Privacy notice — Looking For Accounts

1. Who we are and how to reach us

Looking for Care is a trading name of Looking Global Limited, a company registered in England and Wales under company number 15944828, whose registered office is Summer Shaw, Cudham Lane North, Cudham, Sevenoaks, TN14 7QR.

We are the controller of the personal information described in this notice, except where we say that someone else is. We have not appointed a data protection officer, because we are not required to. Responsibility for data protection rests with the company’s directors, and a named director owns it internally, so a request always reaches a person who can decide.

To ask us anything about this notice, or to exercise any of the rights in section 10, contact us at:

Email: hello@lookingforcare.co.uk
Post: Data protection, Looking Global Limited, Summer Shaw, Cudham Lane North, Cudham, Sevenoaks, TN14 7QR

One mailbox is monitored for privacy questions, complaints and legal notices, so nothing is lost between departments.

2. Enquiries about care, and information about health

We are a directory and enquiry platform. We do not own, operate, manage, inspect or regulate the care homes listed on the site, and we are not a party to any care or accommodation contract between a family and a home.

When you ask us to send an enquiry to a care home, we use the information you give us to send and manage that enquiry. Once the home receives it, the home is a separate controller of that information and is responsible for what it does next. Read the home’s own privacy notice before giving it anything further.

An enquiry about care can reveal a person’s health, disability or care needs. That is special-category information under Article 9 of the UK GDPR, and it carries extra protection. We ask for your explicit consent before we use it or pass it to a home, on a separate control beside the enquiry form, and we do not proceed without it.

Please give only what the home needs in order to reply. Do not send us medical records, NHS numbers, copies of identity documents or payment-card details, and never type them into a search box.

If the information is about someone else, only give it to us if you have that person’s permission or another lawful authority to act for them. If you do not, contact the home directly without identifying them.

3. What we collect

People looking for care

your name, email address and telephone number;
your account sign-in details and whether your email address has been verified;
your relationship to the person needing care, and the location, care stage, funding position and preferences you tell us about;
the homes you save, your shortlist, your private notes and your enquiry history;
the care needs, health conditions, disability information and funding circumstances you choose to include in an enquiry or a message;
whether you asked to visit a home, and which homes you contacted;
your newsletter choice and the record of that consent;
reports of incorrect listing information, feedback and correspondence; and
technical and security information, including your IP address, browser information, session identifiers, timestamps and account activity.

Care-home and provider users

your name, work email address, telephone number, job role and sign-in details;
your organisation’s name, website, telephone number, billing email address, company number and CQC identifiers;
workspace roles, home assignments and invitations;
listing-submission and verification information, including the evidence of authority you send us, the results of CQC and Companies House checks, risk flags, reviewer notes and the decision;
the profile text, availability, fees, facilities, photographs, logos and posts you publish;
your billing address, VAT number, Stripe customer and subscription identifiers, and the brand and last four digits of the card (we never receive the full card number);
enquiry and listing performance statistics; and
notification choices, audit records and device or session information.

Information we obtain from elsewhere

Listings are created by the providers that manage them. We use public regulatory data, principally the CQC register and Companies House, to verify a home and the organisation behind it before a listing is approved. We obtain information from:

the Care Quality Commission, including registered service details, contact details, regulated activities and ratings;
Companies House and other public registers;
the organisation owner or colleague who invites you into a provider workspace;
Stripe, being payment status and limited card details; and
the care homes and provider organisations themselves.

Where we obtain information about a named person indirectly, such as a registered manager named on the CQC register, we tell them within one month of obtaining it, or at the point we first contact them, whichever is sooner. If the information came from a public register, this notice is how we tell you.

4. Why we use it, and what allows us to

We use personal information only where the law gives us a basis for doing so.

