Privacy policy

1. Who we are

Sinc Energy provides a heating control service for schools: smart radiator valves, and software that heats each room when it's about to be used.

In this policy "Sinc Energy", "we" and "us" mean Sinc Energy Ltd, a company registered in England and Wales (company number 17062974), with its registered office at 98 Cloutsham Street, Northampton, England, NN1 3LN.

For anything about privacy, email privacy@sinc.energy.

2. What this policy covers

This policy explains how we handle personal data when a school uses Sinc Energy, through:

• the school sign-in and teacher page (sinc.energy/sign-in), where staff report room temperatures and faults and ask for rooms to be heated;
• the school console, where a school's admins run their heating, rooms and staff list;
• the Sinc Energy apps for Android, iPhone and iPad, which show the same sign-in, teacher page and school console;
• the emails we send, such as sign-in codes, invitations, updates on heating requests and the poster when you ask for it;
• our dealings with the people who set up and manage the service at each school;
• our teacher page demo at sinc.energy/sandbox2, which runs in your browser: nothing you do there is sent to us.

It also covers the enquiries you send us, for example to hello@sinc.energy, and the technical logs kept when you visit our website, sinc.energy (section 4). Our website sets no cookies and uses no analytics.

3. Your school and us

Your school decides to use Sinc Energy and which of its staff can use it. For its staff's personal data, your school is the controller and we are its processor. We only use that data to provide the service to your school, following its instructions and our agreement with it. Your school's own privacy notice for staff also applies.

We are the controller for a small amount of data we use for our own purposes:

• the contact details of the people we work with at schools, and of anyone who sends us an enquiry;
• the records we keep to protect the service from misuse, such as limits on repeated sign-in attempts and our server logs;
• our sign-in security records: the record of sign-ins and account events, signed-in sessions and the Microsoft or Google account identifiers linked to your address (section 10). We keep these to secure the service and look into problems, including after your school stops using Sinc Energy, until their periods end, and we never use them to monitor anyone's attendance, hours or whereabouts.

4. The personal data we handle

From your school's staff list

• Your title, initials, first name, surname and work email address, and a role if your school adds one.
• Your timetable: which rooms you teach in and when, with the class's name, subject and year group.

Most schools send this from their management information system (MIS) through Wonde, a service your school authorises, and we update it every night. A school's admins can also add people themselves. We only keep the details listed here: no job titles, contracts, phone numbers, home addresses or other HR records.

When you sign in

• The email address you sign in with.
• The sign-in codes we email you. We only store a scrambled version of each code (a hash), and a code works once, for 10 minutes.
• If you choose Sign in with Microsoft or Sign in with Google, their confirmation of your email address (section 6).
• For school console users, when you first and last signed in.

What you send us

• Temperature feedback (too hot, just right or too cold) and fault reports: the room, any note you add, and the heating readings at that moment.
• Requests to heat a room: the room, date, times, reason and any note, then the outcome: approved or declined, by whom, when, and any note from the person who decided.
• Requests for access: your name, school email, the school you name and any message.
• The last room you picked, so the page opens on it next time.
• The picture you choose to show next to your name: one of Microsoft's emoji faces, or your initials.
• Whether the temperature question opens by itself when you sign in.

Please don't put anything sensitive in a note, such as health information.

If you use the school console

• Your name, email address and role (for example Operations Manager).
• The changes you make to the heating, which your school's other console users see as recent changes, with your name.
• Anything you add, such as photos of rooms or equipment, room tags, or a timetable typed in by hand. Please avoid photos that show people.

People we work with at schools

The names, email addresses, phone numbers, roles and notes for each school's contacts for the service.

If you contact us

When you email us, for example at hello@sinc.energy to ask about the service, we keep your name, email address and what you write, to reply and follow up. We keep it for 2 years after your last message, unless you become one of the school contacts above.

