Privacy notice
SocialCareScore is designed so that we do not need to know who you are. This notice explains the small amount of information we do handle, why, how long we keep it, and your rights.
Summary
Who we are
SocialCareScore is run by [Operator legal name — to be confirmed before launch]. We are the controller responsible for the information described in this notice.
- [Operator legal name — to be confirmed before launch]
- Company or charity number: [Company or charity number — to be confirmed before launch]
- Address: [Registered address — to be confirmed before launch]
- Information Commissioner's Office registration number: [ICO registration number — to be confirmed before launch]
- Privacy contact: privacy@socialcarescore.co.uk
We are independent. We are not part of, or funded by, any council, government department, regulator or inspectorate. We are not required to appoint a data protection officer, but a named member of our team is responsible for privacy and can be contacted at the address above.
When you rate your experience
What we collect
- the council and service area you choose;
- your relationship to the service (for example "I receive, or received, support myself");
- roughly when your contact with the service happened (for example "within the last 12 months");
- your ratings, and whether you made a complaint and what happened;
- your comment, if you write one, after names, places, dates and other identifying details have been removed automatically;
- the date and time you submitted. After 90 days we delete the exact time and keep only the month;
- technical checks that help us spot automated or repeated submissions, such as whether the browser security check was completed, and a scrambled fingerprint of your comment text used only to spot copies;
- a scrambled version of your withdrawal code. We cannot turn it back into the code.
What we do not collect
We do not collect your name, contact details, IP address, device identifiers or location with your rating. We do not use cookies on public pages. We do not ask for your age, health or other sensitive information.
Sensitive information in comments
Comments about council services, particularly social care, can sometimes reveal sensitive information, such as details of health, disability, ethnicity or religion, or information about alleged crimes, about you or someone else. Please do not include this. If a comment contains sensitive or identifying information, we will not publish it, and we delete the text of comments that are not published after 30 days.
Is my rating anonymous?
We have designed the service so that we cannot tell who you are. However, a comment could still allow someone who knows you, or who knows about your situation, to recognise you. That is why we remove details automatically, a person checks every comment, and we do not publish comments that could identify anyone. Because we cannot rule out that some comments could be linked to a person, we treat comments as personal information and protect them under data protection law.
Preventing abuse
To stop people submitting large numbers of ratings, we limit how many ratings can come from the same network each day. To do this without storing your IP address, we mix your IP address with a random code that changes every day and turn the result into a scrambled value. We keep the scrambled value and the daily code for 48 hours and then delete them. After that, nobody, including us, can link the scrambled value back to an IP address.
We also use a short calculation in your browser and a hidden form field to detect automated software. These do not store anything on your device.
People mentioned in comments
Sometimes a comment may mention another person, such as a family member or a worker, even after details have been removed. We did not get this information from that person directly. We use it only to decide whether the comment can be published. Comments that could identify anyone are not published, and their text is deleted after 30 days. If you think a published comment is about you, please report it. It will be hidden immediately while we review it.
When you report a comment
When you report a comment, we collect which comment you are reporting, who you are (for example "a council" or "the person the comment is about"), the reason and the details you give. Giving your name and email address is optional. We only need them if you want us to tell you the outcome.
We delete your name and email address 12 months after your report is closed, and the rest of the report after 24 months, so that we can deal with any repeat reports or legal complaints.
When you contact us
If you email us, we will see your email address, name if you give it, and your message. We use them only to reply and keep a record of our correspondence. We never add your email address to a rating. We do not send newsletters or marketing.
Council responses
When a council sends us an official response to publish, we publish it with the job title of the person responding, not their name.
Website logs
Our web server records each page request, including the time, the page address (without any search terms), and whether the request worked. It does not record IP addresses, the page you came from or details of your browser. These logs are deleted after 14 days. Error logs, which help us fix faults, are deleted after 30 days.
Our moderators and administrators sign in to a secure area. We keep a record of their actions, including their IP address, for 24 months, for security and accountability.
