Skip to main content

Legal

Privacy policy

Last updated: 7 July 2026 · Version 1.1

Introduction

DARRAA LTD, trading as CareCompliant ("we", "us", "our"), is committed to protecting and respecting your privacy. This policy explains how we collect, use, and protect personal data when you use the CareCompliant platform and website.

We are the data controller for the personal data we collect from you directly. When you use CareCompliant to manage staff and compliance data for your care organisation, you are the data controller for that data and we act as a data processor on your behalf.

Data controller details

DARRAA LTD (trading as CareCompliant)
Registered in England and Wales, company number 16152779
Email: [email protected]

What data we collect

We collect the following categories of personal data:

Account information

  • Name and email address
  • Organisation name and details
  • Phone number (if provided)
  • Job title and role
  • Account credentials (passwords are encrypted)

Usage data

  • Log data (IP address, browser type, pages visited)
  • Feature usage and interaction data
  • Session information

Compliance data (as data processor)

When you use CareCompliant to manage your organisation's compliance, you may input:

  • Staff member details (names, contact information, employment details)
  • Training records and certifications
  • DBS check information
  • Right to work documentation references
  • Incident reports and investigations
  • Audit findings and action plans
  • Policy acknowledgements

For this data, your organisation is the data controller and we process it solely on your instructions as set out in our DPA. A copy of our Data Processing Agreement is available on request.

How we use your data

We use personal data for the following purposes:

Service provision

  • Providing and maintaining the CareCompliant platform
  • Processing your subscription and payments
  • Sending service notifications and updates
  • Providing customer support

Communications

  • Responding to enquiries and demo requests
  • Sending product updates and feature announcements
  • Marketing communications (with your consent)

Service improvement

  • Analysing usage patterns to improve features
  • Identifying and fixing technical issues
  • Developing new functionality

Legal basis for processing

Under UK GDPR, we process your personal data on the following legal bases:

  • Contract: Processing necessary to perform our contract with you (providing the service)
  • Legitimate interests: Processing for our legitimate business interests (improving services, security, fraud prevention) where these do not override your rights
  • Consent: Where you have given consent, for marketing communications and for analytics and advertising cookies
  • Legal obligation: Where processing is required to comply with law

Data sharing and third parties

We may share your data with:

  • Service providers: Cloud hosting (AWS/similar), payment processing (Stripe), email services
  • Analytics and advertising: Plausible Analytics (privacy-focused, no personal data collected), Google (Google Analytics 4 and Google Tag Manager), Meta (Meta Pixel) and Hotjar (behaviour analytics and session recordings)
  • Professional advisers: Lawyers, accountants where necessary
  • Legal requirements: Law enforcement or regulators when required by law

We do not sell your personal data to third parties. We do not share your data with third parties for their own marketing purposes.

Analytics, advertising and consent

We use Plausible Analytics, a privacy-focused service that does not use cookies and does not collect personal data, to understand aggregate website usage.

We also use Google Analytics 4 (delivered through Google Tag Manager), Meta Pixel and Hotjar on our marketing website. These services use cookies and process information such as your IP address, device and browser details, and the pages you visit. Meta Pixel helps us measure the effectiveness of our advertising. Hotjar provides heatmaps and session recordings that show how visitors interact with our pages. These cookies are only set if you accept them through our cookie banner.

Our Google tags operate under Google consent mode. If you decline cookies, no analytics or advertising cookies are set and Meta Pixel and Hotjar are not loaded at all. However, Google tags still send limited, cookieless signals to Google, including the page address you visited, the referring page and basic browser and device information. Advertising click identifiers are redacted from these signals. Google uses this cookieless data to produce aggregate, modelled measurement rather than to identify or profile you. For more detail, see Google's consent mode documentation.

You can change your mind at any time. Clearing your browser's stored data for our website removes your saved choice and the cookie banner will appear again on your next visit.

International transfers

Your data is primarily stored and processed in the United Kingdom. Where we use service providers based outside the UK, including Google, Meta and Hotjar, we ensure appropriate safeguards are in place. These include the UK Extension to the EU-US Data Privacy Framework for certified providers in the United States, and the International Data Transfer Agreement or Addendum approved by the Information Commissioner's Office where Standard Contractual Clauses are used.

Data retention

We retain personal data for as long as necessary to:

  • Provide our services to you
  • Comply with legal obligations
  • Resolve disputes and enforce agreements

Specific retention periods:

  • Account data: Duration of your subscription plus 6 years
  • Marketing contacts: Until you unsubscribe or 2 years of inactivity
  • Demo/contact form submissions: 2 years
  • Compliance data: As instructed by you as data controller, or until account deletion

Your rights

Under UK GDPR, you have the following rights:

  • Access: Request a copy of your personal data
  • Rectification: Request correction of inaccurate data
  • Erasure: Request deletion of your data (subject to legal requirements)
  • Restriction: Request restriction of processing
  • Portability: Request your data in a portable format
  • Object: Object to processing based on legitimate interests
  • Withdraw consent: Withdraw consent for marketing communications or for analytics and advertising cookies at any time

To exercise these rights, contact us at [email protected]. We will respond within one month.

Data security

We implement appropriate technical and organisational measures to protect your data, including:

  • Encryption in transit (TLS) and at rest
  • Access controls and authentication
  • Regular security assessments
  • Staff training on data protection
  • Incident response procedures

Cookies

We use cookies on our website. Analytics and advertising cookies are only set with your consent, which you can give or decline through our cookie banner. For detailed information about the cookies we use and how to manage them, please see our Cookie Policy.

Changes to this policy

We may update this privacy policy from time to time. We will notify you of significant changes by email or through the platform. The "last updated" date at the top of this page indicates when the policy was last revised.

Complaints

If you have concerns about how we handle your data, please contact us first at [email protected]. You also have the right to lodge a complaint with the ICO:

Information Commissioner's Office
Website: ico.org.uk
Helpline: 0303 123 1113

Contact us

For any questions about this privacy policy or our data practices, please contact:

Email: [email protected]