This notice explains what we do with personal information across the Looking for Care website and the Looking For Accounts service. It applies to visitors, people looking for care, account holders, newsletter subscribers, people who write to us, care-home representatives and provider organisations.
1. Who we are and how to reach us
Looking for Care is a trading name of Looking Global Limited, a company registered in England and Wales under company number 15944828, whose registered office is Summer Shaw, Cudham Lane North, Cudham, Sevenoaks, TN14 7QR.
We are the controller of the personal information described in this notice, except where we say that someone else is. We have not appointed a data protection officer, because we are not required to. Responsibility for data protection rests with the company’s directors, and a named director owns it internally, so a request always reaches a person who can decide.
To ask us anything about this notice, or to exercise any of the rights in section 10, contact us at:
- Email: hello@lookingforcare.co.uk
- Post: Data protection, Looking Global Limited, Summer Shaw, Cudham Lane North, Cudham, Sevenoaks, TN14 7QR
One mailbox is monitored for privacy questions, complaints and legal notices, so nothing is lost between departments.
2. Enquiries about care, and information about health
We are a directory and enquiry platform. We do not own, operate, manage, inspect or regulate the care homes listed on the site, and we are not a party to any care or accommodation contract between a family and a home.
When you ask us to send an enquiry to a care home, we use the information you give us to send and manage that enquiry. Once the home receives it, the home is a separate controller of that information and is responsible for what it does next. Read the home’s own privacy notice before giving it anything further.
An enquiry about care can reveal a person’s health, disability or care needs. That is special-category information under Article 9 of the UK GDPR, and it carries extra protection. We ask for your explicit consent before we use it or pass it to a home, on a separate control beside the enquiry form, and we do not proceed without it.
Please give only what the home needs in order to reply. Do not send us medical records, NHS numbers, copies of identity documents or payment-card details, and never type them into a search box.
If the information is about someone else, only give it to us if you have that person’s permission or another lawful authority to act for them. If you do not, contact the home directly without identifying them.
3. What we collect
People looking for care
- your name, email address and telephone number;
- your account sign-in details and whether your email address has been verified;
- your relationship to the person needing care, and the location, care stage, funding position and preferences you tell us about;
- the homes you save, your shortlist, your private notes and your enquiry history;
- the care needs, health conditions, disability information and funding circumstances you choose to include in an enquiry or a message;
- whether you asked to visit a home, and which homes you contacted;
- your newsletter choice and the record of that consent;
- reports of incorrect listing information, feedback and correspondence; and
- technical and security information, including your IP address, browser information, session identifiers, timestamps and account activity.
Care-home and provider users
- your name, work email address, telephone number, job role and sign-in details;
- your organisation’s name, website, telephone number, billing email address, company number and CQC identifiers;
- workspace roles, home assignments and invitations;
- listing-submission and verification information, including the evidence of authority you send us, the results of CQC and Companies House checks, risk flags, reviewer notes and the decision;
- the profile text, availability, fees, facilities, photographs, logos and posts you publish;
- your billing address, VAT number, Stripe customer and subscription identifiers, and the brand and last four digits of the card (we never receive the full card number);
- enquiry and listing performance statistics; and
- notification choices, audit records and device or session information.
Information we obtain from elsewhere
Listings are created by the providers that manage them. We use public regulatory data, principally the CQC register and Companies House, to verify a home and the organisation behind it before a listing is approved. We obtain information from:
- the Care Quality Commission, including registered service details, contact details, regulated activities and ratings;
- Companies House and other public registers;
- the organisation owner or colleague who invites you into a provider workspace;
- Stripe, being payment status and limited card details; and
- the care homes and provider organisations themselves.
Where we obtain information about a named person indirectly, such as a registered manager named on the CQC register, we tell them within one month of obtaining it, or at the point we first contact them, whichever is sooner. If the information came from a public register, this notice is how we tell you.
