1. Who is responsible?
Firebound Interactive supplies and supports the RequesTech software. For this school deployment, The Portsmouth Grammar School determines the purposes of the school booking, equipment and team-administration records and is the data controller for those records. Firebound Interactive provides the software and may process information to operate and support it.
The written data processing agreement between The Portsmouth Grammar School and Firebound Interactive is still being finalised. The DPA status page explains the current position; it is a status notice, not a signed agreement.
For questions about use of school records or to exercise a data-protection right, contact the School Bursar at j.read@pgs.org.uk or the School's Data Protection Officer, GDPR Sentry Limited, at support@gdprsentry.com. For technical support relating to RequesTech, contact info@fireboundinteractive.uk or visit fireboundinteractive.uk.
Firebound Interactive's ICO registration number is ZC202413. ICO registration is not an endorsement of the service or a guarantee of compliance.
2. What information does RequesTech handle?
- Account and access information: Google sign-in email, display name, Firebase user identifier, role, invitations and access permissions.
- Booking and event information: event name, venue, date and times, organiser/requester name and email, answers to booking-form questions, notes, status and technician assignments.
- Equipment information: catalogue items, requested quantities, dates and intended use, approval decisions, lost-equipment reports and resolution status.
- Administration information: booking forms, team roles, department membership, department contact addresses and changes made by authorised users.
- Calendar information: where a calendar feed is created, its URL includes a private token used to control access to that feed.
- Security information: timestamps and rate-limit records. The application hashes the rate-limit identifier used for a Firestore document ID. Service providers may also process technical request information.
Some booking forms can be submitted without signing in. Information entered in those forms, including the email address supplied, is processed to receive and manage the request.
Booking forms can contain custom questions. Users should provide only information needed to organise the event and should not include sensitive personal information unless the School has specifically required it and approved the use.
3. Why is the information used?
- To receive, review and manage technical bookings and event details.
- To request, allocate, approve and track equipment, including reports of missing items.
- To manage authorised users, team roles, departments and invitations.
- To send booking, invitation, approval and equipment notifications.
- To check calendar conflicts and equipment availability, protect the service against excessive submissions, and troubleshoot service issues.
For routine booking and equipment administration, the lawful basis described here is the School's legitimate interests in efficient school operations, including organising events, managing equipment and coordinating authorised technical support, where those interests are not overridden by a person's rights and interests. The School's published privacy notice describes its use of legitimate interests for school operations. Where a particular record is processed for a different purpose or to meet a specific legal requirement, another lawful basis may apply.
4. Who receives the information?
Information is available to authorised users according to their assigned role and department permissions. Depending on the action, booking and equipment emails may go to the requester, relevant department recipients, technicians or lead technicians. Lost-equipment alerts use BCC for the recipient list.
RequesTech uses these services to operate:
- Google Firebase Authentication for sign-in.
- Google Cloud Firestore for application records, accessed by the server-side Worker.
- Cloudflare Pages and Workers for the website and API, and the configured Cloudflare Email Service binding for system emails.
- Google Fonts and Google-hosted JavaScript modules loaded by the browser.
- Image hosts selected by catalogue administrators when an equipment image is loaded from an external HTTPS URL.
Google and Cloudflare may process service or technical information outside the UK, depending on the service and configuration. The controller is responsible for checking the deployed project locations and applicable transfer arrangements. Relevant provider information is available in the Firebase Data Processing Terms, the Google Cloud Data Processing Addendum and the Cloudflare Data Processing Addendum.
5. How long is information kept?
RequesTech does not apply one automatic expiry period to all booking, equipment, user-profile and history records. Invitations may be removed after an invited person signs in, but booking and equipment histories can remain in the database until removed through authorised administration or an applicable retention process.
The School is responsible for applying its records-retention policy to RequesTech information and for arranging deletion when records are no longer needed. Information may be kept for as long as necessary for school operations and where required for legal, safeguarding, audit or dispute-related reasons. The School's published Storage and Retention of Records and Documents Policy describes its general approach; contact the School using the details above for a category-specific retention period.
6. Security
The current application uses verified Google sign-in for signed-in access. Browser requests to application data are routed through the server-side Worker, and the supplied Firestore rules deny direct browser database access. The Worker checks roles and permissions and uses server-side service-account credentials that are not included in the public website.
These controls reduce risk but do not eliminate it. Security also depends on the live Cloudflare and Firebase configuration, credential protection, assigned permissions and ongoing maintenance. Keep your account secure, sign out on shared devices and do not share private calendar feed URLs.
7. Your rights
Depending on the lawful basis and circumstances, you may have the right to request access to personal information, correction, erasure or restriction, to object to certain processing, or to receive a copy of information in a portable format. These rights are subject to legal conditions and exceptions. Where processing is based on consent, consent may be withdrawn.
For requests about school records, contact the School Bursar or Data Protection Officer listed in section 1. You can also raise a concern with the Information Commissioner's Office.
8. Changes to this notice
This notice may be updated when the service or its data handling changes. The controller should review it after a change to the purposes, data collected, providers, lawful bases, retention arrangements or international transfers.