Privacy and cookies
How PDAT uses your information
This page explains what information PDAT keeps about you and your setting, why, who helps us look after it, and the cookies PDAT uses.
Who we are
PDAT (the Physical Development Audit Tool) is provided by Inspector Play Ltd, company number 14171107. We are responsible for the information you put into PDAT (the “controller”). We are registered with the Information Commissioner’s Office (ICO), registration number ZC267853.
If you have any questions about your information, email pdat@inspectorplay.com.
What we collect
- Sign-in details: the email address you sign in with, and your name if you give it or sign in with Microsoft.
- Your setting: the setting or organisation name, the name of the lead contact, and for childminder licences your registration number.
- Your audits: the answers, notes, priorities and action plans you enter, and when they were saved.
- Security records: when sign-in codes are requested and used, and your IP address, so we can stop misuse. We keep IP addresses and email addresses in these records only in a scrambled (hashed) form. Our hosting provider also keeps standard technical logs of visits.
- Payments: if you buy a licence online, Stripe handles your card details. We never see or store your card number. We receive your email, the setting name and confirmation that you’ve paid.
PDAT is about your setting’s practice, not about individual children. Please don’t enter children’s names or other details that could identify a child in your notes.
Why we use it
- To provide PDAT under your licence: signing you in, saving your audits and showing your results and action plans. Our legal basis is the contract with your setting or organisation.
- If your setting is part of an organisation licence, the organisation’s lead can see your setting’s audits and results. This is part of the service your organisation has bought, and is in our and their legitimate interests.
- To keep PDAT secure and stop misuse, such as automated sign-in requests. This is in our legitimate interests.
- To send you the emails PDAT needs, such as sign-in codes, invitations and licence messages.
- To send you occasional emails about PDAT and the other support Natalie and Helen offer, such as training and consultancy. This is in our legitimate interests. Every one of these emails has an unsubscribe link, or you can email pdat@inspectorplay.com. Unsubscribing doesn’t stop sign-in codes or messages about your licence.
We never sell your information or use it for advertising.
Who can see it
People who sign in with your setting’s email, your organisation’s lead if you have an organisation licence, and the PDAT team (Natalie Weir and Helen Battelley) when we need to support you or run the service.
Who helps us
- Microsoft Azure hosts PDAT and stores its database in the UK (UK South).
- Resend sends PDAT’s emails (sign-in codes, invitations and licence messages) from its EU region in Ireland. Resend is a US company.
- Microsoft handles the sign-in if you choose “Sign in with Microsoft”, and hosts our email inbox.
- Stripe takes card payments when you buy a licence online.
They only use your information to provide their service to us.
How long we keep it
We keep your setting’s audits while your licence is active, so you can see your results and compare audits over time.
Following expiry of a PDAT licence, the setting’s audit data will be securely retained for up to 18 months to allow for renewal and continuity of assessment. After this period, the data will be securely deleted or anonymised, unless earlier deletion is requested. We’ll email you a month before this happens.
Where we act as a processor for your setting (for example, holding audit information on your behalf), you can ask us to return or delete your setting’s data when the service ends.
Commercial records, such as invoices, payments and licence and transaction records, are kept separately for as long as accounting and legal rules require. They aren’t deleted with your audit data.
Sign-in codes expire after 24 hours. Security records are deleted after about 2 days.
Cookies
PDAT only uses cookies that are strictly necessary to sign you in and run the service, so we don’t ask for consent and there’s no cookie banner. We don’t use analytics, advertising or tracking cookies.
| Cookie | What it does | How long it lasts |
|---|---|---|
pdat_session | Keeps you signed in | 30 days, or until you sign out |
pdat_signin | Remembers your sign-in while you enter the emailed code | Up to 24 hours, deleted once you’re signed in |
pdat_view | Remembers whether you chose your setting or organisation view | Until you close your browser |
AppServiceAuthSession | Keeps you signed in if you use “Sign in with Microsoft” (set by Microsoft Azure) | 8 hours |
Your rights
You can ask for a copy of your information, or ask us to correct it, delete it or stop using it. Email pdat@inspectorplay.com. We’ll reply within one month.
Complaints
If you’re unhappy with how we’ve handled your data, email pdat@inspectorplay.com. If you’re still not satisfied, you can complain to the ICO at ico.org.uk/make-a-complaint.
Last updated 14 October 2026.