1. About Us

French & Co Care Consulting provides consultancy, training, and compliance services to organisations within adult social care. We are the Data Controller for the personal data we collect.

2. The Personal Data We Collect

We may collect and process the following types of personal data:

• Contact details (name, role, organisation, email, phone).
• Professional information (service details, governance documents, project requirements).
• Special category data, only where necessary for consultancy work, including:
  • health‑related information contained within policies, audits, or case reviews;
  • safeguarding‑related information;
  • demographic information included in care records or workforce data.
• Website usage data (analytics, cookies—if applicable).
• Financial information (invoices, payment records).

We only collect the minimum data required for each purpose.

3. How We Collect Personal Data

We collect data:

• Directly from you (emails, phone calls, meetings, forms).
• Through consultancy activities (audits, policy reviews, training evaluations).
• From publicly available sources (e.g. CQC reports).
• Via our website (cookies/analytics/enquiries).

4. Why We Use Personal Data & Our Lawful Bases

Under UK GDPR, we must identify a lawful basis for each processing activity. The purpose and lawful basis are set out below: 

Delivering consultancy services - Contract (Art. 6(1)(b))

Responding to enquiries - Legitimate interests (Art. 6(1)(f))

Managing invoices and  payments - Legal obligation (Art. 6(1)(c))

Improving our services - Legitimate interests (Art.   6(1)(f))

Processing special category data - Art. 9(2)(g) substantial public interest; or Art. 9(2)(a) explicit consent

5. How We Use Personal Data

We use personal data to:

• Provide consultancy, governance, training, and compliance services.
• Produce reports, audits, recommendations and policies.
• Maintain communication with clients and wider stakeholders.
• Meet legal and regulatory obligations.
• Improve our website and services.

6. Data Sharing

We may share personal data with:

• Professional advisers (legal, accounting).
• IT service providers (secure email, cloud storage).
• Regulators or authorities where legally required.
• Sub‑contractors working under confidentiality agreements.

We do not sell personal data. If data is transferred outside the UK, we use appropriate safeguards such as adequacy regulations or standard contractual clauses.

7. Data Security

We use appropriate technical and organisational measures to protect personal data, including:

• Access controls and password protection.
• Confidentiality agreements.
• Regular review of data protection practices.

8. Data Retention

We retain personal data only for as long as necessary:

• Consultancy project data: typically 6 years.
• Financial records: 6 years (legal requirement).
• Website analytics: typically 12–24 months. 

9. Your Rights

Under UK GDPR, you have the right to:

• Access your data
• Request correction
• Request deletion
• Restrict processing
• Object to processing
• Request data portability
• Withdraw consent (where applicable)

To exercise these rights, contact us at ruth@frenchcareconsulting.co.uk

10. Complaints

If you have concerns about how we handle your data, please contact us.

You also have the right to complain to the Information Commissioner’s Office (ICO):
Website: ico.org.uk
Phone: 0303 123 1113

12. Updates to This Policy

We may update this policy periodically. The latest version will always be available on our website.

13. Contact Us

French & Co Care Consulting

ruth@frenchcareconsulting.co.uk