In plain English. We collect what we need to get into your house, look after it and your animals, and take payment — nothing else. Your key safe and alarm codes are encrypted, and a carer only sees them while they are actually at your property. We do not sell anything to anybody, and there is no advertising tracking on this site. You can ask us for a copy of everything we hold, or ask us to delete it, by sending one email.
The sections below are the binding detail.
This policy explains what we do with your personal information: what we collect, why we are allowed to, who sees it, how long we keep it and what you can ask us to do about it.
1. Who is responsible, and the law that applies
1.1 WE-DEV LTD is the data controller for the information described here. WECARE is a trading name of WE-DEV LTD, registered in England and Wales, company number 15878974. Registered office: Unit 6, Block 3 Woolwich Church Street, London, England, SE18 5PQ.
1.2 We are registered with the Information Commissioner's Office under [ICO REGISTRATION NUMBER].
1.3 This policy is written to the UK General Data Protection Regulation and the Data Protection Act 2018, both as amended by the Data (Use and Access) Act 2025, whose provisions were phased in between June 2025 and June 2026 and now apply in full.
1.4 Email info@wecarehome.co.uk with any question about this policy or about your information. We do not have a Data Protection Officer, and are not required to appoint one.
2. What we collect and why
2.1 Your account. Name, email address, phone number, and a password we store only as a hash, never in readable form. Lawful basis: Article 6(1)(b), performance of our contract with you.
2.2 Your property. Address, postcode, property type, parking notes, special instructions, and access details — key safe codes, alarm codes, where a key is kept, which rooms we may enter. Lawful basis: Article 6(1)(b).
2.3 Your animals. Species, breed, age, feeding, medication, temperament, vet, insurance and microchip details. Information about an animal's health is not special category data, because special category data is about people. Lawful basis: Article 6(1)(b).
2.4 Anything you tell us about yourself. A booking note sometimes says why you are away — a hospital stay, a bereavement. Where that reveals something about your health it is special category data, and we rely on your explicit consent, given by choosing to write it. Lawful basis: Article 6(1)(a) and Article 9(2)(a). You never have to tell us. If you would rather not, leave it out and the booking works exactly the same.
2.5 Visit records and photographs. What was done, when the carer arrived and left, and photographs taken inside your property for the visit report — the front door on leaving, your animals, anything needing your attention. Lawful basis: Article 6(1)(b), and Article 6(1)(f) legitimate interests in being able to evidence what was done.
2.6 Where a carer was. When a carer starts a visit we record the time and, where their device allows it, the location, so we can show the visit happened at your property. This is information about the carer rather than about you. Lawful basis: Article 6(1)(f), our legitimate interests in verifying the service and in protecting people who work alone.
2.7 Payments. Card payments are taken by Stripe. We never see or store your full card number. We keep the amount, the date, the last four digits, the card type and Stripe's reference. Lawful basis: Article 6(1)(b), and Article 6(1)(c) our legal obligation to keep accounting records.
2.8 Messages and enquiries. What you send through the website, the contact form, or the message thread on a booking. Lawful basis: Article 6(1)(b) where you are a customer; Article 6(1)(f) legitimate interests in answering an enquiry otherwise.
2.9 Website use. Our web server keeps standard logs — IP address, page requested, time — for security and troubleshooting. We do not use analytics or advertising cookies. See our Cookie Policy. Lawful basis: Article 6(1)(f), keeping the site working and secure.
2.10 Records of what was agreed. Which version of these documents you accepted, when, from which IP address; and your cookie choice. Lawful basis: Article 6(1)(c) and Article 6(1)(f) — we are required to be able to demonstrate consent and agreement.
2.11 Audit records. Administrative actions on your account, including every occasion an access code is revealed to a carer. Lawful basis: Article 6(1)(f), security and accountability.
3. Emergencies, and "recognised legitimate interests"
3.1 The Data (Use and Access) Act 2025 added a lawful basis called recognised legitimate interests. It covers a short list of situations — including responding to an emergency and safeguarding a vulnerable person — where we do not have to weigh our interests against yours before acting.
3.2 It matters here because of what our carers occasionally walk into. If a carer finds somebody unwell in a property, or finds a fire or a flood, they will give the emergency services whatever they need to know without stopping to consider data protection. Lawful basis: Article 6(1)(ea) and Annex 1.
3.3 That is the only thing we use it for. It is not a general licence, and we do not rely on it for anything routine.
4. Who sees your information
4.1 Your carer sees what the visit requires: the address, the tasks, your animals, your instructions. Access codes appear only while that carer's visit is in progress, and every disclosure is recorded.
4.2 Our staff see what is needed to run the business.
4.3 Our processors. Stripe for payments, our hosting provider for the servers, our mail provider for email. Each acts only on our documented instructions, under a contract containing the terms Article 28 requires.
