This policy explains how Fosterwith collects, uses and protects personal data when you visit fosterwith.com, contact us, or use the Fosterwith platform. It is written to meet the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).
Fosterwith is a trading name of FOSTERWITH LTD, a company registered in England and Wales under company number 17281682, with its registered office at Office 10236 321-323 High Road, Romford, England, RM6 6AX.
If you have any question about this policy or how we handle your data, contact us using the details above.
We handle personal data in two different capacities.
Fosterwith as data controller. We decide how and why we use personal data about website visitors, people who contact us or book a demo, prospective customers, and the business contact and account details of people who administer Fosterwith for their organisation. This policy covers that data in full.
Fosterwith as data processor. Local authority children's services teams and independent fostering agencies (IFAs) use Fosterwith to manage placements, carer budgets, expenses and case notes. That data is owned by the local authority or IFA, which is its data controller, and we act only on its documented instructions under a written Data Processing Agreement (DPA). This includes data about foster carers, social workers, and looked after children (LAC).
If you are a foster carer, social worker or child whose information is held in Fosterwith by your local authority or IFA, that organisation's own privacy notice explains how your data is used. Requests to exercise your rights over that data should go to them. If you contact us directly, we will pass your request to the relevant organisation without delay.
| Category | What it includes | Source |
|---|---|---|
| Contact and enquiry data | Name, email address, organisation, role, and anything you write in the additional information field | You, via our contact or book a demo form, email or phone |
| Prospect data | Name, job title, organisation, work email, work phone number, LinkedIn profile URL | Public sources such as organisation websites, LinkedIn, Ofsted reports and business data providers |
| Account data | Name, work email, mobile number (for magic link login), role, organisation, login and single sign-on (SSO) identifiers | Your organisation's administrator, or you |
| Usage and technical data | IP address, browser and device type, pages viewed, log-in times, actions taken in the platform, error logs | Automatically, when you use the website or platform |
| Support and communications data | Messages, support tickets, call notes and feedback | You |
| Contract and billing data | Names and contact details of people who sign or manage contracts, invoices and subscriptions; billing address; purchase order numbers; payment status and transaction history; for card payments, the card type, last four digits and expiry date only | You, your organisation, or Stripe |
How we collect payment depends on your plan.
Invoiced plans. We send invoices to your organisation, which are paid by bank transfer or through your organisation's procurement or purchase order system. We keep the contact and billing details needed to issue invoices and reconcile payments.
Subscription plans. Payments are taken by Stripe, our payment provider. Card and bank details are entered directly into Stripe's secure payment pages and are never stored on or passed through Fosterwith's systems. Stripe shares only limited information with us, such as the card type, last four digits, expiry date and whether a payment succeeded, so we can manage your subscription. Stripe processes payment data in line with its own privacy policy, and may also use it to prevent fraud and meet its legal obligations.
| Purpose | Lawful basis (UK GDPR Article 6) |
|---|---|
| Responding to enquiries and demo requests | Legitimate interests (responding to people who contact us) or steps prior to entering a contract |
| Contacting prospective customers about Fosterwith by email, phone or LinkedIn | Legitimate interests (promoting our services to relevant public sector and IFA professionals) |
| Setting up and managing user accounts, including login and SSO | Performance of our contract with your organisation; legitimate interests |
| Providing, securing and supporting the platform | Performance of contract; legitimate interests |
| Sending service notifications (for example approval alerts and allowance updates) | Performance of contract |
| Improving the website and platform using aggregated usage data | Legitimate interests |
| Invoicing, accounting and contract management | Performance of contract; legal obligation |
| Complying with law, regulators and valid legal requests | Legal obligation |
| Establishing, exercising or defending legal claims | Legitimate interests |
Business-to-business marketing. Under PECR, we may send marketing emails to corporate email addresses (including local authority addresses) without prior consent, provided each message identifies us and offers a simple way to opt out. You can opt out at any time by using the unsubscribe link or contacting us.
Where we rely on legitimate interests, we have assessed that our interests do not override your rights. You can ask us for details of that assessment.
Fosterwith holds information about looked after children only as a processor for local authorities and IFAs. We apply data minimisation by design: child records in the platform are limited to what is operationally necessary, and carers see only the details they need for the placement.
Case notes and related records may contain special category data (for example health information) or information about children. Our customers, as controllers, are responsible for the lawful basis and any Article 9 condition for that processing, and for completing a Data Protection Impact Assessment (DPIA) where required. We support customers with DPIAs and information governance reviews on request.
The Fosterwith website and marketing activities are not directed at children, and we do not knowingly collect personal data from children as a controller.
We use strictly necessary cookies to keep the website and platform working and secure, including keeping you signed in. These do not require consent.
We use analytics cookies only with your consent, which you can give or withdraw at any time through the cookie banner. We do not use advertising or cross-site tracking cookies. Who we share data with and international transfers
We do not sell personal data. We share it only with:
All Fosterwith platform data is stored and processed in the UK, on AWS servers in London. We do not transfer personal data outside the UK. Customers are notified of changes to sub-processors in line with their DPA.
| Data | Retention period |
|---|---|
| Enquiries and demo requests that do not lead to a contract | 24 months from last contact |
| Prospect data | 24 months from last contact, or sooner if you opt out |
| Marketing suppression list (to honour opt-outs) | For as long as we send marketing |
| Account data | For the life of the customer contract, then deleted within 90 days |
| Contract and billing records | 6 years after the end of the financial year they relate to |
| Security and access logs | 12 months |
| Customer platform data (as processor) | As instructed by the customer and set out in the DPA; customers can export their data before the contract ends, after which it is permanently deleted |
Deletion by customers. Customers control their own data in Fosterwith. Anything a customer deletes is permanently deleted, and we cannot recover it.
Security. Fosterwith holds Cyber Essentials certification. Our security measures include:
If a personal data breach occurs, we will notify affected customers without undue delay and, where required, the Information Commissioner's Office within 72 hours.
Under UK data protection law you have the right to:
To exercise any of these rights, email support@fosterwith.com. We will respond within one month, and there is normally no charge. We may need to confirm your identity first. For data we hold as a processor, we will refer your request to the relevant local authority or IFA, as explained in section 2.
Complaints. If you are unhappy with how we have handled your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.
Changes to this policy. We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated. Where changes are significant, we will tell customers directly.