Privacy notice

Homestay Carers Ltd ("we", "us", "our") is a live-in care introductory agency. We introduce independent, self-employed carers to families looking for live-in care. This notice explains what personal information we collect, how we use it, who we share it with, how we protect it and your rights. It covers families (and anyone enquiring on someone's behalf), carers who apply to join our register, and anyone who sends us their CV or contact details, whether for a specific role or to be considered for future opportunities.

Who we are

Homestay Carers Ltd, company number 17468243, registered office Romany, Sunset Lane, Pulborough, RH20 2NY, is the data controller for your personal data under the UK General Data Protection Regulation (UK GDPR). We're registered with the Information Commissioner's Office (ICO), registration number ZC278434.

Our dual role under UK data protection law

Homestay Carers acts in two distinct capacities depending on how your information is handled:

Data controller: we are the data controller for the personal information you provide to set up your account, complete vetting, handle billing and third-party collection of your weekly payments, and communicate with our team.
Data processor: we act strictly as a data processor regarding the execution, electronic signing and ongoing digital storage of the direct Private Care Agreement (Contract 3) entered into between the client or family and their chosen independent carer.

Strict data limitations for stored care agreements

When our website auto-generates, routes or stores your signed Private Care Agreement, we act solely as a secure digital filing cabinet on behalf of both contracting parties. We explicitly commit to the following safeguards:

No marketing exploitation: we will never share, sell, lease or use any contents, personal health terms, care schedules or sensitive background information contained within that specific agreement for our own business marketing or profiling purposes.
Passive storage only: the document is encrypted and stored purely for the operational convenience and future review of the client and carer. Our staff do not actively monitor, audit or manage the ongoing delivery of care outlined within it.

1. The information we collect

Families

Contact details: name, address, phone number and email address, and who the care is for.
Emergency contacts: names and contact details of family members, next of kin or anyone holding Lasting Power of Attorney.
Health and care information (special category data): health conditions, medical history, mobility needs, dietary requirements and daily routine, so we can introduce suitable carers. We treat this with extra care.
Payment details: what's needed to set up and collect weekly payments by direct debit, handled by Stripe Payments UK Limited.
If you ask us to email you our free planning pack: your email address, used only to send it.
On our website: information from cookies, if you agree to them (see below).

Carers

Identity and contact details: name, address, email, phone number, date of birth, photo ID and right-to-work documents.
Professional information: care experience, CV, qualifications, training certificates and references.
Vetting checks: enhanced DBS check results, including the Adults' Barred List, and your DBS Update Service status.
Insurance: details of your public liability insurance, and car insurance if you'll drive for a family.
Bank details: where needed to make payments to you.

Applicants and our talent pool

If you apply for a role with us, or ask to join our talent pool so we can contact you about suitable roles in the future, we collect:

Contact details: name, address, email and phone number.
Your CV and application: work history, care experience, qualifications, training, skills, availability, preferred locations and anything else you choose to include in your CV or covering letter.
Interview and selection notes: notes from calls or interviews, and the outcome of any application.
Right-to-work and references: only if you go forward for a specific role.

Please don't include health information, your date of birth, a photo, or details such as religion or ethnicity in your CV unless you want us to know them. We don't need them to consider you.

2. How we get your information, and why we're allowed to use it

Most of the information we hold comes directly from you: when you enquire about live-in care, apply to join our register as a carer, send us your CV, or ask to join our talent pool. If you apply through a job board or recruitment website, we receive your application from them. We also receive references from people you've named, and DBS results from the screening service.

Under the UK GDPR, the lawful bases we rely on are:

Contract: to take steps you've asked for before a contract, and to perform our contract with you, for example introducing carers to a family, vetting a carer, or considering your application for a role.
Talent pool: if you ask us to keep your details for future roles, we rely on your consent. You can ask us to remove you at any time, and we'll delete your details.
Legal obligation: for example checking a carer's right to work in the UK, and keeping tax and accounting records.
Legitimate interests: replying to enquiries and running our business, where this doesn't override your rights.
Consent: for health information about the person needing care, we rely on your explicit consent. For marketing emails and non-essential cookies, we only act with your consent. You can withdraw consent at any time by contacting us.
DBS and criminal record information is handled only as the law allows for safeguarding.