4. Why we use it, and what allows us to
We use personal information only where the law gives us a basis for doing so.
| What we do | What we use | Our lawful basis |
|---|---|---|
| Run the directory, search, saved homes and family accounts | Account, preference, shortlist, note and usage information | Performance of our contract with you where you have an account; otherwise our legitimate interest in operating a useful directory |
| Send and manage an enquiry you ask us to send | Your contact details, the home you chose and your message | Steps taken at your request before entering a contract, and our legitimate interest in connecting families with homes |
| Use health, disability or care-needs information in an enquiry | The special-category information you choose to give us | Your explicit consent under Article 9(2)(a), given on a separate control beside the form |
| Reply to messages, listing reports and complaints | Contact details and correspondence | Our legitimate interest in answering you and correcting our records; legal obligation or legal claims where those apply |
| Create and run accounts and provider workspaces | Identity, contact, sign-in, role and organisation information | Performance of our contract, and our legitimate interest in secure account administration |
| Verify that a provider may act for a home | Contact and role details, public-register information, the evidence sent to us, risk signals and audit records | Our legitimate interest in preventing fraud and protecting homes and families, and the establishment or defence of legal claims |
| Publish and maintain care-home listings | CQC information and provider-supplied content | Our legitimate interest in operating an accurate directory, and our contract with the provider |
| Take membership payments and keep billing records | Billing identity, Stripe identifiers, payment status and limited card details | Performance of our contract with the provider, and our legal obligations for accounting and tax |
| Send service and enquiry notifications | Account email address, role, preferences and service events | Performance of our contract, and our legitimate interest in administering the service |
| Send the newsletter | Name, email address and the consent record | Your consent |
| Keep the service secure and investigate misuse | IP address, browser information, sessions, audit records and account activity | Our legitimate interest in security and fraud prevention, and our legal obligations |
| Establish, exercise or defend legal claims | The relevant account, transaction, communication and incident records | Our legitimate interests and the establishment or defence of legal claims; Article 9(2)(f) where special-category information is strictly necessary |
| Meet regulatory, tax and law-enforcement duties | The relevant identity, account, billing and transaction records | Legal obligation |
Where we rely on legitimate interests, those interests are operating and improving the platform, keeping it secure, establishing who genuinely controls a listing, preventing fraud, answering the people who contact us and running a sustainable business. In each case we have considered whether the processing is necessary and whether it is fair to you, and we will explain that assessment on request.
Where we rely on consent, you can withdraw it at any time. Withdrawing does not make what we did beforehand unlawful. If the information is what makes an enquiry possible, withdrawing consent before we send it will mean we cannot send it.
Giving us your information is not a statutory or contractual requirement. You are free not to, and you can browse the directory without an account. But we cannot send an enquiry, hold a shortlist or run a provider listing without the information described above.
5. Automated decisions
You have the right not to be subject to a decision based solely on automated processing that produces a legal effect or similarly significantly affects you. We do not make decisions of that kind.
Search results are ordered by a set of relevance and quality signals, described in our listings and ranking policy. That ordering suggests homes to look at; it does not decide anything about a person.
When a provider submits a listing, we run automated checks, for example whether a work-email domain, postcode or telephone number matches the public register. Those checks produce a score and flags for a reviewer. Every approval, rejection and ownership decision is made by a person.
Care homes decide their own admissions. Councils and the NHS decide their own funding. We are not involved in either.
7. Sending information outside the United Kingdom
Our database and our uploaded files are held in the United Kingdom or the European Economic Area. Some of the suppliers listed in section 6 are established in the United States and may process personal information there.
Where a transfer is made to a country without UK adequacy regulations, we rely on the UK International Data Transfer Agreement, or on the UK Addendum to the European Commission’s standard contractual clauses, and we assess whether any additional measures are needed. Where the receiving organisation is certified under the UK Extension to the EU-US Data Privacy Framework, we may rely on that instead.
Write to hello@lookingforcare.co.uk if you would like details of the safeguard used for a particular transfer, or a copy of it.