4.4 Your vet, where we need treatment for an animal under your authorisation.
4.5 Emergency services or a tradesperson, where there is an incident at your property and you have authorised it.
4.6 Our insurers, advisers and the authorities, where a claim makes it necessary or the law requires it.
4.7 We never sell your information, and we never share it for anyone else's marketing.
5. How long we keep it
| What | How long | Why |
|---|---|---|
| Bookings, invoices and payment records | 7 years | Tax and accounting law, and the limitation period for claims |
| Visit photographs | 2 years | Long enough to settle a dispute about a visit |
| Key safe and alarm codes | 3 months after your last visit | Deleted as soon as they are no longer needed |
| Website enquiries | 2 years | To answer follow-up questions |
| Unsuccessful carer applications | one year | To answer a query about a decision |
| Audit log | 7 years | Security and accountability |
| Cookie consent records | 12 months | To show your choice was recorded and respected |
| Your account | Until you close it, then deleted or anonymised | Records tax law requires are kept separately |
These periods are configured in our system, and this table is generated from that configuration — so what you read here is what actually happens, not what we intended.
6. How we protect it
6.1 Key safe codes, alarm codes and similar access details are encrypted in our database using a key held separately from the data.
6.2 An access code is shown to a carer only during their visit, and never in an email or a text message.
6.3 Visit photographs are stored outside the public web root and served only through short-lived signed links, after a check that the person asking is entitled to see them.
6.4 The site is served over HTTPS. Passwords are hashed. Sessions expire. Every private route is checked on the server, not merely hidden in the interface.
6.5 Administrative actions are written to an audit log.
6.6 Carers are vetted before their first visit and sign a confidentiality undertaking.
7. Your rights
7.1 You have the right to:
- ask for a copy of the information we hold about you;
- have inaccurate information corrected;
- ask us to delete information we no longer need;
- object to, or ask us to restrict, processing we carry out on the basis of legitimate interests;
- ask for your information in a portable, machine-readable format;
- withdraw consent, where we rely on it, at any time and as easily as you gave it.
7.2 Email info@wecarehome.co.uk. There is no charge and no form to complete.
7.3 We respond within one month. We may extend that by two further months for a complex request, and if we do we will tell you within the first month and explain why.
7.4 If we need something from you before we can start — proof of who you are, or clarification of what you are asking for — the Data (Use and Access) Act 2025 allows us to pause the clock until you reply. We will ask promptly and specifically. The clock restarts the day your answer arrives.
7.5 We are required to carry out a reasonable and proportionate search. That means we will look everywhere it is sensible to look; it does not mean we will search every backup ever taken for a single email.
7.6 Some information must be kept even if you ask us to delete it — invoices, for example, which tax law requires us to hold. We will tell you what we are keeping and why.
8. Complaining to us
8.1 If you are unhappy with how we have handled your information, tell us first. Email info@wecarehome.co.uk, or use the form on our contact page, which reaches us electronically.
8.2 The Data (Use and Access) Act 2025 requires us to make complaining straightforward, to acknowledge your complaint within 30 days, and to respond without undue delay. We will do both, and in practice we aim to be much faster than 30 days.
8.3 You do not have to complain to us before going to the regulator. It usually gets the problem fixed faster.
9. Complaining to the regulator
You can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, by telephone on 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
10. Where your information is held
10.1 Our servers are in the United Kingdom.
10.2 Stripe may process payment information outside the UK. Where it does, the transfer is covered by the UK's approved safeguards, including the International Data Transfer Addendum to the European Commission's standard contractual clauses.
11. Cookies
We set only the cookies this site needs to work. There is no analytics and no advertising tracking. The Cookie Policy lists every one, with what it does and how long it lasts.
12. Automated decisions and profiling
12.1 We do not make any decision about you by automated means alone.
12.2 Our contact and careers forms score incoming messages for spam. A message the scoring flags is held for a person to read, never deleted automatically and never binned unseen. If a genuine message of yours is ever caught, a person will still see it.
12.3 We do not profile you, and we do not use your information to predict anything about you.
13. Marketing
13.1 We email you about your bookings because we have a contract with you. That is not marketing and you cannot opt out of it while you have a live booking — you would stop receiving your visit reports.
13.2 We only send marketing email if you have opted in. Every one has an unsubscribe link that works immediately, and you can change your preferences in your account.
13.3 We do not share your details with anyone else for marketing, and we never will.
14. Children
Our services are for adults. We do not knowingly collect information about children. If you tell us a child will be at the property, we record only what a carer needs in order to keep everybody safe.
15. Changes to this policy
We update this policy when what we do changes, or when the law does. The current version and the date it took effect are at the top of this page, and "What changed" tells you what moved.