Technical data

• Your IP address. We use it to limit repeated attempts, and store it with each sign-in code, report, request and access request for 30 days.
• Server logs. These record each request to our server, with the address requested and your IP address (but not what you type into forms), and some events with the email address involved, such as a Microsoft or Google sign-in or an email that couldn't be sent. The edge network our pages reach you through (section 9) keeps its own access log of each request: the address requested, the time, your IP address and browser details.

Heating data

Room temperatures and humidity, valve settings and battery levels, and heating schedules. These are about rooms, not people. Combined with a timetable, though, they can show when a room was in use.

What we don't collect

• Pupils' personal data. For the timetable we receive class names and year groups, not who is in each class.
• Anything through analytics, advertising or tracking tools: we don't use any.

5. How we use it

• To sign you in, and check you're on your school's staff list.
• To heat rooms before they're used, from your school's timetable and approved requests.
• To show your school's console users your reports, requests and access requests so they can act on them, and to email the people your school has chosen to approve requests.
• To show other staff at your school a room's timetable, with the teacher's name (for example "Ms J. Smith") and the picture they chose, so they can see when it's in use.
• To email you sign-in codes, invitations to the school console, updates on your requests, the poster when you ask for it, and notices about how your account is signed in to (a new browser, or a Microsoft or Google account linked, refused or removed).
• To check the heating is working and help your school: our support team gets a copy of each heating request, fault report and "too hot" or "too cold" report, with the sender's name and email address, and any access request we can't match to a school. Your school's main contact can also get the reports, if your school asks.
• To keep the service secure: limiting repeated attempts, and investigating problems and misuse.
• To support your school.

We don't sell personal data or use it for advertising. We don't make decisions about you by automated means that have legal or similarly significant effects. Heating requests can be approved automatically, within limits your school sets. That only affects when a room is heated.

6. Signing in with Microsoft or Google

If you choose Sign in with Microsoft or Sign in with Google, Microsoft or Google confirm your email address to us. We use it only to find you on your school's staff list and sign you in.

• From Google we ask only for your email address (openid and email). From Microsoft we ask for openid, profile and email. Microsoft also sends your name, which we don't use or keep.
• From your Microsoft or Google account we keep only its identifiers (its organisation and account IDs), with your email address, so another account using your address can't sign in as you. We email you when an account is first linked to your address, when the link moves to a new address, when another account is refused, and when we remove the link. We record each sign-in (the email address and time) in our server logs to keep the service secure.
• We never see your password, and we can't read your email, files, contacts or calendar.
• We don't use this information for advertising, and we don't sell it or share it.

Sinc Energy's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

7. Our legal basis

For the data we handle for your school, your school decides the legal basis, and its privacy notice for staff explains it. Schools usually rely on performing a public task, or on their legitimate interests, to run their buildings.

For the data we control, we rely on our legitimate interests: running, securing and supporting our service, and working with the schools that use it.

8. Who sees it and who handles it for us

At your school

• Your school's console users (for example its Operations Manager) see reports, requests and access requests, and decide requests.
• The people who approve requests at your school (its Operations Managers and main contact, or an approver your school names) get an email for each one, with the teacher's name, email address, room, times and note. They can approve or decline it from the email.
• Other staff see room timetables, with teachers' names and the pictures they chose.

At Sinc Energy

A small number of Sinc Energy staff can see every school's data, to set up, support and monitor the service. They sign in with their Sinc Energy Microsoft 365 accounts. Our support team also gets the copies of requests and reports described in section 5.

Our service providers

Wonde, which sends us your school's staff list and timetable from its MIS, works for your school, not for us: your school authorises it to share that data with us.

We don't share personal data with anyone else unless the law requires it.

9. Where it's stored

We store data on Amazon Web Services in Ireland, in its eu-west-1 region, which is in the European Economic Area. UK law recognises the EEA as protecting personal data adequately. A backup of the database is taken every day and kept for 35 days in Ireland, with a copy in London (AWS's eu-west-2 region), in the UK.

