Privacy notice
Last updated 14 August 2026.
This notice explains what personal data Requestable handles, why, where it is kept and who else is involved. It covers two different situations, and the difference between them matters, so they are dealt with separately below: this website, and the Requestable platform that a school or trust signs into.
Who is responsible for what. When a school or multi-academy trust uses Requestable, the trust is the data controller: the data is theirs, they decide what goes into it and how long it is kept. Requestable is a data processor acting on their instructions. For this website, and for enquiries sent to us, Requestable is the controller.
1. Who we are
Requestable is operated by [legal entity name to confirm], registered in England and Wales, registered office [registered address to confirm]. ICO registration number [to confirm].
For any question about this notice, or to exercise a right described below, write to hello@itjustworks.uk.
2. This website
This site is deliberately plain. It sets no cookies, contains no analytics, no advertising tags and no social media trackers, and loads nothing from any other company's servers. There is no form on it. Nothing you do here is tracked or profiled.
Our hosting provider, Cloudflare, processes the technical information any web server necessarily receives, such as your IP address, in order to serve the page and to protect the site from attack. We do not build any record of visitors from it.
If you email us, we hold that email and your reply address so that we can answer you and, if you become a customer, so that we have a record of what was agreed. The lawful basis is our legitimate interest in responding to enquiries and running the business. We keep enquiry correspondence for two years after the last message, unless it forms part of a contract, in which case it is kept for as long as the contract and then [six or seven years, to confirm] for tax and audit purposes.
3. The Requestable platform
3.1 Whose data it is
The trust or school is the controller. Requestable processes the data only to provide the service, only on their instructions, and never for our own purposes. We do not sell data, we do not share it with anybody the customer has not asked us to, and we do not use it to train anything.
3.2 What is in it
| Category | What it is |
|---|---|
| Staff identity | Name, work email address, the school or department they belong to, their role in the platform, and the identifier their Google account is known by |
| What they asked for | Requisitions, expense claims and invoices, including suppliers, amounts, budget codes, justifications and answers to the trust's own questions |
| Who decided | Every approval, refusal, request for information and comment, with the person and the time |
| Documents | Quotes, receipts, invoices and any other file a member of staff attaches |
| Payments | That something was paid, when, by which method from a fixed list, and a remittance reference |
No field in the platform asks for a bank account number, a sort code or a card number, and none is stored. Payment happens in the trust's own banking and finance systems; Requestable records only that it happened and how it can be traced.
3.3 Signing in
Staff sign in with the Google account their school already gives them. We never receive, hold or reset a password. From Google we receive the person's email address, their name and a stable identifier for their Google account, and nothing else. Only addresses at the domains the trust has told us to accept are allowed in; everybody else is refused.
Where a trust asks for it, we additionally check with their Google Workspace directory that the person is staff rather than a pupil, using read-only access the trust grants and can withdraw. That check reads the organisational unit the account sits in. It reads nothing else, and no pupil data is stored by Requestable at any time.
3.4 Where it is stored
Every trust has its own database and its own document storage, not a shared table. Both are created with a European Union residency constraint that cannot be changed afterwards, so the data stays in EU data centres. Our infrastructure provider is Cloudflare, processing under their data processing addendum. The United Kingdom recognises the EU as providing an adequate level of protection, so this transfer needs no additional safeguard.
3.5 Who else processes it
| Processor | What for | Where |
|---|---|---|
| Cloudflare | Hosting, database, document storage, DNS and protection from attack | European Union |
| Authenticating the person signing in, and the optional staff directory check | Under Google's own terms with the trust |
Notification emails are sent by the trust's own Google Workspace, as the trust, using a small script installed in their account. Those messages do not pass through us, and no third party mail service is involved. A trust that prefers no email at all can turn notifications off, in which case messages are recorded in the platform and sent nowhere.
3.6 What Requestable's own staff can see
Our administration console holds the customer register, what each customer is entitled to, what they pay, and whether their nightly backup arrived. It has no access to the contents of a trust's records: it cannot open a requisition, a claim, an invoice or a document, and it is built without any route to a customer's database.
If we ever need access to a trust's own data in order to help them with a problem, it will be at their request, limited in time, and recorded in that trust's own audit history, so they can see for themselves what was looked at and when.
3.7 How long it is kept
The trust decides, and sets it in the platform. Financial records are usually kept for [seven years, to confirm as the default we ship] in line with normal practice for school finance. Two things follow from that:
- Anything deleted goes to a bin for six weeks first and can be restored in full, so a mistake is recoverable.
- Nightly copies of the database are kept for a number of weeks the trust chooses, and older copies are then retired. That retirement removes copies only, never a record and never the last copy.
When a trust stops using Requestable, they receive a complete export of their data and we then delete their database and their documents. Deletion is carried out deliberately by a person, not on a timer, and we confirm when it is done.
3.8 Security
- All traffic is encrypted in transit. Data is stored on encrypted infrastructure.
- We hold no passwords, so there are none to leak.
- Access is default deny and re-checked on the server on every single request, so removing somebody's access takes effect immediately rather than when their session expires.
- The audit trail cannot be edited or deleted by anyone, including us: the database itself refuses the change.
- Exports that leave the platform are encrypted with AES-256-GCM under a passphrase the customer chooses and we never hold.
- Access to our infrastructure account requires two-factor authentication.
4. Your rights
Under the UK General Data Protection Regulation you have the right to be told what is held about you, to have it corrected, to have it erased in some circumstances, to restrict or object to its use, and to receive a copy in a portable form.
For anything inside the platform, ask your own school or trust, because they are the controller and they decide. Send us the request instead and we will pass it to them and help them answer it, which we are obliged to do promptly. For this website or an email you sent us, ask us directly.
If you are not satisfied with how a request has been handled you can complain to the Information Commissioner's Office at ico.org.uk, or by telephone on 0303 123 1113.
5. Automated decisions
There are none. Requestable routes a request to the people your own Scheme of Delegation names, and every approval and refusal is made by a person. Nothing in the platform decides anything about anybody automatically.
6. Changes to this notice
If this notice changes materially, the date at the top changes and existing customers are told directly rather than left to notice. Previous versions are available on request.