Who's involved
Your school is the data controller for the pupil information held in your Arbor MIS. Nothing is shared until you grant permission.
Your council commissions the HAF programme and is a data controller for its delivery. Their privacy notice is found on their website and can be shared on request.
Arbor is your existing MIS. Eequ connects to it via Arbor's official API.
Eequ Ltd (ICO registration ZA465055) is the booking platform. For this programme Eequ acts as a data processor on your council's documented instructions, under a data sharing/processing agreement.
How permission works
You authorise the Eequ app in Arbor via System → Partner Apps. Access is read-only and limited to the fields below. You can withdraw access at any time from the same screen.
Eequ’s Arbor APP name and description is:
Eequ Local Authority HAF Invitation Service
Council-authorised Arbor APP for emailing parents of children receiving targeted Free School Meals (FSM) to invite them to book council-funded Holiday Activities and Food (HAF) programme.
What data Eequ reads from Arbor
Child's first name
Child's last name
Child's date of birth
Child's FSM status (StudentFreeSchoolMealEligibility)
Parent/guardian first name
Parent/guardian last name
Parent/guardian email (all eligible guardians, where more than one exists)
How Eequ uses this data
Eequ uses this data to email the parents/guardians of targeted FSM-eligible children when HAF booking opens (on the go-live date set by council), and possibly one reminder 7–10 days later.
Eequ does not retain the data after the emails are sent
To honour unsubscribes and avoid duplicate sends, it keeps only a one-way, salted hash of the email address. This cannot be reversed to reveal the address.
Eequ does not pass any of this data to the council.
Eequ does not use the data for its own marketing or any other purpose.
Lawful basis
Sharing is on the basis of public task (UK GDPR Article 6(1)(e)) — promoting a government-funded programme to eligible families. This is consistent with DfE guidance encouraging schools and local authorities to ensure targeted FSM children are aware of and can participate in the HAF programme.
If a parent goes on to book
Following the link and booking a funded session starts a separate processing relationship, governed by your council’s HAF privacy notice, under which Eequ acts as processor or joint controller as set out in the council agreement. A parent who does not book leaves no data with Eequ.
Contacts
Eequ: privacy@eequ.org — Eequ Ltd, 3rd Floor, 86–90 Paul Street, London EC2A 4NE. Full policy: help.eequ.org/en/articles/221003-eequ-privacy-policy
For the council, please find the correct contact details on your council’s Privacy Notice which can be found on their website.