Privacy Notice

Wardcote is a trading name of RJS & Partners LLP (OC455066), registered at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. This notice explains what information we collect when you use the Wardcote website, free tools, Staff Briefings and application, why we collect it, and the choices you have. If you have any questions, contact us at partners@rjsandpartners.co.uk.

Who is responsible for your information

RJS & Partners LLP is the controller for account administration, billing, enquiries, website tools and our own product analytics. Your organisation is the controller for personal information it puts into its workspace, including staff and records records; Wardcote processes that information on its behalf to provide the service. Your organisation decides what information is necessary, who may access it and which legal conditions apply. Staff Briefings uses published-report information as explained in the separate staff briefing notice below.

Information we collect

• Account information: your name and email address, used to sign you in and contact you. If you create a free account from a website template, the account holds your email address, the first name and role you gave, the templates you keep in your library, which version of each you have seen, and which template update emails we have sent you.
• Organisation details: your organisation’s trading/legal name, company number, sites, and team members.
• Records documents: the files you upload or import so Wardcote can help you track readiness review-readiness. These may contain personal data about staff and, in some settings, children or residents. We treat this as sensitive and apply additional safeguards (see High-sensitivity mode below).
• Website enquiries and free tools: contact details and the information you submit when requesting a demo, resource, scan or support; your selected setting, readiness URN, public readiness review information, scan results and delivery status. When you download a free template, we keep your email address, the first name and role you give us (both optional), which templates you asked for and when, and the website attribution described below. We email you a link to the template you asked for. If you tick the box to hear when a template changes, we keep a record of that choice, the wording you agreed to and when. These download and update-choice records are kept in the website database. If you create an embedded fee calculator, we store the setting and fee configuration, your email and the details needed to manage it. Published calculator settings can be viewed by visitors to that calculator. These tools do not require a paid app subscription.
• Website attribution: referral and landing-page addresses, campaign parameters, click identifiers where present, and the page on which you submit a form. The website stores first-visit attribution in browser local storage and includes it with relevant submissions. Clearing the website’s local storage removes that browser copy; it does not delete information already submitted. Authentication also uses browser storage or cookies where needed to keep you signed in.
• Published readiness review information: setting and inspector information from published readiness reports and registers, including readiness review dates, findings and citations.
• Usage and technical data: basic logs needed to operate and secure the service.
• Product analytics: counts and timings describing how Wardcote is used, such as how long it takes to file a document after uploading it, and how often a review is opened and left undecided. These are tied to a code that stands for your organisation and a code that stands for a signed-in user, not to names. We never record the contents of your documents, their file names, dates read from them, the reasons you record, staff or children’s names, or email addresses. There is no session recording, no screen capture and no advertising.

Wardcote does not provide per-child profiles, registers or development records. Uploaded records can incidentally contain children’s information. Please only provide the personal information needed for the task. If required account, contact or records information is not supplied, we may be unable to provide the particular service you request.

Connecting Google Drive (and other cloud storage)

If you choose to connect Google Drive, Wardcote requests least-privilege, per-file access (the drive.file scope) by default, for one purpose: to let you import documents you select as compliance records. This scope means Wardcote can only see the specific files you choose, not your wider Drive. We:

• only access the files and folders you choose to import;
• never modify, delete, or share your Google Drive files;
• store the extracted text, metadata, and a copy of imported documents inside your Wardcote account;
• store your access/refresh tokens encrypted at rest, and let you disconnect at any time from Settings → Integrations.

Google API Limited Use disclosure

Wardcote’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, data obtained from Google Drive is used solely to provide and improve the document-records features you see in the app; it is not used for advertising, is not sold, and is not used by us to train AI models.

How we use your information and our lawful bases

Where we act as controller, we use account, contact and billing information to enter into or perform a contract with you, or in our legitimate interests in administering our service and responding to the organisation you represent. When an owner or admin accepts our Terms of Service and Customer Data Processing Agreement for an organisation, we keep a record of that acceptance, with their name, email address and role, the date and time, the IP address and the device or browser used, as records of the contract, and we keep it after the account is closed. We use security logs to protect the service under our legitimate interests, and retain records required for tax and other legal obligations. We use enquiry and scan information to fulfil your request and support the service, and attribution to understand how people find us. Where you choose to receive marketing on the basis of consent, you can withdraw that choice at any time, including by contacting us. A request for a free scan or a resource is not itself consent to marketing.

Free templates. We use your email address to send you the template you asked for. That is part of providing the free tool you requested, and is in our legitimate interests in running it. We do not add you to a mailing list because you downloaded a template.

Template update emails. If you choose to hear when a template changes, we email you when we publish a corrected or updated version. The email lists what changed and links to the new version. Our lawful basis is your consent. Each email has a one-click unsubscribe link, and unsubscribing stops these emails straight away.

