This policy explains how personal information is handled when Total Track is used. Total Track is provided by Malachi Burnett trading as Wiizard Software. Contact: [email protected] or wiizardsoftware.uk.
Total Track is available through total-track.uk and organisation subdomains such as organisation_name.total-track.uk.
Who Is Responsible For The Data
Each organisation or provision using Total Track is normally the controller for the records it creates and manages. Wiizard Software provides, hosts, maintains, and supports the platform and normally acts as processor for those records.
Wiizard Software may act as controller for limited business and operational information such as enquiries, onboarding correspondence, support requests, invoices, account administration, security logs, and records needed to run the service.
Information Total Track Handles
- Young person profile, education, celebration, milestone, target, outcome, medical, consent, and photo sharing records.
- Photos and media uploaded by authorised staff.
- Parent/carer names, contact details, accounts, and links to young people.
- Staff and Senior Leadership names, contact details, account details, roles, permissions, and activity needed to run the platform.
- Account setup, password reset, email verification, two-factor login, and protected-action approval emails.
- System logs, security events, data export files, one-time download links, and deletion workflow records.
- Business contact, onboarding, support, pricing, invoicing, and administration information handled manually with organisations.
Why Information Is Used
Information is used to provide the platform, enforce permissions, share appropriate records with linked parent/carers, manage accounts and security checks, provide exports and deletion-download links, support organisations, handle onboarding and invoicing, protect the service, and meet legal, safeguarding, contractual, and operational duties.
Wiizard Software does not sell personal information and does not use Total Track to send advertising to young people, parent/carers, or staff users.
Lawful Basis
The lawful basis for records held by an organisation is normally decided by that organisation as controller. Wiizard Software processes platform data on behalf of the organisation to provide the service. For Wiizard Software's own limited business and operational records, the lawful basis may include contract, legitimate interests, legal obligation, or consent where consent is specifically requested.
Access And Sharing
Access is controlled by account role and backend permission checks. Staff can access records needed for their work. Senior Leadership can manage wider platform settings. Parent/carers can only access linked young people and cannot see draft records. Media access is checked before files are served.
The current external providers are Resend for email delivery and Cloudflare for tunnels, domain routing, and related network services. Total Track does not use third-party advertising trackers.
Security And Backups
The platform is hosted on an Ubuntu server administered by the system owner. Administration is restricted to Tailscale and SSH key authentication. The application runs in Docker containers, secrets are stored in a git-ignored .env file, and passwords are salted and hashed.
Senior Leadership accounts use email two-factor authentication. Sensitive Senior Leadership actions use email confirmation by the requester and, where another active Senior Leadership account exists, separate approval from another Senior Leadership member.
Off-site backups are kept on a separate machine with the same access model. Only 30 daily backups are retained.
Retention And Deletion
Each organisation controls how long its operational records should be kept, subject to platform settings and any agreement with Wiizard Software. Young people are archived before deletion. Archived-record retention can be configured, including a never option.
When deletion is confirmed, linked parent/carers are emailed a download link for the young person's data. The link remains valid until it is downloaded. After the download is used, the live records are deleted. Deleted information may remain in backups until the normal backup retention period has passed.
Cookies And Local Storage
Total Track uses strictly necessary authentication/session storage so users can log in and private data can be protected. No cookie banner is used because Total Track does not currently use non-essential cookies or advertising/tracking cookies.
Your Rights
Under UK data protection law, you have rights over your personal information. Depending on the situation, these rights include being informed, accessing your information, correcting inaccurate information, asking for deletion or restriction, objecting to certain uses, receiving information in a portable format in some cases, and complaining to the Information Commissioner's Office.
Because each organisation is normally the controller for its Total Track records, requests about young person, staff, or parent/carer records should usually be made to the organisation first. For information Wiizard Software controls directly, contact [email protected].
Contact
Malachi Burnett trading as Wiizard Software
Email: [email protected]
Website: wiizardsoftware.uk