Data protection
How we handle personal data
ENTRACCESS UK LTD builds attendance systems for schools. That means we hold records about children. This page says what we hold, why, who can see it, and how long it stays.
Registered with the ICO
- ICO registration number
- [ICO REGISTRATION NUMBER]
- Registered entity
- ENTRACCESS UK LTD, registered in England and Wales ([COMPANY NUMBER])
- Status
- Data processor for settings; data controller for our own records
- Under
- UK GDPR and the Data Protection Act 2018
Who is responsible for what
The distinction matters, because it decides who a parent should approach.
- Your school is the data controller for its children' records. It decides which children are enrolled, what is recorded about them, and who at the school may see it.
- ENTRACCESS is the data processor acting on that school's instructions. We store and process the records so the system works; we do not decide what a school collects, and we do not use a school's records for our own purposes.
A parent asking about their own child should ask the school first. The school can reach us from the Support button in their console.
What we hold
| About | What is held | Why |
|---|---|---|
| Children | Name, room, child number, gender, contact details, and a signed identifier behind their QR pass | To recognise a child at the gate and record their attendance |
| Attendance | Arrival and departure times, which station, and how it was recorded | The record itself, and the answer to whether a child is on site |
| Guardians | Name, relationship, email address, phone number | To tell a family their child has arrived, and to let one of them use Entrusta's Parents |
| Collection | People a parent has authorised to collect a child, with a phone number, and a hashed PIN | So a school can refuse to release a child to somebody who is not on the list |
| Staff | Name, work email, role, room, and their own attendance | To sign in, to be attributed correctly, and to answer whether an adult was on site |
| Activity | Every scan and every change, with who made it and when | So a disputed record can be checked afterwards |
What we deliberately do not do
- We do not sell data, and we do not advertise. There is no third party buying anything here.
- A QR pass contains no personal detail. No name, no room, no date of birth — only a signed identifier that means nothing outside your school.
- We do not read a school's roster by default. Our support team works from configuration and delivery logs, which contain no child.
- We do not track visitors to this website across the internet. Our analytics set no cookie and store no identifier for a visitor, which is why this site has no cookie banner to click away.
- We do not use school data to train anything.
Who can see a school's records
- Staff at that school, according to the level their administrator gave them. A form room leader sees one room and nothing else, enforced in the database rather than by hiding buttons.
- A guardian, for their own children only, through Entrusta's Parents.
- ENTRACCESS staff only under an access grant the school can see. An operator must request it, state a reason in words the school will read, and the window closes on its own. The school sees every grant, what was looked at under it, and can end it early from their own settings.
- Nobody else. One school can never see another's records.
Where it is kept, and for how long
Records are held in the UK or the European Economic Area, encrypted in transit and at rest, on managed infrastructure with access limited to the people who operate the service.
A school decides how long to keep its own records, and can export everything it holds at any time, in one file, without asking us. When a school leaves, its data is erased on request. A child who has left is archived rather than deleted, so the register of a past year stays true — and a family exercising a right to erasure gets exactly that.
If you apply to work with us
An application from our careers page — your answers and your CV — is held by ENTRACCESS UK LTD for one purpose: deciding whether to take your application forward, and contacting you about it. It is seen only by the people at ENTRACCESS handling recruitment, and it is emailed to our recruitment mailbox when you apply.
We keep an application for up to 12 months after you apply, and then delete it with its CV. You can ask us to delete it sooner, or to see or correct what we hold, by emailing support@entraccess.co.uk with your application ID.
Your rights
Under UK GDPR and the Data Protection Act 2018 you may ask what is held about you, ask for a correction, ask for erasure, object to processing, or complain to the Information Commissioner’s Office (ICO).
- Parents and children: ask your school. They hold the record and can act on it immediately.
- If the school needs us, or your request is about ENTRACCESS itself: support@entraccess.co.uk.
- If we have not resolved it, you may complain to the Information Commissioner’s Office at ico.org.uk.
If something goes wrong
We tell affected schools without delay: what happened, what was involved, what we have done, and what they should do. We report to the ICO within 72 hours where UK GDPR requires it. We will not wait until we understand everything before telling you.
Getting in touch
Email support@entraccess.co.uk. Schools can also use the Support button in their console, which keeps everything in one thread.
Last reviewed 4 October 2026.