KitDeskPrivacy policy
Last updated 10 August 2026
KitDesk is equipment booking software. Organisations use it to keep track of who has borrowed what. This page explains what it stores about the people who use it, why it needs that, and how to get rid of it.
The software is run by Alpha IT Solutions Ltd, a company registered in England and Wales, number 15837037. Write to info@alphaitsolutions.uk about anything on this page.
Who is responsible for your data
This matters more than it sounds. If your employer, school or club gave you a KitDesk login, they decide what goes in and how long it stays. They are the data controller. We run the software and the server for them, which makes us their processor.
So if you want your records changed or removed, ask them first. If they will not help, or you cannot work out who to ask, write to us and we will.
What KitDesk stores
| What | Why |
|---|---|
| Your name and email address | To sign you in, show who booked what, and send you booking emails |
| Your password | Stored only as a bcrypt hash. Nobody, including us, can read it back |
| A 4 to 8 digit kiosk PIN, if you set one | So you can use a shared tablet without typing an email address. Also stored hashed |
| Bookings you make | What you took, where you took it and when it is due back |
| Photos you upload | Pictures of equipment, and pictures of damage when something comes back broken |
| Signatures, if your organisation collects them | Drawn with a finger when equipment changes hands, stored as an image on the booking |
| An activity log | Who checked what in or out, and when. This is the point of the product |
| Contact details of outside borrowers | Only if your organisation lends to people who are not staff |
| Server logs | IP address and request time, kept briefly, for security and fault finding |
There is no analytics package, no advertising network and no third-party tracker in KitDesk. No cookies are used for tracking. Your sign-in token is kept in your browser's local storage and is removed when you sign out.
The camera
The app asks for the camera so you can scan the QR label on a piece of equipment. Video is read in the browser, frame by frame, purely to find a code. Nothing is recorded, stored or sent anywhere. Refuse the permission and everything still works, you just type the reference instead.
Who else sees it
Two others, and only these:
- Brevo sends the emails. They receive the recipient's name and address and the content of the message, which is a booking confirmation, a reminder or an overdue notice.
- IONOS hosts the server, which is in Germany. They do not access the data; they supply the machine it runs on.
Nothing is sold. Nothing is shared for advertising. Data is not transferred outside the UK or EEA beyond the German hosting described above.
How long it is kept
Account details last as long as the account. Bookings and the activity log stay for as long as the organisation wants them, because a record of who had a £1,700 camera is the reason they bought the software. Photos last until deleted. Server logs are kept for about 30 days.
Delete your account and your name, email and PIN go for good. Bookings you made stay, with the link to you cut, so the organisation still knows the equipment moved without holding your details.
Your rights
Under UK GDPR you can ask for a copy of what is held about you, ask for it to be corrected, ask for it to be deleted, or object to how it is used. Ask your organisation first, since it is their data. Failing that, email us and we will act within one month.
If you think we have handled it badly, you can complain to the Information Commissioner's Office at ico.org.uk.
Deleting your account
In the app: open the menu, tap your name at the bottom of the sidebar, choose Delete account. It asks for your password and takes effect immediately.
Cannot get in? See deleting your account.
Children
KitDesk is for staff and volunteers running an equipment store. It is not aimed at children and we do not knowingly create accounts for under-13s.
Changes
If this policy changes in a way that matters, the date at the top changes and anyone with an account is told by email.