Clear about the data. Careful with the people.

Who we are

Critical Developments is a trading name and division of First Principles Works Limited, registered in England and Wales under company number 17417548. Our registered office is 58a Toorack Road, Harrow, England, HA3 5HU.

First Principles Works Limited is the data controller for this website, enquiries, commercial records and the Critical Developments Account service. When a school uses one of our products for pupil or staff records, the school normally decides why and how that information is used. In that setting the school is the controller and we act as its processor under the customer agreement and data-processing terms.

Information we use

Website and enquiries

We may receive your name, work contact details, school, the content of your message and basic technical security logs created when you visit the site.

Account and licensing

We use account identifiers, work email addresses, school memberships, roles, sign-in and security events, authentication status, product entitlements, licence records and any purchase-order or contract evidence supplied by an authorised school contact.

School product data

The information a school enters depends on the product. It may include staff identity and, where the school has authorised it, pupil, attendance, support, pastoral, classroom or recognition records. Each product is designed to limit access by school, role, permission and purpose.

Cookies and local storage

This public website sets no cookies. The Account service and signed-in products use strictly necessary security and session storage to keep people signed in, protect requests and remember essential interface choices. We do not use it for behavioural advertising.

Why we use it

We process information only where there is a lawful basis and a defined purpose. Depending on the context, this includes:

• taking steps requested before a contract and delivering contracted services;
• our legitimate interests in operating, securing and improving the service, where those interests do not override a person’s rights;
• meeting legal, tax, accounting, security and regulatory obligations; and
• following a school’s documented instructions when we act as its processor.

The school remains responsible for identifying the lawful basis for pupil and staff information it asks us to process. Signing in, receiving an invitation or holding an email address does not create a school membership or product licence.

Who receives information

We do not sell personal information. We disclose it only when needed to provide and secure the service, comply with law or protect people and systems.

Specialist providers may support hosting, network security, email routing and school-selected sign-in methods such as Microsoft or Google. They are assessed and contracted for their role. Where information is processed outside the UK, we use an appropriate lawful transfer mechanism and carry out the checks required for that transfer.

Within a school, access follows its memberships, roles and product permissions. Platform operators have tightly limited, audited access for account, licence, recovery and security administration.

Retention and deletion

We keep information only for as long as it is needed for the purpose collected, the school’s documented retention policy, security and audit needs, and any legal or contractual obligation. We then delete or de-identify it securely.

Schools control the justified retention periods for the identifiable pupil records they ask our products to process. Closing an account or ending a licence does not automatically override a legal hold, safeguarding requirement or an agreed return-and-deletion process.

Security

We use access controls, encryption in transit, restricted administrative actions, audit records and multi-factor authentication for elevated access. No service can remove every risk, so we also maintain incident, recovery and notification procedures.

Your rights

Depending on the circumstances, you may have the right to ask for access, correction, erasure, restriction, objection or portability, and to complain about how information is used. Where a school controls the record, contact the school first; we will support it in responding.

You can also complain to the Information Commissioner’s Office. We would still like the opportunity to put things right.

Contact us about privacy