Privacy notice

RTW Track is a right to work follow-up monitoring service for UK care providers. For the data described in this notice we are the data controller. You can reach us at contact@rtwtrack.co.uk.

Your employer decides what to hold about you and why. They are the controller and we are their processor, so requests to see, correct or delete your record go to them, not to us. We will pass on anything you send us and help them answer it.

When your employer asks you for a share code, you get a link to a short form. It asks for the code and your date of birth so the right record is updated. Both are encrypted individually before they are stored. We do not use anything you send for any purpose other than the check your employer is carrying out.

If you enquire. Your name, work email, the name of your service and your message, so we can reply. We keep enquiries for two years so we have the thread if you come back to us.

If you have an account. Your name, work email, your role and which services you cover. We sign you in with a code sent to your email, so there is no password. We keep a record of sign-ins and of what you view, change and export inside the product, because an unalterable audit trail is the thing customers are buying.

If you pay us. Your billing contact details and the identifiers Stripe gives us for your customer and subscription record. Card details go to Stripe directly and never reach our systems.

When you use the site. Our host keeps short-lived server logs that include IP addresses, for security and to keep the service running. Sign-up and contact forms are protected by Cloudflare Turnstile, which checks that a submission came from a person and receives your IP address to do it.

For replying to enquiries and for running, securing and improving the service, our basis is legitimate interests: ours in operating a business, balanced against your interest in not being contacted or tracked beyond what you would expect. For taking payment and providing the service you have signed up to, it is performance of a contract. For keeping business and tax records, it is a legal obligation.

One cookie keeps you signed in between pages, and the bot check on our forms may set a short-lived one of its own. Neither is used to build a profile of you. There is no advertising cookie, no analytics cookie and no third party tracking on this site, which is why you are not being asked to accept anything.

We use a small number of suppliers to run the service. Each one is contracted to process data only on our instructions, and each is listed with what it handles and where, in the sub-processor table in our data processing agreement. We do not sell personal data and we do not share it for anyone else’s marketing.

Accounts, staff records, documents and audit history are stored in the United Kingdom and stay there. Billing is handled by Stripe, which processes data in the United States and Ireland under the UK addendum to the standard contractual clauses. Stripe receives billing contact and payment details only, never staff records.

• Enquiries: two years from your last message.
• Account and audit records: for as long as your organisation has an account.
• After a subscription ends: you can export your full record for 30 days, then we delete it. If an organisation is set up but never subscribes, we delete it 14 days later.
• Billing records: six years, because tax law requires it.

You can ask for a copy of your data, ask us to correct it, ask us to delete it, object to processing based on legitimate interests, or ask for it in a portable format. Email contact@rtwtrack.co.uk and we will respond within one month. We do not charge for this.

If a request concerns a staff record inside a customer’s account, we will point you to the employer, because the decision is theirs to make.

If you think we have handled your data badly, tell us first and we will try to put it right. You can also complain to the Information Commissioner’s Office at ico.org.uk, or on 0303 123 1113.

If we change this notice we will update the version at the top. If a change materially affects account holders, we will email them before it takes effect.