Privacy Notice

1. Who we are

Care Governance Solutions is a software product of Care Business School Ltd (Company No. 17217121), registered with the Information Commissioner's Office under registration reference ZC147699. For personal information that we collect for our own business purposes, such as account administration, enquiries, demonstrations, billing and service communications, Care Business School Ltd is the data controller.

Privacy enquiries can be sent to: support@caregovernance.solutions

Where a care provider or other customer uses Care Governance Solutions to upload, record or manage information about its staff, service users or other individuals, that customer will normally be the data controller and Care Business School will act as its data processor. In those circumstances, the customer decides why the information is used and is responsible for providing appropriate privacy information to the individuals concerned.

2. Information we collect

Depending on how you interact with us, we may collect:

Identity and contact information, such as your name, job title, organisation, email address and telephone number.

Account information, such as your login details, user role, organisation details and account preferences.

Commercial and billing information, such as subscription details, invoices, payment status and transaction references. We do not need to store full payment-card details where payment is handled by a payment provider.

Communications, including enquiries, support requests, demonstration bookings and correspondence.

Technical and usage information, such as IP address, browser/device information, login activity, security logs and information about how the platform is used.

Information entered or uploaded to the platform by customers, which may include governance records, audit evidence, workforce compliance information, incident or safeguarding information, and other records selected by the customer.

Customer-uploaded information may include personal data and, depending on what the customer chooses to record, special category personal data. Customers should only upload information that is necessary, lawful and appropriate for their use of the platform.

3. Why we use personal information

Where we rely on legitimate interests, those interests include operating and improving our business and platform, maintaining security, supporting customers and communicating appropriately with business contacts. We consider whether those interests are overridden by the rights and interests of individuals.

4. Special category and sensitive information

Care Governance Solutions is designed for governance and compliance use in the care sector. A customer may choose to enter information that is sensitive, including information relating to health or safeguarding. When we process this information on behalf of a customer, we do so as a processor under the customer's instructions. The customer is responsible for identifying the appropriate lawful basis and, where required, a condition for processing special category data.

We do not require customers to enter more personal information than is necessary for the governance or compliance task being completed.

5. When we act as a processor

When a customer uses the platform to manage its own records, Care Business School processes that information on the customer's behalf. Our responsibilities are set out in our Data Processing Agreement and applicable service terms. We process customer data only for providing, securing, supporting and maintaining the service, and as otherwise instructed or legally required.

If you are a staff member, service user or another individual whose information has been entered into Care Governance Solutions by a care provider, you should normally contact that care provider first if you wish to exercise your data protection rights.

6. Who we share information with

We use trusted service providers to operate Care Governance Solutions. We only share personal information where necessary and subject to appropriate contractual and security arrangements.

We do not sell personal information. We may disclose information where required by law, to protect legal rights, or in connection with a corporate transaction, subject to applicable data protection requirements.

7. How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including to provide the service, meet contractual obligations, resolve disputes, maintain security and comply with legal, tax and accounting requirements.

Customer data held within the platform is retained in accordance with the customer's subscription, our contractual terms and the customer's instructions. When an account ends, data will be handled in accordance with the applicable agreement and our documented deletion or return procedures.

8. Security

We use technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure. These measures include access controls, authentication, role-based permissions, secure infrastructure, logging and other safeguards appropriate to the service.

No online service can guarantee absolute security. Customers are also responsible for managing their authorised users, passwords, access permissions and the information they choose to upload.

9. Data hosting and international transfers

The core Care Governance Solutions platform is configured to host customer application data in the EEA. Some suppliers that support our business or platform may process limited personal information outside the UK or EEA.

Where an international transfer requires safeguards, we use appropriate legal mechanisms, such as adequacy regulations, the UK International Data Transfer Agreement or Addendum, and/or approved Standard Contractual Clauses, as applicable.

Google Workspace processes business email and correspondence under Google's applicable data processing terms. International transfers may occur as part of Google's global service, with contractual transfer safeguards applying where required.

10. Your data protection rights

Depending on the circumstances and the lawful basis being used, you may have rights to:

• ask for access to your personal information;
• ask for inaccurate information to be corrected;
• ask for information to be erased in certain circumstances;
• ask us to restrict processing in certain circumstances;
• object to certain processing, including direct marketing;
• receive certain information in a portable format; and
• withdraw consent at any time where processing is based on consent.

Your right to object: where we rely on legitimate interests, you may have the right to object to our use of your personal information. You always have the right to object to direct marketing.

To exercise rights relating to information we control directly, contact support@caregovernance.solutions. If your information was entered into the platform by one of our customers, please contact that organisation first because it will normally be the controller.

11. Cookies and website analytics

Our website may use cookies and similar technologies that are necessary for security, login and core functionality. Where we use optional analytics, advertising or other non-essential technologies that require consent, we will ask for your choice before using them. You can change your cookie choices through the cookie settings made available on the website.

Further details will be provided in our Cookie Policy.

12. Marketing

We may contact business users about Care Governance Solutions where permitted by law. Where consent is required, we will obtain it. You can unsubscribe from marketing at any time using the unsubscribe option in the message or by contacting us. We may still send essential service or account communications.

13. Complaints

If you have concerns about how we use personal information, please contact us first at support@caregovernance.solutions so that we can try to resolve the issue.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator. Information about making a complaint is available at ico.org.uk.

14. Changes to this Privacy Notice

We may update this Privacy Notice when our services, suppliers or legal obligations change. We will publish the current version on our website and update the date shown at the top. Where a change materially affects how we use personal information, we will take reasonable steps to bring it to the attention of affected users.

15. Contact us