8. How long we keep it
We keep personal information only for as long as we need it. These periods are enforced automatically by a scheduled process, not merely intended.
| What | How long | Why |
|---|---|---|
| Search records | 90 days from the search | What was searched for and how many homes matched. We keep this briefly so we can tell whether the directory is returning sensible results, then delete it. |
| Enquiries sent to a care home | 365 days from the enquiry being sent | Our copy of an enquiry you asked us to send. We keep it for twelve months so we can help if something goes wrong with it, then delete it. The home keeps its own copy under its own privacy notice. |
| Messages sent to us | 730 days from the message | Messages sent through our contact and feedback forms, kept for two years so we have a record of what was raised with us and how it was resolved. |
| Expired sign-in and verification links | 30 days from the link expiring | Password reset, email verification and email change links are deleted 30 days after they expire. |
| Two-factor sign-in steps | Until it expires | The short-lived record of a two-factor sign-in step, deleted once it has expired. |
| Sign-in sessions | Until it expires | Sessions last 30 days and are removed as soon as they expire. |
| Newsletter unsubscribes | 30 days from unsubscribing | When you unsubscribe we stop immediately and delete your details within 30 days. |
Some records are governed by a different rule:
| What | How long | Why |
|---|---|---|
| Provider authority evidence | 90 days after the verification decision | Documents a provider sends to prove they may act for a home are deleted 90 days after we approve or reject the listing, unless a dispute requires us to keep them. |
| Family and provider account data | while the account is open | Your profile, saved homes, shortlist and private notes exist while your account does. Closing your account deletes them, along with your password and two-factor security. |
| Billing, invoice and tax records | six years | Kept for six years because company and tax law requires it. |
| Records of who did what on an account | six years | A record of actions taken on a paid account, kept for six years so a dispute can be answered. When an account is closed these records stay, but stop being linked to a person. |
We may keep information for longer where a complaint, a safeguarding concern, an investigation or a legal claim requires it. We may keep anonymous statistics indefinitely, because they no longer identify anyone.
9. Keeping it secure
We protect personal information with measures appropriate to the risk, including encrypted connections, access controls, two-factor authentication for sensitive roles, restrictions on who can see provider evidence and enquiry content, and an append-only record of administrative actions.
No online service is completely secure. Keep your password, your authentication codes and your devices to yourself.
If we suffer a personal data breach that is likely to result in a risk to people’s rights and freedoms, we will report it to the Information Commissioner’s Office within 72 hours of becoming aware of it. Where the breach is likely to result in a high risk to you, we will tell you without undue delay. Tell us straight away at hello@lookingforcare.co.uk if you think an account or an enquiry has been interfered with.
10. Your rights
Depending on the circumstances, you have the right to:
- be told how we use your personal information, which is what this notice does;
- get a copy of the personal information we hold about you;
- have inaccurate or incomplete information corrected;
- have information deleted;
- have our use of it restricted while a question about it is resolved;
- receive information you gave us in a portable, machine-readable format;
- object to processing we base on legitimate interests;
- withdraw a consent you have given; and
- not be subject to a decision based solely on automated processing that significantly affects you, as explained in section 5.
Some of these rights apply only in particular circumstances, and some have legal exceptions.
Your right to object to direct marketing is absolute. Use the unsubscribe link in any marketing email, or write to hello@lookingforcare.co.uk. We will stop, and we may keep the minimum record needed to make sure we do not contact you again by mistake.
To exercise a right, write to hello@lookingforcare.co.uk. We may ask for information to satisfy ourselves who you are. We will respond within one month, and will tell you if we need longer because the request is complex.
You can close your account yourself in your settings. Doing so deletes your profile, your saved homes, your notes, your password and your two-factor security. What survives, and why, is set out in the second table in section 8.
11. Complaints
Please raise a concern with us first, at hello@lookingforcare.co.uk, so that we have the chance to put it right.
You also have the right to complain to the Information Commissioner’s Office:
- Online: ico.org.uk/make-a-complaint
- Telephone: 0303 123 1113
- Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
12. Children
The service is for adults. It concerns adult social care, and you must be 18 or over to create an account or send us information. We do not knowingly collect information from children. Tell us if you believe a child has given us personal information and we will delete it.
13. Changes to this notice
We will update this notice when the service, our suppliers or the law changes. The current version is always published here with the date it took effect. Where a change materially affects how we use your information, we will take reasonable steps to bring it to your attention before the new use begins.