What we do	What we use	Our lawful basis
Run the directory, search, saved homes and family accounts	Account, preference, shortlist, note and usage information	Performance of our contract with you where you have an account; otherwise our legitimate interest in operating a useful directory
Send and manage an enquiry you ask us to send	Your contact details, the home you chose and your message	Steps taken at your request before entering a contract, and our legitimate interest in connecting families with homes
Use health, disability or care-needs information in an enquiry	The special-category information you choose to give us	Your explicit consent under Article 9(2)(a), given on a separate control beside the form
Reply to messages, listing reports and complaints	Contact details and correspondence	Our legitimate interest in answering you and correcting our records; legal obligation or legal claims where those apply
Create and run accounts and provider workspaces	Identity, contact, sign-in, role and organisation information	Performance of our contract, and our legitimate interest in secure account administration
Verify that a provider may act for a home	Contact and role details, public-register information, the evidence sent to us, risk signals and audit records	Our legitimate interest in preventing fraud and protecting homes and families, and the establishment or defence of legal claims
Publish and maintain care-home listings	CQC information and provider-supplied content	Our legitimate interest in operating an accurate directory, and our contract with the provider
Take membership payments and keep billing records	Billing identity, Stripe identifiers, payment status and limited card details	Performance of our contract with the provider, and our legal obligations for accounting and tax
Send service and enquiry notifications	Account email address, role, preferences and service events	Performance of our contract, and our legitimate interest in administering the service
Send the newsletter	Name, email address and the consent record	Your consent
Keep the service secure and investigate misuse	IP address, browser information, sessions, audit records and account activity	Our legitimate interest in security and fraud prevention, and our legal obligations
Establish, exercise or defend legal claims	The relevant account, transaction, communication and incident records	Our legitimate interests and the establishment or defence of legal claims; Article 9(2)(f) where special-category information is strictly necessary
Meet regulatory, tax and law-enforcement duties	The relevant identity, account, billing and transaction records	Legal obligation

Where we rely on legitimate interests, those interests are operating and improving the platform, keeping it secure, establishing who genuinely controls a listing, preventing fraud, answering the people who contact us and running a sustainable business. In each case we have considered whether the processing is necessary and whether it is fair to you, and we will explain that assessment on request.

Where we rely on consent, you can withdraw it at any time. Withdrawing does not make what we did beforehand unlawful. If the information is what makes an enquiry possible, withdrawing consent before we send it will mean we cannot send it.

Giving us your information is not a statutory or contractual requirement. You are free not to, and you can browse the directory without an account. But we cannot send an enquiry, hold a shortlist or run a provider listing without the information described above.

5. Automated decisions

You have the right not to be subject to a decision based solely on automated processing that produces a legal effect or similarly significantly affects you. We do not make decisions of that kind.

Search results are ordered by a set of relevance and quality signals, described in our listings and ranking policy. That ordering suggests homes to look at; it does not decide anything about a person.

When a provider submits a listing, we run automated checks, for example whether a work-email domain, postcode or telephone number matches the public register. Those checks produce a score and flags for a reviewer. Every approval, rejection and ownership decision is made by a person.

Care homes decide their own admissions. Councils and the NHS decide their own funding. We are not involved in either.

7. Sending information outside the United Kingdom

Our database and our uploaded files are held in the United Kingdom or the European Economic Area. Some of the suppliers listed in section 6 are established in the United States and may process personal information there.

Where a transfer is made to a country without UK adequacy regulations, we rely on the UK International Data Transfer Agreement, or on the UK Addendum to the European Commission’s standard contractual clauses, and we assess whether any additional measures are needed. Where the receiving organisation is certified under the UK Extension to the EU-US Data Privacy Framework, we may rely on that instead.

Write to hello@lookingforcare.co.uk if you would like details of the safeguard used for a particular transfer, or a copy of it.

8. How long we keep it

We keep personal information only for as long as we need it. These periods are enforced automatically by a scheduled process, not merely intended.

