information secure, and leaves schools feeling confident that their students and staff are safe.
Our Data Protection Officer and data protection representatives can be contacted directly here:
0113 322 9253
4.0 Data being processed
4.1 As the Data Controller, the personal data we would like to process on your behalf is:
| Personal data type: | Purpose | Lawful Grounds | ||
| Passport App | ||||
| Email address* | Account creation/Signing into App | Article 6(1a) Consent | ||
| First name* | Signing in | |||
| Surname* | Signing in | |||
| Company ** | Signing in | |||
| Car Registration ** | Signing in | |||
| Photograph ** | Signing in | |||
| Photograph** | Location of item audited | |||
| Location data** | Location of item audited | |||
4.2 As the Data Processor delivering the services listed below under contract, we process the following data
| Personal data type: | Purpose | Lawful Grounds | ||
| Anywhere App | ||||
| Email address* | Synchronisation of account | Article 6(1b) – Under contract | ||
| Location data** | Enable location-based sign-in | |||
| Audit & Compliance | ||||
| Email address* | Signing into system | Article 6(1b) – Under contract | ||
Above fields marked with * are required for system functionality, fields marked with a ** are optional.
4.2 The data listed above is processed for the following purposes:
- Creation of a Passport account
- To enable signing in to an organisations on-premise InVentry system through the use of the Passport App
- Synchronisation of the Anywhere App with the users account which has been created on the on-premise system.
- Facilitate the location-based sign-in feature for staff.
- Sign into Audit and Compliance
- Assist in identify and location of item audited.
4.3 Our legal basis for processing for the personal data:
- Article 6(1a) – the data subject has given consent to the processing of his or her personal data for one or more specific purposes.
- Article 6(1b) – processing is necessary for the performance of a contract to which the data subject is party
5.0 Consent
5.1 The data subject is consenting to this privacy notice through the affirmative action required in the app to create. As the data subject, you are giving InVentry Ltd permission to process the personal data supplied specifically for the purposes identified.
You may withdraw consent at any time by contacting the Data Protection Officer at InVentry using the contact details above.
6.0 Disclosure
6.1 InVentry Ltd will not process the information to any unauthorised third party unless the request is subject to legal obligation without obtaining the express written authority of the partner who provided the information with the following exceptions
| Data | Organisation | Purpose | Lawful grounds |
| Passport App Profile data | The InVentry system under the control of organisation into which the data subject is signing in | To facilitate the signing in of a visitor to an organisation when attending site and the transfer of the data is agreed via consent of the data subject. | Article 6(1a) – Consent |
| Car registration number | Driver and Vehicle Licensing Agency (DVLA) | Compare vehicle registration entered and provide these to the data subject to ensure they have entered correct details on the day. Data is only used for comparison and not retained by the DVLA and would normally exist within their system. | Article 6(1a) – Consent |
7.0 Retention period
7.1 InVentry will process your data for the following period:
- Until the application is deleted from your device
- Until consent is withdrawn
- After 12 months of account inactivity.
7.2 Data transferred to an organisation system during a sign in will be subject to the Data Retention and Protection policies of that organisation.
8.0 IP Addresses and Cookies
8.1 In the course of using our site, we automatically track certain information about users, including what browser you they are using and their IP address.
8.2 The cookies used on our website have been categorised based on information provided by the International Chamber of Commerce UK Cookie Guide.
8.3 For more information please read our cookies policy which can found at https://inventry.co.uk/cookie-policy/
9.0 As the Controller
9.1 All data hosted by InVentry Ltd is done so in compliance with the requirements laid in Data Protection Act 2018/GDPR.
9.2 InVentry will takes all possible steps to ensure the security of the data. However, it cannot be held responsible or liable for the any breach of data that is beyond its control. All requests for additional assistance will be subject to the agreement of the Directors.
9.3 Should InVentry choose to change a 3rd party service, we will complete appropriate impact assessments, alter our privacy statement where appropriate and notify you of this change. Where additional services are being provided, consent will be sought.
10.0 Your rights as a data subject
10.1 At any point while we are in possession of or processing your personal data, you, the data subject, have the following rights:
- Right of access – you have the right to request a copy of the information that we hold about you.
- Right of rectification – you have a right to correct data that we hold about you that is inaccurate or incomplete.
- Right to be forgotten – in certain circumstances you can ask for the data we hold about you to be erased from our records.
- Right to restriction of processing – where certain conditions apply to have a right to restrict the processing.
- Right of portability – you have the right to have the data we hold about you transferred to another organisation.
- Right to object – you have the right to object to certain types of processing such as direct marketing.
- Right to object to automated processing, including profiling – you also have the right to be subject to the legal effects of automated processing or profiling.
- Right to judicial review: in the event that InVentry Ltd refuses your request under rights of access, we will provide you with a reason as to why. You have the right to complain as outlined in clause 11 below.
All of the above requests will be dealt with in line InVentry Ltd’s Subject Access Procedure and will shared with the customer should a request come from directly a subject.
11.0 Complaints
11.1 In the event that you wish to make a complaint about how your personal data is being processed by InVentry Ltd or how your complaint has been handled, you have the right to lodge a complaint directly us, with the supervisory authority or the school/organisation’s data protection representatives.
The details for each of these contacts are:
| Supervisory authority contact details | Data and Safeguarding Manager contact details | |
| Contact Name: | Information Commissioners Office | InVentry Limited |
| Address line 1: | Wycliffe House | Visitor House |
| Address line 2: | Water Lane | Gelderd Road |
| Address line 3: | Wilmslow | Gildersome |
| Address line 4: | Cheshire | Leeds |
| Address line 5: | SK9 5A | LS27 7JN |
| Email: | registration@ico.org.uk | dpo@InVentry.co.uk |
| Telephone: | 0303 123 1113 | 0113 322 9253 |
12.0 Document Owner and Approval
The Data Protection Officer is the owner of this document and is responsible for ensuring that this record is reviewed in line with the review requirements of the UKGDPR.
Signature: David Tidman Date: 12/01/2021
Appendix 1 – InVentry Processing
The following InVentry data hosting and processing locations are utilised for the purposes described below:
| Service | System | Processing provider | Purpose/Justification | Location | Article 44 compliance (where required) |
| Signing in | Passport | Microsoft Azure | Providing processing for visitor signing in | UK | Legally binding contract |
| Evacuation/Sign-in for staff | Anywhere | IBM Cloudant | Providing evacuation and signing in | UK | Legally binding contract |
Please contact DPO@inventry.co.uk for more details.
Document dated: March 2021