Privacy
and your data.
How RGB Technology uses information on this website and in the RGB Portal.
Who is responsible
RGB Technology Ltd is responsible for personal information collected through this site and the RGB Portal. Company number 12056167; VAT number 462578563. Postal address: 4 High Street, Hanging Heaton, Batley, West Yorkshire, England, WF17 6DX. For privacy questions or requests, email [email protected].
Our purposes and lawful bases
RGB has selected a lawful basis for each purpose and records its legitimate-interests reasoning. The ICO explains that organisations must identify a basis for each purpose and give this information to people.
| Purpose and information | Lawful basis | Why we use it |
|---|---|---|
| Optional public click, hover and download totals | Consent; we ask before optional analytics run | You choose whether to contribute optional website analytics. Rejecting does not block the site or portal. |
| Optional Microsoft Store click and Course or Equipment PDF activity notices | Consent | If you opt in, RGB sends these events to its internal Analytics Microsoft Teams channel. A signed-in portal user's name and email are included; an outside guest is labelled as not signed in and no identity is collected. No notice is sent without consent. Teams messages follow Microsoft 365 retention settings. |
| Review access requests, create and administer accounts, manually check that applicants are 18+, prevent misuse, and keep the approved-user contact list in Outlook | Legitimate interests | RGB’s interests are to provide a controlled service for law-enforcement and agency users, assess requests, administer access, contact approved members and protect accounts. The age-check record contains only the checker and time; RGB does not collect ID documents through this site. |
| Signed-in, per-user course views and file-download starts | Legitimate interests | RGB’s interest is understanding which portal resources are used so it can plan and maintain the service. These records are restricted to portal administrators and kept for 90 days. |
| Admin-created or imported member accounts, invitation links, and private training certificates | Legitimate interests | RGB’s interest is administering its professional training service, inviting approved adult agency contacts and making their training certificates available to them. Only the member and authorised administrators can download that member’s certificates. Invitation links do not opt anyone into news or marketing. |
| Security, sessions, rate limits and password setup/reset records | Legitimate interests | RGB’s interest is protecting the website and accounts, limiting abuse and ensuring that only approved users retain access. |
| Remembering your choice and sending optional product or service updates | Consent | You choose Yes or No and can change your choice. The portal currently records it but does not send marketing email or SMS. |
| Responding to an email, Teams or other enquiry you initiate | Legitimate interests | RGB’s interest is responding to your request and following up on the service or information you asked about. |
Where non-essential cookies or similar storage/access technologies are used on your device, RGB also obtains consent where required by PECR. This sits alongside the UK GDPR lawful basis for any personal data involved.
RGB’s legitimate interests are limited to the purposes above and balanced against the rights and reasonable expectations of people using a specialist business portal. Safeguards include 18+ approval, restricted administrator access, data minimisation, no storage of ID documents, separation of optional aggregate analytics from account-linked activity, and the stated deletion periods. You may object to processing based on legitimate interests; RGB will stop unless it has compelling grounds to continue or needs the information for legal claims.
Information we collect
The public website does not ask for personal information in an enquiry form. If you email or contact RGB through Microsoft Teams, RGB receives what you choose to include in that message.
The portal access-request form asks for your name, organisation, work email, optional phone number, the access or information requested, and why you need it. RGB administrators review each request. Please do not enter case details, special-category information, or personal information about other people. Portal accounts are for people aged 18 or over. RGB checks age manually before approval; the site records the administrator and time of the check, not a copy of an identity document.
An approved account stores your name, organisation, email address, optional phone number, account status, approval and age-check details, a password hash, session/security records, and your latest-news preference. Passwords are not stored in readable form. The site does not store full IP addresses in its application analytics. Cloudflare processes network information, including the connecting IP address, to serve and protect the site and apply rate limits.
Portal activity
When you are signed in, the portal records which course cards your account views (at most once per course per UTC day) and when a permitted file download starts. This account-linked activity is visible only to authorised administrators, is separate from optional anonymous analytics, and is deleted after 90 days. A download-start record does not prove that a file finished downloading or that software was installed.