Expiry reminders. In the training matrix and single central record templates, you can ask us to email you before dates you enter. We store your email address, each date, and a short label you type for it. We ask you to use initials, not full names. We use these only to send the reminders you asked for, about 30 days before each date. Our lawful basis is your consent. You can stop any or all reminders from the link in each email. We delete each reminder once its date has passed, and all of them when you stop them. We do not need or ask for staff names, certificates or any other staff records for this.

Your template library. If you create a free Wardcote account from a template, we use your details to give you access to your library and to sign you in. Sign-in links are sent only to your email address. When a template you keep is updated, we tell you in the app and send you an email, and we keep a record of each of those emails and whether it was sent. That email is a service message about something you asked us to keep for you, not marketing. It stops when you remove the template from your library or close your account. Our lawful basis is performing our agreement with you to provide the account. Your library does not need an organisation. If you later set up Wardcote for your setting, the rest of this notice applies to that organisation’s account as usual.

When you first open your library, you agree to our Free template library terms. We keep a record of that agreement, in our legitimate interests in being able to show what was agreed. The record holds the version and wording you agreed to, the date and time, your IP address and the device or browser you used. We keep it while your account is open and for six years after it closes, and we remove the IP address and device or browser details from it twelve months after you agree.

• To provide the service: classify documents, extract dates, and track requirement status.
• To send you reminders, digests, and account/security emails.
• To take payment and manage your subscription.
• To keep the service secure and to meet our legal obligations.
• To measure and improve the product. Our lawful basis for this is our legitimate interests in understanding and improving our service. We are not relying on consent, and we do not treat accepting our terms or being signed up as consent to analytics. You can object at any time and we will exclude your organisation entirely; see Your rights below.

Product analytics is enabled for customer organisations by default. What is measured is deliberately narrow: a closed list of events with a fixed set of properties, enforced automatically, so no free text and no document content can be sent even by mistake. It is processed by PostHog on servers in the European Union, and it is used only to understand how Wardcote is used. It is never used for advertising, never sold, and never combined with data from other sites.

Document classification and date extraction use an automated AI document-processing provider (OpenAI or Anthropic; see sub-processors below). Content from the documents you upload, which may include special-category or criminal-offence data such as DBS and barred-list results, right-to-work and identity documents, health information, or safeguarding records, is sent to the active provider to provide document classification, extraction and record-quality checks. Where a document is a photograph or a scan with no readable text, the file itself is sent to be read, as described below. You should assume this applies to every document we are able to read; we do not operate a mode in which some uploaded documents are classified without the provider. We are completing verification of the account-level data-processing terms with each provider and publish the confirmed position on our Trust page.

Each kind of AI call sends different information, with its own limit. When a document with readable text is processed:

• Classification sends the first 6,000 characters of the document’s text and its filename, which may include a person’s name, together with the type of setting and our own list of requirement types.
• Reading dates and names sends the first 6,000 characters of the text. For a longer document it also sends up to 4,000 characters from later passages that introduce a person, such as those containing “certificate holder” or “has completed”, so up to 10,000 characters of the document in all. The filename is not sent with this call.
• The records check runs when the document is matched to one of the standard requirements in our list. It sends the first 5,000 characters of the text with that requirement’s name, your organisation’s name and the setting name. The filename is not sent with this call.

For a photograph, or a PDF scan with no readable text, the file itself is sent first so that the provider can read it: the image as uploaded, or the PDF. This happens automatically when the file is uploaded or imported. That call carries our own instructions and requirement types but not the filename. Each call is limited to 12 MB and 20 pages, and a file or part over 12 MB is not sent. The text the provider reads from the file is then used as the document’s text for the calls above, so the classification call includes the filename. A scan longer than 20 pages is read in parts in the background: Wardcote sends a copy of the next 20 pages (or 10 pages, if 20 would exceed 12 MB) and repeats the calls for each part, using everything read so far within the same limits, until it has found what the requirement needs, reached the end of the file or read 60 pages. A part that could not be read may be sent again. A document whose processing did not finish is sent again automatically, and choosing to retry the analysis sends it again, so one document can involve more calls than those listed here.

Complete-document analysis is part of how Wardcote processes documents for every organisation. For each document whose every page has readable text of its own, such as a PDF with a text layer or a Word or plain-text document, it sends the extracted text of every page, with the filename, to our AI provider, OpenAI, for the same purpose as the calls above: to check the document as records, here by finding restrictions, missing dates and integrity problems anywhere in it. Wardcote asks OpenAI to handle this analysis, and the classification, dates and names and records check calls above, on its priority service tier for every organisation it is on for. That is OpenAI’s faster processing option; it does not change what is sent or why. It is not made for a photograph or a scan, which are read as described above, or for a document with more than 342,000 characters of text. The Legal agreements page in your organisation’s Settings shows whether it is on.