What	How long	Why
Search records	90 days from the search	What was searched for and how many homes matched. We keep this briefly so we can tell whether the directory is returning sensible results, then delete it.
Enquiries sent to a care home	365 days from the enquiry being sent	Our copy of an enquiry you asked us to send. We keep it for twelve months so we can help if something goes wrong with it, then delete it. The home keeps its own copy under its own privacy notice.
Messages sent to us	730 days from the message	Messages sent through our contact and feedback forms, kept for two years so we have a record of what was raised with us and how it was resolved.
Expired sign-in and verification links	30 days from the link expiring	Password reset, email verification and email change links are deleted 30 days after they expire.
Two-factor sign-in steps	Until it expires	The short-lived record of a two-factor sign-in step, deleted once it has expired.
Sign-in sessions	Until it expires	Sessions last 30 days and are removed as soon as they expire.
Newsletter unsubscribes	30 days from unsubscribing	When you unsubscribe we stop immediately and delete your details within 30 days.

Some records are governed by a different rule:

What	How long	Why
Provider authority evidence	90 days after the verification decision	Documents a provider sends to prove they may act for a home are deleted 90 days after we approve or reject the listing, unless a dispute requires us to keep them.
Family and provider account data	while the account is open	Your profile, saved homes, shortlist and private notes exist while your account does. Closing your account deletes them, along with your password and two-factor security.
Billing, invoice and tax records	six years	Kept for six years because company and tax law requires it.
Records of who did what on an account	six years	A record of actions taken on a paid account, kept for six years so a dispute can be answered. When an account is closed these records stay, but stop being linked to a person.

We may keep information for longer where a complaint, a safeguarding concern, an investigation or a legal claim requires it. We may keep anonymous statistics indefinitely, because they no longer identify anyone.

9. Keeping it secure

We protect personal information with measures appropriate to the risk, including encrypted connections, access controls, two-factor authentication for sensitive roles, restrictions on who can see provider evidence and enquiry content, and an append-only record of administrative actions.

No online service is completely secure. Keep your password, your authentication codes and your devices to yourself.

If we suffer a personal data breach that is likely to result in a risk to people’s rights and freedoms, we will report it to the Information Commissioner’s Office within 72 hours of becoming aware of it. Where the breach is likely to result in a high risk to you, we will tell you without undue delay. Tell us straight away at hello@lookingforcare.co.uk if you think an account or an enquiry has been interfered with.

10. Your rights

Depending on the circumstances, you have the right to:

be told how we use your personal information, which is what this notice does;
get a copy of the personal information we hold about you;
have inaccurate or incomplete information corrected;
have information deleted;
have our use of it restricted while a question about it is resolved;
receive information you gave us in a portable, machine-readable format;
object to processing we base on legitimate interests;
withdraw a consent you have given; and
not be subject to a decision based solely on automated processing that significantly affects you, as explained in section 5.

Some of these rights apply only in particular circumstances, and some have legal exceptions.

Your right to object to direct marketing is absolute. Use the unsubscribe link in any marketing email, or write to hello@lookingforcare.co.uk. We will stop, and we may keep the minimum record needed to make sure we do not contact you again by mistake.

To exercise a right, write to hello@lookingforcare.co.uk. We may ask for information to satisfy ourselves who you are. We will respond within one month, and will tell you if we need longer because the request is complex.

You can close your account yourself in your settings. Doing so deletes your profile, your saved homes, your notes, your password and your two-factor security. What survives, and why, is set out in the second table in section 8.

11. Complaints

Please raise a concern with us first, at hello@lookingforcare.co.uk, so that we have the chance to put it right.

You also have the right to complain to the Information Commissioner’s Office:

Online: ico.org.uk/make-a-complaint
Telephone: 0303 123 1113
Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

12. Children

The service is for adults. It concerns adult social care, and you must be 18 or over to create an account or send us information. We do not knowingly collect information from children. Tell us if you believe a child has given us personal information and we will delete it.

13. Changes to this notice

We will update this notice when the service, our suppliers or the law changes. The current version is always published here with the date it took effect. Where a change materially affects how we use your information, we will take reasonable steps to bring it to your attention before the new use begins.