Privacy Policy

This policy explains how Limbrick Consultancy LLP ("we", "us", "our") handles personal data in Sprocket Tools, the shared platform behind the websites, portals and online services we build for our customers. We do not sell, rent or trade personal data.

1. Who is responsible for your data

Our customers are usually the controller. Most personal data in Sprocket Tools belongs to a website or service run by one of our customers, such as a school, trust, local authority or membership organisation (a "Customer Service"). For that data, the customer is the data controller and decides what is collected and why. We act as their data processor, handling it only on their instructions and under a written agreement. The customer's own privacy notice explains how they use it, and requests about that data should go to them first. We will help them respond.

We are the controller for a small amount of platform data. This includes the sign-in, security and usage records we need to run and protect Sprocket Tools, and the details of anyone who contacts us directly. This policy mainly covers that data.

2. What we collect

Account and sign-in details. We store your name, email address and the details needed to sign you in. If you sign in with Microsoft or Google, that provider confirms who you are and sends us your name, email address and a unique account and organisation identifier. We never see your Microsoft or Google password.

Usage and security logs. When you are signed in, we record which pages you visit and when, linked to your account. We also record IP addresses in some situations, such as when invitations are sent or forms are submitted. We use these logs to provide the service, show activity to the organisation running the Customer Service, investigate problems and keep the platform secure.

Information you or the customer add. Anything entered into a Customer Service, such as forms, messages, documents and records, is held for the customer as described in section 1.

Contact and support requests. If you contact us or use a help or contact form, we keep what you send us so we can respond.

3. Cookies

Essential cookies. We use a session cookie to keep you signed in while you use a site. These are needed for the site to work.
"Remember me" cookies. If you choose to stay signed in on a device, we set two cookies containing random values that we match to a record on our servers. They do not contain your name, email address or any other directly identifying information, and they are removed when you sign out.
Spam protection. Some contact and help forms use Google reCAPTCHA. On those pages only, Google collects technical information such as your IP address, browser and device details and how you interact with the page, and may set its own cookie. This is used to tell people from automated spam. The content of your form is not sent to Google. Google's privacy policy applies to this.
Analytics cookies. Some Customer Services use Google Analytics to understand how their site is used. Where this is turned on, analytics only runs if you accept it in the cookie banner, and IP addresses are anonymised. You can decline, and the site will work in exactly the same way.

4. Why we use it (our lawful basis)

To provide the service a customer has asked us to provide, under our contract with them, and to follow their instructions as processor.
To keep the platform secure, prevent misuse and fix problems. This is in our legitimate interests and those of our customers.
To meet our legal obligations.
With your consent, for analytics cookies.

5. Who we share data with

We use a small number of trusted suppliers to run Sprocket Tools itself. They only act on our instructions:

Microsoft and Google, to sign you in when you choose those options;
Google reCAPTCHA, to protect some forms from spam and automated abuse;
Google Analytics, only where a Customer Service uses it and you have consented;
Email delivery services, to send messages generated by the platform; and
Our hosting and infrastructure providers.

Our customers can also choose to use optional features, or connect their Customer Service to other systems they use. Data shared in this way is covered by our agreement with that customer and by the customer's own privacy notice.

Some of our suppliers may process data outside the UK. Where they do, we rely on appropriate safeguards such as UK adequacy regulations or the International Data Transfer Agreement or Addendum.

We will also share data where the law requires it, or with the organisation running the Customer Service you use.

6. How long we keep it

We keep data in a Customer Service for as long as the customer instructs us, and we delete or return it when our agreement with them ends. We keep platform logs and support records only as long as they are needed for the purposes above, after which they are deleted or anonymised.

7. Keeping data secure

We use appropriate technical and organisational measures to protect personal data. These include encrypted connections and access controls.

8. Your rights

You have the right to ask for a copy of your personal data, and to ask for it to be corrected, deleted or restricted. You can also object to how it is used. For data in a Customer Service, please contact the organisation that runs it. For anything else, or if you are not sure who to ask, email dpo@limbrickconsultancy.com.

If you are unhappy with how your data has been handled, you can complain to the Information Commissioner's Office at ico.org.uk.

9. Changes to this policy

We review this policy at least once a year and whenever our practices or the law change. This policy was last updated in October 2026.

10. Contact us

Limbrick Consultancy LLP, 14 Connaught Avenue, Kidderminster, Worcestershire DY11 6LS
Email: dpo@limbrickconsultancy.com