Where this analysis finds that a document does not show what the requirement it is filed against needs, for example a stated exclusion, missing pages, an expected date that is not shown or a problem with the file itself, Wardcote puts a hold on it: the document does not count for that requirement while the hold stands, and the reason is shown with it. A hold is resolved in the way its kind allows: by uploading the whole document or a replacement that counts for the requirement; for missing pages, a missing date, an exclusion that needs checking or a problem with the file, by a new read of the same file that no longer finds it; or by a manager who can record exceptions for that records, with a reason, adding the missing date and saying where it came from, reviewing the exclusion, recording an exception on the requirement or accepting the document as supplied. The finding stays recorded, and a hold never changes or deletes the file.

Other features send no document content:

• Ask Wardcote sends your question (up to 800 characters) with details of up to 120 requirements you can see: each requirement’s name, including names your organisation gave its own requirements, its category, severity, status, whether it is recommended practice, setting name, expiry and review dates, and an internal reference. It also sends counts of requirements by status, and the name, job role and status of each staff member you can see; inactive staff are sent by job role and status only, without their name. This information is cut at 9,000 characters.
• Reports, including those made for a mock readiness review or a readiness review, send counts of requirements by status and the readiness score for the summary, and, for the recommendations, the names of up to eight high-priority requirements that are missing, expired or out of date, which can include names your organisation gave its own requirements.
• Chase email drafts send the name of the requirement being chased or the action title, which for your own requirements includes the name you gave it. The due date is not sent.
• Projects: creating a project, or generating its plan again, sends the project type, its name (up to 200 characters) and goal (up to 2,000 characters), any location you enter (country, region, city and local authority) and your answers to its setup questions, cut at 4,000 characters. Drafting a support document for a project sends the kind of document, the project name and type, the setting name, the titles of the project’s checklist items and linked requirement, and your setup answers, cut at 1,500 characters. Anything you type into these fields is sent as written.

These features support human review; Wardcote does not make solely automated decisions with legal or similarly significant effects on individuals. See the Trust and security page for current configuration and processing details. High-sensitivity mode does not switch off AI processing.

Service providers (sub-processors)

We rely on a small number of providers to run Wardcote:

• Cloudflare: public website delivery, security and DNS (global edge network)
• Lovable Cloud / Supabase: website hosting and website-tool database services for enquiries, free scans, calculator configuration and related events. The website database’s configured region is being verified; it is separate from the application’s MongoDB database.
• Vercel: application hosting (functions run in the EU / Dublin region) and Vercel Blob object storage for uploaded documents and published readiness reports
• Render: background processing for Staff Briefings (Frankfurt, EU)
• MongoDB Atlas: database
• Resend: transactional email, and receiving documents emailed to your Wardcote address (EU/US)
• Stripe: payments (EU/US)
• PostHog: product analytics (servers in the European Union)
• WhatsApp (Meta), delivered through a WhatsApp gateway we host ourselves and reach through an ngrok tunnel: internal alerts to the Wardcote team when something happens on an account, such as a new sign-up, a payment, a failed card, a cancellation or a support request. Limited to account facts: your organisation name, the name and email address of the person on the account who triggered the event, the plan, amounts charged or refunded, how many settings you hold, the domain of anyone invited to your team, and for inspector briefings the inspector reference you bought a briefing about. Documents, their contents, and the text of a support message are never sent.
• ngrok: the tunnel that carries those internal alerts from the application to our WhatsApp gateway. The text of each alert passes through it.
• OpenAI and/or Anthropic (United States): automated document classification and text/date extraction. Which provider is used depends on our configuration; the information described above is sent to the active provider for each AI feature, including assistants, and published report content is sent for published-report analysis. See our Trust page for exactly what is sent and for the verified position on retention and model-training as we complete confirmation of each provider’s account-level terms.

Company lookups use Companies House (UK); address suggestions use Google Maps Places (global). Optional imports use your Google Drive or Microsoft OneDrive account. These services receive the search or selected-file information needed for that feature. Authorised Wardcote staff may access information for support, security and rights requests. We may disclose information when legally required or as part of a notified business transfer. We do not sell your personal data or share your setting’s information with finance partners without a separate explanation and choice. This notice does not enable a finance-sharing feature.

readiness inspector information

If you are a readiness inspector, our Staff Briefings privacy notice explains how we use information from published readiness reports, our legitimate interests, retention, and how to object or make a subject access request.