If you allow optional analytics, selected public link clicks, coarse mouse-hover areas and anonymous download totals may be combined by page, hour and country. The hover map uses an 8-by-12 grid; it does not store individual cursor trails. These aggregated records do not include your name, email address, form contents or full IP address and are deleted after 13 months. Separately, the optional Teams notices described above include a signed-in user's name and email. You can change or withdraw your choice using “Privacy & analytics settings” in the footer; withdrawing consent stops future optional events and notices.
Language preferences
The language selector saves your choice in local browser storage so it carries between pages. RGB does not receive this setting or use it for analytics. Translations are bundled with the website. Choosing a language does not send page text to a translation service. Translated wording is provided for convenience. The UK English version of this privacy information is authoritative if a translation differs.
Member invitations and certificates
RGB administrators may create your approved account directly or import your professional contact details from an agency contact list. They record the manual 18+ check before creating access. Outgoing invitation email is paused: an administrator shares your personal password-setup link directly. New-member links expire after 24 hours and can be used once. Your news preference remains unanswered until you choose.
Certificates may contain your name, course title, completion or issue details and other information within the file RGB uploads. Certificate metadata includes its title, filename, size, upload date and issuing administrator. Files are stored privately on Cloudflare R2 and are available through your signed-in My certificates page and the protected admin area. Certificate contents are not added to analytics. Certificates remain with your account until you request account closure. Removing a member or certificate from the active lists archives it for restoration; archiving is not permanent erasure. Contact [email protected] to request closure or deletion.
Product and service updates
On first sign-in, the portal asks whether you want the latest product and service news. Your Yes or No answer and its time are recorded, and you can change it in the portal. Portal access does not depend on saying Yes. This preference currently does not trigger email or SMS messages.
Outlook contacts and service providers
After an administrator approves your request, the portal is designed to copy your name, organisation, email address and optional phone number into the Contacts folder for [email protected] in Microsoft Outlook. This helps RGB’s authorised administrators manage approved agency contacts. The Outlook sync is not active until RGB configures its Microsoft Graph integration. RGB intends to limit contact-folder access to [email protected], [email protected] and [email protected] through Microsoft 365 permissions.
Cloudflare provides hosting, Workers, the D1 database, private R2 file storage, Access controls and network protection. D1 is restricted to the EU jurisdiction and currently runs in Eastern Europe. The private R2 bucket reports Western Europe but uses Cloudflare’s default jurisdiction. Cloudflare Workers handle requests across Cloudflare’s global network, so some processing may occur outside the UK. Microsoft provides Outlook and Teams services; its processing is governed by the applicable Microsoft 365 tenant configuration and terms.
How long we keep information
- Approved portal account details and your news preference: until you ask RGB to close your account.
- Declined portal access requests: automatically deleted 28 days after the decision.
- Expired or revoked sessions and used or expired password-action records: automatically deleted after 90 days.
- Per-user course views and download starts: automatically deleted after 90 days.
- Optional aggregate analytics and anonymous download totals: automatically deleted after 13 months.
- Enquiry correspondence: kept as needed to answer the enquiry and manage any resulting customer relationship, then reviewed for deletion.
To close an account or ask for deletion, contact [email protected]. RGB will verify the request, disable portal access, and remove related portal and Outlook contact information subject to any legal need to retain it.
Your rights
Depending on the circumstances, you can ask to access, correct, erase or restrict your information, receive information you provided, or object to processing based on legitimate interests. You can withdraw consent at any time where processing relies on consent; this does not affect earlier processing. You can complain to the Information Commissioner’s Office. Contact RGB at [email protected]; RGB may need to verify your identity.
Children
The public pages are not age restricted. Portal accounts, courses, equipment resources, software downloads and portal update preferences are designed for adults aged 18 or over and are not intended for children. RGB manually checks age before approving a portal account.
Changes and analytics choice
We update this information when our services or data practices change. Use the control below to review or change your optional analytics choice.
Read the ICO guide to legitimate interests, ICO guidance on privacy information, and ICO guidance on storage and access technologies.