Why we are allowed to use information
| Purpose | Lawful basis |
|---|---|
| Calculating and publishing scores, and publishing moderated comments, so that the public can see how council services are experienced | Legitimate interests: public accountability of public services and freedom of expression. We have balanced these against the privacy of the people involved, which is why we minimise information and do not publish anything identifying. |
| Deciding whether a comment containing sensitive information can be published, and deleting it if not | Legitimate interests, and the substantial public interest conditions in the Data Protection Act 2018 for protecting the public and safeguarding children and adults at risk. We have an appropriate policy document for this. |
| Preventing abuse and protecting the security of the website | Legitimate interests |
| Handling reports about comments, data protection complaints and requests to use your rights | Legitimate interests; legal obligation where the law requires us to have a complaints process; establishing or defending legal claims |
| In rare cases, telling the police or a council if someone appears to be at serious risk and we hold enough information to help | Vital interests; the recognised legitimate interest in safeguarding vulnerable people; the Data Protection Act 2018 condition for safeguarding children and individuals at risk |
| Managing accounts for our moderators and administrators | Contract (their engagement with us) and legitimate interests |
We do not make decisions about people using automated processing. Our software removes details and flags possible problems, but a person makes every decision about publishing a comment.
Who we share information with
- The public: scores, statistics and comments that have passed moderation. Our open data contains totals and scores only, not comments or individual ratings. We do not publish breakdowns based on very small numbers of ratings.
- Our hosting provider: our website and database are hosted on a server in the UK or European Economic Area. The provider acts on our instructions under a contract.
- Our email provider: for messages sent to our email addresses, under a contract.
- The police or a council: only in the rare safeguarding situations described in our safeguarding policy, or if a court or the law requires it. We cannot tell anyone who wrote a rating, because we do not know.
- Professional advisers: such as solicitors or insurers, if needed to deal with a legal complaint.
We do not sell information, and we do not use advertising, analytics or social media tracking. We do not plan to transfer personal information outside the UK and European Economic Area. If that changes, we will make sure it is protected as the law requires and update this notice.
How long we keep information
| Information | How long we keep it |
|---|---|
| Scrambled network values and daily codes used to prevent abuse | 48 hours |
| Single-use form codes | Up to 24 hours |
| Exact time of your submission | 90 days, then only the month is kept |
| Scrambled fingerprint of comment text used to detect copies | 90 days |
| Text of comments that are not published, including those held for safeguarding reasons | 30 days after the decision |
| Published comments | Shown for up to 36 months |
| Anonymous numeric ratings | Up to 6 years (only the most recent 24 months are used in current scores) |
| Name and email address given with a report | 12 months after the report is closed |
| Report records | 24 months |
| Record of moderator and administrator actions, including their IP address | 24 months |
| Web server logs (no IP addresses) | 14 days |
| Error logs | 30 days |
| Withdrawn ratings | Deleted immediately |
Your rights
Under UK data protection law you have rights to be informed, to access your information, to have it corrected or deleted, to restrict or object to its use, and to complain.
If you rated a service
Because we cannot identify you, we cannot find your rating from your name or email address, and the law does not require us to collect extra information to do so. Instead, you can use the one-time withdrawal code you were given to withdraw your rating. This deletes your ratings and comment straight away. If you have lost your code, we cannot recover it. This is deliberate, to protect your anonymity.
If you think a comment is about you
Report the comment. It will be hidden immediately while we review it, and removed if it could identify you. You can also email us to object or ask what we hold.
If you reported a comment or contacted us
Email privacy@socialcarescore.co.uk to ask for a copy of your information, or to have it corrected or deleted. We may need to confirm the request comes from the email address you used.
We will respond within one month. For complex requests we may extend this by up to two further months and will tell you why.
Complaints
If you are unhappy with how we have handled information, please tell us first at privacy@socialcarescore.co.uk. We will acknowledge your complaint within 30 days and tell you the outcome without undue delay.
You can also complain to the Information Commissioner's Office (ICO), the UK data protection regulator, or to the Information Commission when it takes over the ICO's role:
Other information
Children and young people
Young people can use SocialCareScore, including young people who have been in care. We handle everyone's information in the same careful way. We never ask your age, we do not create profiles, and we remove details that could identify you. If something is worrying you, you can talk to Childline on 0800 1111 or, if you are 25 or under and live in Wales, Meic on 0808 80 23456.
Security
We use encrypted connections, strict security settings, two-step sign-in for all our staff, limited access based on each person's role and a record of every staff action. No system is completely secure. If a data breach is likely to put people at risk, we will tell the regulator within 72 hours and, where we can, the people affected.
Cookies
We do not use cookies on public pages. See our cookies page.
Changes to this notice
We will update this notice if the way we handle information changes, and show the date it was last reviewed below.