Who's involved
Your school is the data controller for the pupil information held in your Arbor MIS. Nothing is shared until you grant permission.
Your council commissions the HAF programme and is a data controller for its delivery. Their privacy notice is found on their website and can be shared on request.
Arbor is your existing MIS. Eequ connects to it via Arbor's official API.
Eequ Ltd (ICO registration ZA465055) is the booking platform. For this programme Eequ acts as a data processor on your council's documented instructions, under a data sharing/processing agreement.
How permission works
You authorise the Eequ app in Arbor via System → Partner Apps. Access is read-only and limited to the fields below. You can withdraw access at any time from the same screen.
Eequ’s Arbor APP name and description is:
Eequ Local Authority HAF Invitation Service
Council-authorised Arbor APP for emailing parents of children receiving targeted Free School Meals (FSM) to invite them to book council-funded Holiday Activities and Food (HAF) programme.
What data Eequ reads from Arbor
Child's first name
Child's last name
Child's date of birth
Child's FSM status (targeted)
Child's Year group
Parent/guardian first name
Parent/guardian last name
Parent/guardian email (primary guardian)
How Eequ uses this data
Eequ uses this data to email the parents/guardians of targeted FSM-eligible children when HAF booking opens (on the go-live date set by council), and possibly one reminder 7–10 days later.
Eequ does not retain the data after the emails are sent
To honour unsubscribes and avoid duplicate sends, it keeps only a one-way, salted hash of the email address. This cannot be reversed to reveal the address.
Eequ does not pass any of this data to the council.
Eequ does not use the data for its own marketing or any other purpose.
Lawful basis
Sharing is on the basis of public task (UK GDPR Article 6(1)(e)) — promoting a government-funded programme to eligible families. This is consistent with DfE guidance encouraging schools and local authorities to ensure targeted FSM children are aware of and can participate in the HAF programme.
Right to object
You may receive a request from a parent or carer asking that their information is not used for this purpose.
The processing described above is carried out on the basis of public task. This means that the right to object is not an absolute right in this circumstance. An objection does not automatically mean that the school must stop the processing or that Eequ can no longer send the HAF invitation.
If a parent or carer objects to their information being used for this purpose, please refer the request to your council using the contact details in the council's Privacy Notice. The council will consider the objection and determine whether there are grounds to continue processing the information.
Eequ acts as a data processor on the council's documented instructions and cannot independently decide to stop processing where the council has determined that the processing should continue.
If a parent goes on to book
Following the link and booking a funded session starts a separate processing relationship, governed by your council’s HAF privacy notice, under which Eequ acts as processor or joint controller as set out in the council agreement. A parent who does not book leaves no data with Eequ.
Contacts
Eequ: privacy@eequ.org — Eequ Ltd, 3rd Floor, 86–90 Paul Street, London EC2A 4NE. Full policy: help.eequ.org/en/articles/221003-eequ-privacy-policy
For the council, please find the correct contact details on your council’s Privacy Notice which can be found on their website.