Special category & criminal offence data

To help settings records their statutory duties, Wardcote processes special-category data (UK GDPR Article 9, for example health information) and criminal-offence data (Article 10, for example DBS and barred-list results, DBS Update Service status-check results, and suitability declarations). We process this on behalf of your organisation (the employer), which determines why it is collected. Your organisation must identify its applicable Article 6 lawful basis and the additional Article 9 or Article 10 condition, including any relevant Data Protection Act 2018 Schedule 1 requirements, for each purpose. Employment and safeguarding duties may be relevant; a subscription to Wardcote does not by itself establish those conditions. Staff completing a suitability declaration are shown a short notice before they submit. Staff asked to agree to periodic DBS Update Service status checks are shown a versioned notice before they answer, setting out what will be checked, how often, who sees the result and how to withdraw; the certificate number, surname and date of birth held so that a status check can be carried out are encrypted, are shown only to the roles permitted to see sensitive staff records, and every disclosure of them is recorded.

International transfers

Wardcote is operated from the UK, but processing is not limited to the UK. Application functions and the private document store are in Dublin, EU. Files uploaded before 3 September 2026 were previously held in Washington DC, United States; those customer files have been moved into the private EU store. Published organisation logos remain in the older store.

Our automated processing providers, OpenAI and/or Anthropic, are based in the United States. Document content, including special-category or criminal-offence data where present, may be transferred there for the AI features described above. Email, payments and global infrastructure providers can also process information outside the UK. EU storage does not mean that every provider processes information only in the EU.

Transfers outside the UK require an applicable UK adequacy arrangement or another valid transfer mechanism, such as the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses, with any required assessment. We are completing verification of the transfer terms incorporated in each AI provider’s account-level agreement, including retention and model-training settings. We do not currently describe those account-level terms as verified. Contact partners@rjsandpartners.co.uk to request information about the safeguards relevant to your data or a copy where available. We will update the notice when the position is confirmed.

Acknowledgement & declaration audit trail

When a staff member opens or submits a policy acknowledgement or a suitability declaration through a secure link, we record the outcome together with the date and time, the IP address, and the device/browser used, so the acknowledgement or declaration can be recorded during a readiness review. These records form part of your organisation’s compliance history.

High-sensitivity mode

When enabled for your organisation, Wardcote keeps personal details about children, residents, and staff inside the app and out of outbound emails.

Retention & security

We keep your data while your account is active and as needed to provide the service. When you close your account or ask us to delete your data, we delete it within 30 days of a verified request, except for limited records we must retain to meet legal or regulatory obligations (for example, compliance/audit history or financial records). We use encryption in transit and at rest for credentials and apply access controls appropriate to the sensitivity of the data.

Website enquiries, scan records and calculator configurations are retained for as long as needed to fulfil the request, provide the tool, handle support and meet applicable legal obligations. The period depends on the service and whether an ongoing relationship exists; you can ask us to delete information you no longer need us to hold. Limited billing and accounting records are retained for six years. Staff Briefings has the separate retention periods in its notice. Export your workspace data before cancelling; cancellation does not guarantee continued access to downloads.

Template download records are kept for up to 24 months from your last download, then deleted. Template update choice records are kept for as long as you are subscribed and for 24 months after you unsubscribe, so we can show what you agreed to. Expiry reminders are deleted once their date has passed. A template library is kept while your account is open, and templates you remove are deleted from it straight away. A free account that has only a template library and has not been used for 24 months is closed and deleted: we email you first, and close it 30 days later unless you sign in.

Your right to object

You can object to processing based on legitimate interests. To object to product analytics, email partners@rjsandpartners.co.uk and identify your organisation; we will exclude it from product analytics. You can also object to direct marketing at any time. Staff members have the specific objection route in their notice.

Your other rights

Under UK GDPR you have rights to access, correct, delete, and port your data, and to object to or restrict certain processing. To exercise any of these, email partners@rjsandpartners.co.uk.

You can withdraw consent where that is the basis, without affecting processing already carried out lawfully. Rights depend on the circumstances. We normally respond within one month and may need proportionate identity information. If your request concerns a venue’s workspace records, contact that organisation as controller; we will support it in responding. You may also contact us and we will help direct your request appropriately.

You have the right to complain to the Information Commissioner’s Office. You do not have to contact us before making a complaint.

Changes

Published versions are kept at permanent links in our notice history. We will explain material changes and notify affected account holders by email and, where appropriate, in the app at least 14 days before they take effect, including any change of controller. This version takes effect on 6 October 2026, when it was published. It adds the free website templates and the free template library: what we keep when you download a template, ask to hear when one changes or set an expiry reminder, what a free account created from a template holds, the record of your agreement to the Free template library terms, and how long each is kept, including closing unused template-only accounts after 24 months with 30 days’ email warning. These are new optional features, and nothing about how we use existing account holders’ or organisations’ information changes, so we treat this as a change that does not need advance notice. No organisation, owner, admin or member of staff needs to accept anything because of this change. The rest of this notice is unchanged from version 2026-09-28. This version does not treat continued use as consent.