Our pages reach you through Amazon CloudFront, AWS's edge network: the location nearest you, in Europe or North America, carries the encrypted connection to your browser and keeps copies of our public files (pictures, fonts and scripts, which hold no personal data). It records each request in an access log, kept in Ireland (section 10). Its firewall (AWS WAF), which screens requests for attacks, also logs them: the address requested, the time, your IP address and browser details, never your cookies. AWS keeps that log in its US East region, the only place a CloudFront firewall can write to, under the protections described below.

Our email (Microsoft 365) is stored in the UK.

Some of our providers are based in the US or elsewhere, and may process data there. When they do, we rely on the protections UK law requires, such as the UK International Data Transfer Addendum or the UK-US data bridge.

10. How long we keep it

Our server deletes what has passed these periods automatically, every night, and our hosting deletes logs, backups and archived readings as they reach theirs.

When a school stops using Sinc Energy, we delete its data within 90 days, unless the school asks us to return it first. Our own security records expire at the times above.

11. How we keep it secure

• Every connection to the service is encrypted (HTTPS).
• You don't have a password with us. You sign in with an emailed code or your school's Microsoft or Google account. Codes work once, for 10 minutes, are stored only in scrambled form, and repeated attempts are limited.
• Signed-in sessions are kept on our server, where they end when you sign out, after a while unused, or at their time limit. Their cookies hold only a random key, which the page's scripts can't read and which is only sent over encrypted connections.
• Your school's data is shown only to the people your school sets up, according to their role, and to the Sinc Energy staff who run the service.

12. Cookies and browser storage

We only use cookies that are needed to sign you in and keep you signed in, so they don't need your consent. We don't use analytics or advertising cookies.

Until you close the tab, the teacher page also remembers the email address you typed (sinc_staff_email) and which of its tabs you had open (sinc_staff_tab), in your browser's session storage.

The Sinc Energy apps for Android, iPhone and iPad show these same pages, so they keep the same cookies and session storage, inside the app on your phone rather than in its browser. The apps add nothing of their own: no analytics, advertising or crash reporting. On Android the app is left out of your phone's backups and transfers.

Our teacher page demo at sinc.energy/sandbox2 keeps nothing in your browser.

Our pages load their fonts, icons and scripts from our own address, not from a third-party content network, so no one but our hosting provider (section 8) sees your browser load them.

13. Your rights

You have the right to:

• get a copy of your personal data;
• have it corrected if it's wrong;
• have it deleted;
• restrict or object to how it's used;
• in some cases, receive it in a format you can reuse.

Your school is the controller for most of your data here, so the quickest route is usually to ask your school, for example its data protection officer. Your staff list details come from your school's MIS, so corrections are best made there. If you ask us, we'll pass your request to your school and help it respond.

For the data we control, contact us at privacy@sinc.energy. We'll reply within one month.

Deleting your account

Your Sinc Energy account comes from your school: your place on its staff list, or the school console access its admins gave you. It's the same account in the apps and on the web. To delete it, either:

• ask your school to remove you: from its staff list in its management information system, or from the Users tab of the school console; or
• email privacy@sinc.energy from your school email address with "Delete my account" and your school's name, and we'll remove you with your school.

Once you're removed, you can't sign in. What you sent us, such as reports and requests, and the records of your sign-ins are deleted at the times in section 10. If you want them deleted sooner, say so in your email and we'll do it with your school's agreement, as it controls most of this data (section 3); copies in our backups expire within 35 days. Deleting the app from your phone signs you out on that phone but doesn't delete your account.

14. Complaints

If you're unhappy with how your data is handled, please talk to your school or us first. To complain to us, email privacy@sinc.energy or write to the address in section 16. We'll acknowledge your complaint within 30 days, keep you told of progress, and tell you the outcome. If it's about data your school controls, we'll pass it to your school and help it answer.

You can also complain to the Information Commission (the ICO) at ico.org.uk/make-a-complaint, or by calling 0303 123 1113.

15. Changes to this policy

We'll update this policy when the way we handle personal data changes, and change the date at the top. We'll tell schools about significant changes before they take effect.

16. Contact us

Email privacy@sinc.energy, or write to Sinc Energy Ltd, 98 Cloutsham Street, Northampton, England, NN1 3LN.