- Who we are
- [COMPANY], registered in England, [COMPANY NUMBER], [REGISTERED ADDRESS]. Contact: [YOUR EMAIL].
- What Northlight is, and who the controller is
- Northlight is a workspace for independent Regulation 44 visitors. Each visitor is the data controller for what they record; [COMPANY] is the processor. There are no provider accounts, and no provider can read a visitor’s record.
- What is recorded
- Homes (name, Ofsted URN, provider, region), visits, reports, recommendations, and an audit log of every change. Children and staff are recorded by initials only — a full name cannot be stored.
- Where it is held
- In a database in London (AWS eu-west-2). It does not leave the UK. Drafting assistance, when used, runs in the same region; prompts contain initials only.
- Lawful basis
- [TO BE CONFIRMED WITH COUNSEL — see the strategy document, Risk 2.]
- How long it is kept
- Submitted reports are immutable and kept for [RETENTION PERIOD]. A visitor who closes their account receives an export of their reports before anything is removed.
- Your rights
- Access, rectification, erasure, restriction, portability, and objection, under UK GDPR. Write to [YOUR EMAIL]. Erasure of a submitted report is a deliberate, recorded act and is never something the application can do on its own.
- Last updated
- [DATE]