Privacy Policy

ELIZABETH CARE CONSULTING

Clarity. Confidence. Better care.

PRIVACY NOTICE

ECC Governance Compliance Suite

Last updated: 7 July 2026

Elizabeth Care Consulting Ltd · ICO registration ZC143634

1. Who We Are

Elizabeth Care Consulting Ltd ("ECC", "we", "us", "our") is the data controller for the personal data

described in this notice. We are a company registered in England and Wales, company number 17258169,

registered office 8 Atherley Road, Hayling Island, PO11 0JS, and we are registered with the Information

Commissioner's Office under reference ZC143634.

2. The Short Version

The ECC Governance Compliance Suite is built so that the compliance content you enter — including

anything relating to your service, your staff, or the people you support — stays in your own browser's

local storage and is never transmitted to or held on ECC's servers. We do not see, collect, or process this

content. Separately, we hold basic account information (to run your subscription) and billing information

(via our payment processor). This notice explains that data only.

3. What We Collect and Why

Account data: name, organisation name, email address, and login details, collected when you register for

the Suite. Used to create and manage your account, communicate with you about your subscription, and

provide support. Lawful basis: performance of a contract.

Billing data: payment card details are collected and processed directly by our payment processor, Stripe;

we do not store full card numbers ourselves. We hold billing history (amounts charged, dates,

subscription status) to administer your subscription. Lawful basis: performance of a contract.

Communications: if you contact us by email, we hold that correspondence to respond to you and keep a

record of the interaction. Lawful basis: legitimate interests (providing customer support).

Marketing (where applicable): if you opt in to hear about updates, events such as The Governance Hour,

or new features, we hold your email address for this purpose until you unsubscribe. Lawful basis:

consent.

We do not collect or process special category data (such as health data about people you support) — this

is because that content, entered into the working tools of the Suite, remains in your browser's local

storage and never reaches us.

4. Where Your Data Is Held

Account data is held on our application platform, Bubble. Billing data is held by our payment processor,

Stripe. Both providers are based in the United States; where personal data is transferred there, this is

done under UK-approved safeguards, currently the UK International Data Transfer Agreement (IDTA) or

the UK's Standard Contractual Clauses addendum.

Compliance content you enter into the Suite's tools is stored only in your browser's local storage on your

own device. It is not transmitted to Bubble, Stripe, or any ECC server, and we cannot access, recover, or

back it up on your behalf. You are responsible for your own back-ups of this content.

5. Who We Share Data With

We share account and billing data only with the processors necessary to run the Suite and your

subscription:

● Bubble — application hosting and account data storage

● Stripe — payment processing and billing

We do not sell personal data, and we do not share it with third parties for their own marketing purposes.

6. Cookies

The Suite currently uses essential cookies only, needed to operate and keep your account session secure.

If we introduce analytics or other non-essential cookies in future, we will update this notice and add a

cookie consent banner at that time.

7. How Long We Keep Data

We retain account and billing data for 6 years after your subscription ends, in line with standard UK

financial and contractual record-keeping requirements, after which it is deleted or anonymised.

Compliance content held in your browser's local storage is entirely under your control — it persists only

for as long as you keep it in your browser, and clearing your browser data or local storage will delete it.

We hold no copy of it.

8. Your Rights

Under UK GDPR, you have the right to:

● Access the personal data we hold about you

● Have inaccurate data corrected

● Have your data erased in certain circumstances

● Restrict or object to certain processing

● Data portability, where technically feasible

● Withdraw consent at any time, where processing is based on consent

To exercise any of these rights, contact admin@elizabethcareconsulting.co.uk. You also have the right to

complain to the Information Commissioner's Office (ico.org.uk) if you believe your data has not been

handled correctly.

9. Security

We use appropriate technical and organisational measures, including access controls, secure (HTTPS)

connections, and keeping system credentials server-side, to protect the account and billing data we hold.

10. Changes to This Notice

We may update this notice from time to time, for example to reflect changes in our processors or the

law. The"last updated" date at the top of this document will always reflect the current version.

11. Contact Us

Questions about this notice or how your data is handled can be sent to