Privacy notice
Last updated: not yet set
EASAL (Environment Audit for Speech and Language) is a tool for early years settings to assess how well their rooms and outdoor spaces support children's speech and language. This notice explains what personal information the EASAL website and tablet app hold, why, and what your rights are.
The short version
- EASAL audits are about rooms and environments, not people. An audit records no information about any child, parent or member of staff.
- The only personal information EASAL holds is what it needs to give you a login and keep the platform secure: your work email address and a record of your sign-ins.
- Your information is held in the United Kingdom.
- Nothing about your setting's results is used for training, marketing or research unless your setting has chosen to allow it, separately for each.
Who is responsible
Childbase Partnership is the data controller: it decides how EASAL is used and is responsible for your information. Contact: [email protected], not yet set.
IceBubble Ltd builds and hosts the platform on the controller's behalf, as a data processor. IceBubble only handles your information to run, secure and support EASAL. It does not use it for its own marketing, research or any other purpose.
What we hold about you
| Information | Why we hold it |
|---|---|
| Your work email address | It is your login. We send your sign-in codes to it. |
| Your name, if you add it to your profile | So the platform can show who is signed in. Optional. |
| The setting, group or local authority your login belongs to | To show you the right information and nothing else. |
| Your role (setting, group, local authority, research or administrator) | To control what you can see and do. |
| Sign-in records: when a code was requested and when you signed in | To keep accounts secure. |
| If you switch on an authenticator app: the key it shares with EASAL (encrypted) and your recovery codes (stored scrambled, so they cannot be read back) | So EASAL can check the extra sign-in step. Removed when you switch it off. |
| A log of requests made while signed in, including the address of your internet connection (IP address) | To protect the platform and to be able to show that information has only been accessed appropriately. |
| Your setting's consent choices, and when they were made | To respect them. |
| System emails sent to you | To deliver them and to deal with delivery problems. |
EASAL has no passwords. You sign in with a one-time code sent to your email, so there is no password for us to store or lose. We do not hold any special category information (such as health, ethnicity or religion), and we do not hold any information about children.
What an audit contains
An audit records, for a named room or outdoor area, which statement best describes it against each element of the EASAL tool, the resulting grades, and any action plan the setting writes. Action plans have free text boxes (what will be done, how, who and when). Please do not name children or families in them. A job title is enough for "who".
How we use it, and our lawful basis
We use your information to provide EASAL to your organisation: to sign you in, show you the right results, send service emails, keep the platform secure and deal with problems. Our lawful basis is not yet set.
Separately, a setting can choose whether its audit results may be used for three further purposes. Each is off until the setting turns it on, none is pre-selected, and each can be changed at any time on the Data sharing choices page:
- Quality and training: looking at patterns across settings to improve the audit and offer relevant training.
- Marketing: contacting the setting about relevant services in light of its results.
- Research: sharing anonymised or regionalised results with the partner university for academic research.
Saying no to any of these does not affect your use of EASAL.
Who can see what
- A setting sees its own audits and action plans. Only a setting sees an individual audit.
- A group sees summary results across its own settings.
- A local authority sees summary results for the settings it licenses, where that is part of the agreement with those settings.
- Researchers see anonymised results, and only from settings that opted in to research.
- Platform administrators manage the audit templates, licences and accounts, and provide support. They cannot see any audit results, scores or action plans.
Who we share it with
We do not sell your information. We use these companies to run the platform, under contract and only for that purpose:
| Company | What for |
|---|---|
| IceBubble Ltd | Builds, hosts and supports EASAL (United Kingdom) |
| Blue Sky Hosting Limited | Data centre and servers (United Kingdom) |
| Microsoft Azure | Encrypted off-site backups (United Kingdom regions) |
| Twilio SendGrid | Sending sign-in codes and system emails |
| Cloudflare | Protects the platform from attacks and speeds it up |
| Raygun | Error reports when something goes wrong in the website or app: technical details of the fault and of the device or browser, never your account details |
All platform data is stored in the United Kingdom. SendGrid, Cloudflare and Raygun run international services, so an email on its way to you, your web traffic, or an error report can pass through or be processed on servers outside the United Kingdom. We may also disclose information where the law requires it.
How long we keep it
| Information | Kept for |
|---|---|
| Your account | For as long as your organisation uses EASAL, then deleted or returned at its instruction |
| Sign-in codes | Deleted as soon as they are used or expire. The email containing a code is deleted once sent |
| Other system emails | 30 days after sending |
| Email delivery records | 90 days |
| The log of requests (including IP address) | 12 months |
| Technical error logs | 6 months |
| Audits and action plans | For as long as your organisation uses EASAL |
| Consent choices | Kept as a record for as long as the account exists |
| Backups | Overwritten after not yet set |
An audit that is started but not finished is removed, answers and all, after a set time (currently 12 hours), so unfinished work is never kept indefinitely.
The tablet app
The app keeps a copy of your setting's rooms, the audit templates, and any audits in progress on the tablet, so you can work without a connection. Audits are sent to the platform when the tablet is next online. Signing out removes your login from the tablet. The app does not use your location, camera, contacts or microphone, and contains no advertising or tracking.
Cookies
The website uses one essential cookie to keep you signed in, and one to protect forms from misuse. It uses no advertising or analytics cookies, so there is no cookie banner.
Keeping it safe
Connections are encrypted. There are no passwords to steal. Each organisation's information is separated from every other's. Administrative access is restricted and logged. Servers are kept patched behind firewalls, and backups are encrypted.
Your rights
You have the right to ask for a copy of your information, to have it corrected, to have it deleted, to restrict or object to how it is used, and to have it transferred. To use any of these, contact [email protected]. If your login was set up by your employer, group or local authority, they may be the quickest route for changes to your account.
If you are unhappy with how your information has been handled, you can complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113.
Changes to this notice
We will update this page if anything changes, and change the date at the top.