We don't sell your information, and we don't use it for marketing unless you've said yes.

3. Who we share it with

As an introductory agency, sharing some information is necessary to make a good match.

Families to carers: we first share an anonymised outline of the care needed. Once a carer is interested, we share the detailed care needs and location so they can check they can meet them, with your agreement.
Carers to families: we share a carer's profile, experience and vetting status with families or their representatives.
Service providers who help us run the business: our DBS screening provider, booking diary Calendly LLC, email providers Google Workspace and Resend, website host, direct debit provider Stripe Payments UK Limited and WhatsApp. They only use your information on our instructions.
Future sister companies: we may in future set up other companies owned by the same people as Homestay Carers Ltd. If we do, and want to share the details of applicants or people in our talent pool with them so they can be considered for suitable roles, we'll update this notice to name those companies and tell people in our talent pool before any details are shared. We won't share families' information, or anyone's health information, with them.
When the law requires it: for example, to protect someone at risk of harm (safeguarding), or if the police, a court or a regulator asks.

Transfers outside the UK: Google Workspace, Calendly, Stripe and WhatsApp may process some of your information in the United States. Where this happens, these companies protect it either under the UK–US data bridge (the UK Extension to the EU–US Data Privacy Framework) or under the UK's International Data Transfer Addendum, which require your information to be protected to UK standards. You can ask us for more detail about these safeguards at any time.

If you message us on WhatsApp

You can contact us on WhatsApp if you'd like to. If you do:

Your messages are end-to-end encrypted between you and us. WhatsApp (part of Meta) also processes some information, such as your phone number and when messages are sent, under WhatsApp's own privacy policy.
We use the WhatsApp Business app on a company phone, and only Homestay Carers staff can see your messages.
We use WhatsApp only to reply to you and arrange calls or visits. We won't add you to broadcast lists or send marketing without your agreement.
We may note the key details of a conversation in our records, and we delete WhatsApp chats after [12 months], or sooner if you ask.
Please don't send medical details, documents or photos you'd rather not share. We're happy to talk those through on a call.
You can ask us to switch to phone or email at any time.

Cookies

We use essential cookies to make the website work. With your permission, we also use analytics cookies to see how the site is used, and advertising cookies from Google, Microsoft and Meta to show our adverts to people who've visited. You can accept or reject these when you first visit, and change your choice at any time through [Cookie settings].

4. How we store and protect your information

Your information is stored on encrypted, password-protected cloud systems, and only people who need it can access it. We take particular care with health information and background checks.

We keep information only for as long as we need it, including to meet legal, accounting and reporting requirements:

Enquiries that don't go ahead: [12 months] after our last contact.
Families we work with: [6 to 7 years, confirm] after our service ends.
Carers on our register: while you're on our register, then [6 years, confirm].
Applications for a specific role that don't go ahead: 6 months after we tell you the outcome, unless you ask to join our talent pool.
Talent pool: 4 years from our last contact with you. Before then, we'll ask whether you'd like to stay in the pool. If you say yes, we'll keep your details for a further 4 years; if you don't reply, we'll delete them.
WhatsApp chats: [12 months], as above.
Planning pack and cost comparison email requests: [12 months].

When the retention period ends, we permanently delete digital records and securely shred any paper copies.

5. Your data protection rights

Under UK data protection law, you have the right to:

Access: ask us for a copy of your personal information.
Rectification: ask us to correct information you think is inaccurate or incomplete.
Erasure: ask us to delete your information in certain circumstances.
Restriction: ask us to limit how we use your information.
Objection: object to how we use your information.
Portability: ask us to move your information to another organisation, in certain circumstances.
Withdraw consent: where we rely on your consent, at any time.

There's no charge for exercising your rights, and we'll reply within one month.

6. How to contact us or complain

If you have any questions or concerns about how we use your personal information, contact us:

Homestay Carers Ltd, Romany, Sunset Lane, Pulborough, RH20 2NY
Email: hello@homestaycarers.co.uk
Phone: 01798 300 463

If you're still unhappy, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Changes to this notice

We'll update this notice if how we use your information changes. Last updated: [date].