1. About Us and Identity of the Data Controller
This Privacy Policy applies to the School Shield web application hosted at https://trifecta-management.co.uk/SaaS/School-Shield/, provided and operated by Trifecta Management (a trading name of J Smithson Consultancy Services) ("we", "us", "our").
Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Trifecta Management acts as the Data Controller solely for the technical connection data generated when loading our web infrastructure. Subscriber schools and users act as the Data Controllers for any data entered into local browser tools.
2. Information We Process & Legal Bases
Because the application operates entirely client-side, processing is split into two areas:
| Data Type | Where Stored | UK GDPR Lawful Basis |
|---|---|---|
| Server Access Logs (IP address, user-agent, timestamp, page requests) |
Server memory/logs (UK Hosting Infrastructure) | Legitimate Interests (Art. 6(1)(f)): Essential for cyber-security, preventing DDoS attacks and ensuring server stability. |
| Client-Side Workspace Data (Active package tiers, tab states, tool inputs, session variables) |
Client-Side Browser Storage (`localStorage` / `sessionStorage`) | Performance of Contract (Art. 6(1)(b)): Necessary to render the requested software tools and maintain user workspace context. |
3. Privacy & Electronic Communications Regulations (PECR)
In accordance with PECR and ICO rules regarding storage and access technologies (cookies, web storage):
- No Advertising or Tracking Cookies: School Shield does not use third-party analytics, marketing trackers or profiling scripts.
- Strictly Necessary Local Storage: Web storage keys (`localStorage`/`sessionStorage`) are used exclusively to remember your interface preferences, active tab sessions and tool calculations. These are categorised as strictly necessary under PECR Regulation 6(4)(b) to deliver the service explicitly requested.
4. Data Retention & Erasure
- Server Technical Logs: Web server access logs containing IP addresses are automatically overwritten or purged after a maximum period of 30 days.
- Local Application State: All tool inputs, dynamic package settings and cached session states remain under your direct physical control within your web browser. You can clear or permanently erase this data at any time by clearing your browser's site data/cookies or clearing `localStorage`.
5. Third-Party Sharing and International Transfers
We do not sell, share, trade or transfer any client data. Because operational data is never transmitted to our servers, no international data transfers occur under Chapter V of the UK GDPR.
6. Your Statutory Rights under UK GDPR
Under the UK GDPR, you possess rights concerning personal data held about you:
- Right of Access (SAR): Right to request access to server-held personal data (e.g., technical logs linked to your static IP address).
- Right to Rectification & Erasure: Right to request correction or erasure of server-side logs.
- Right to Object: Right to object to server log processing based on legitimate interests.
Note on Client-Side Data: Because operational records entered into School Shield tools never reach our servers, we cannot view, modify or export client-side browser data on your behalf. You can manage or clear this directly within your browser settings.
7. Contact DPO & ICO Complaints
If you have questions about this policy or wish to exercise your rights, please contact:
Trifecta Management
Email: support@trifecta-management.co.uk
Website: trifecta-management.co.uk
If you believe your data has been handled unlawfully, you have the right to lodge a complaint with the UK supervisory authority:
Information Commissioner’s Office (ICO) — ico.org.uk | Helpline: 0303 123 1113.