Privacy Notice

Last updated: [SET DATE BEFORE LAUNCH]

This Privacy Notice must be reviewed by a solicitor or qualified DPO before going live.

Who we are

Orbis Care Limited is the data controller for personal data collected through this website.

Company registration number: 13220293
Registered address: Forward House, 17 High Street, Henley-in-Arden, Warwickshire, B95 5AA
ICO registration number: ZB389369
Contact: hello@orbiscare.co.uk | 01564 335180

What personal data we collect through this website

Contact and enquiry data. If you complete our contact form or request an assessment, we collect your name, phone number, email address, and the content of your message. Your message may include information about a loved one's care needs. We treat any health or care-related information you share with particular care.

Booking data. If you request a free assessment through this website, we collect your name, contact details, and your preferred appointment times.

Technical data. Standard technical information may be processed when you visit our website, including your IP address, browser type, and pages visited. See our Cookie Policy for detail on cookies.

We do not collect payment information through this website. We do not ask for special category personal data (such as health records or clinical information) through web forms, though you may choose to include care-related detail in a free-text message, which we handle accordingly.

How we use your personal data and our lawful basis

To respond to your enquiry. We use the contact details and message you provide to respond to your enquiry or question.
Lawful basis: legitimate interests (it is in both your interest and ours to respond to enquiries submitted through the website).

To confirm and manage your assessment booking. We use your name and contact details to confirm your appointment, send reminders, and contact you if we need to reschedule.
Lawful basis: performance of a pre-contractual arrangement (taking steps at your request before providing a service).

To improve our website. We use anonymised technical data to understand how our website is used and to improve its content and functionality.
Lawful basis: legitimate interests (improving our website is a reasonable business interest, and the data used is anonymised).

To comply with legal and regulatory obligations. In some cases we may need to retain or share information to comply with our legal obligations as a regulated care provider.
Lawful basis: legal obligation.

We do not use personal data submitted through this website for direct marketing without your explicit consent.

Who we share your data with

We work with a small number of third-party processors to operate this website. These processors act on our instructions and are contractually required to handle your data securely and in line with UK GDPR.

Cloudflare, Inc. (website hosting)
This website is hosted on Cloudflare Pages. Cloudflare is a US company, and technical data such as IP addresses in server logs may be processed in the United States under the UK Extension to the EU-US Data Privacy Framework and standard contractual clauses. Cloudflare's data processing addendum applies to our use of the service.

Brevo (Sendinblue SAS, France) (contact and assessment form delivery)
When you submit a form on this website, your details are delivered to our office mailbox by Brevo, an EU-based email service. Brevo processes the message within the EU/EEA solely to deliver it to us and does not use it for any other purpose.

Microsoft Corporation (email)
Email communications are handled through Microsoft 365. Microsoft holds a UK GDPR-compliant Data Processing Addendum and processes data in line with standard contractual clauses.

Care Quality Commission (ratings widget)
The footer of every page displays our CQC rating using the CQC's own widget. When it loads, your browser connects to the CQC's servers (a UK public body), which may process your IP address.

OpenStreetMap Foundation (embedded map)
Our contact page includes an embedded map from OpenStreetMap. When the map loads, your browser connects to OpenStreetMap's servers, which may process your IP address. See the OSMF privacy policy.

Plausible Analytics (website statistics)
We use Plausible, a privacy-focused analytics service, to understand how many people visit this website and which pages they find useful. Plausible does not use cookies, does not collect or store any personal data, and does not track you across other websites. It cannot identify you individually. Data is processed within the EU.

We do not sell your personal data to third parties. We do not share your data with any party for their own marketing purposes.

Anthropic, PBC (chat assistant)
This website includes an automated chat assistant, Compass. Messages you send to Compass are processed by Anthropic, a US company, to generate a reply. See our Chat Assistant Privacy page for detail on how this works and what we recommend you avoid sharing.

International transfers

Where our processors handle data outside the UK, appropriate safeguards are in place. Cloudflare processes data in the United States under the UK Extension to the EU-US Data Privacy Framework and standard contractual clauses. Microsoft 365 processes data under standard contractual clauses. Brevo processes form deliveries within the EU/EEA, which the UK recognises as providing adequate protection. Plausible processes analytics data within the EU.

How long we keep your data

Enquiry and contact form data. We retain correspondence for 12 months from the date of your last contact with us, unless it leads to a care services agreement, in which case our operational data retention policy applies.

Booking data. If an assessment does not lead to a care arrangement, we retain booking records for 12 months. If care begins, records are retained in line with our operational policy.

Website analytics data. Plausible does not collect personal data, so there is nothing about you individually to delete or expire. Aggregated, anonymous visit statistics are kept for ongoing trend reporting.

Your rights under UK GDPR

You have the following rights in relation to personal data we hold about you:

Right of access. You can request a copy of the personal data we hold about you.
Right to rectification. You can ask us to correct inaccurate data.
Right to erasure. In certain circumstances, you can ask us to delete personal data we hold about you.
Right to restrict processing. You can ask us to pause processing your data in certain circumstances.
Right to data portability. In certain circumstances, you can ask us to provide your data in a portable format.
Right to object. You can object to processing based on legitimate interests. We will consider your objection and stop processing unless we have compelling legitimate grounds that override your interests.
Rights relating to automated decision-making. We do not make decisions about you using solely automated means.

To exercise any of these rights, contact us at hello@orbiscare.co.uk or write to us at our registered address. We will respond within one calendar month.

Complaints

If you believe we have handled your personal data incorrectly, you have the right to complain to the Information Commissioner's Office (ICO).

ICO website: ico.org.uk
ICO helpline: 0303 123 1113

We would always prefer to hear from you directly first so we can try to resolve any concern, please contact us at hello@orbiscare.co.uk.

Changes to this notice

We may update this Privacy Notice from time to time. The date at the top of this page shows when it was last updated. Significant changes will be notified on the website.

How to contact us about privacy

Email: hello@orbiscare.co.uk
Phone: 01564 335180
Post: Orbis Care Limited, Forward House, 17 High Street, Henley-in-Arden, Warwickshire, B95 5AA