Privacy policy

This Privacy Policy explains how Steadlo Ltd collects, uses, stores and shares personal information when you use our website, mobile applications and related services.

1. Who we are

Steadlo Ltd
Company number: 16587567
Registered office: Flat 401, Portland House, 102 Prince of Wales Road, Norwich, Norfolk, NR1 1NJ
Email: support@steadlo.com
Telephone: 01603 339390
ICO registration: ZC089449

Steadlo is generally the data controller for information used to operate its Platform, including accounts, verification, matching, subscriptions, bookings, payments, safeguarding and Platform administration.

2. Laws that apply

We process personal information in accordance with applicable UK data-protection law, including the UK GDPR and Data Protection Act 2018.

We also comply with applicable electronic communications and direct-marketing requirements.

3. Who this policy applies to

This policy applies to people who:

• visit our website;
• use our applications;
• create a Steadlo account;
• arrange support for themselves or another person;
• receive support arranged through Steadlo;
• register as a private support worker or Personal Assistant;
• use Steadlo through an employer, council, provider or other organisation;
• communicate through Steadlo;
• contact our support or safeguarding teams; or
• interact with our marketing.

4. Information we collect

Identity and contact information

This may include:

• name;
• address;
• email address;
• telephone number;
• date of birth where necessary;
• profile photograph; and
• account information.

Information about support needs

Where support is being arranged, we may process:

• type of support required;
• routines;
• mobility;
• medication-support requirements;
• communication needs;
• dietary requirements;
• health information;
• risks;
• accessibility requirements;
• preferred times;
• location;
• Identity and personal preferences;
• care plans;
• care notes; and
• information relevant to compatibility.

Private support worker information

We may collect:

• identity documents;
• right-to-work information;
• DBS information;
• Child and Adult Barred List information where the relevant check is legally permitted;
• references;
• training records;
• qualifications;
• work history;
• availability;
• experience;
• skills;
• profile information;
• insurance documents;
• insurance declarations;
• rates;
• payment information;
• attendance records;
• location information where applicable;
• reviews;
• complaints;
• incident information; and
• safeguarding information.

Direct Payment information

Where a person uses Direct Payments or another form of public funding, we may process information such as:

• confirmation that Direct Payments are being used;
• information required for billing or records;
• relevant council or funding-body information;
• authorised representatives; and
• other information necessary to administer the person's use of Steadlo.

Steadlo does not determine a worker's employment status on behalf of a Direct Payment recipient.

Organisation information

Where Steadlo is provided or funded through an employer, council, provider, NHS body or other organisation, we may process:

• organisation details;
• administrator details;
• account entitlements;
• billing information;
• subscription status; and
• information needed to administer access.

Communications

We may process:

• in-app messages;
• customer-support enquiries;
• complaints;
• safeguarding reports;
• incident reports;
• reviews; and
• other communications made through or about Steadlo.

Technical information

We may automatically collect:

• IP address;
• browser information;
• device information;
• operating system;
• application version;
• crash data;
• diagnostic information;
• Platform activity;
• pages or features used; and
• timestamps.

5. Location information

Steadlo may use location information for:

• finding nearby private support workers;
• matching;
• estimated arrival times;
• confirming arrival at a support location;
• recording the start of a visit;
• detecting possible lateness or missed visits; and
• supporting continuity and replacement functions.

6. Special-category information

Some information processed through Steadlo may reveal:

• health;
• disability;
• racial or ethnic origin;
• religion;
• sexual orientation; or
• other special-category information.

We process special-category information only where an appropriate Article 6 lawful basis and Article 9 condition apply.

Depending on the circumstances, this may include:

• explicit consent;
• vital interests where someone cannot provide consent;
• substantial public interest, including appropriate safeguarding circumstances; or
• another lawful condition permitted by UK legislation.

We seek to collect only information reasonably necessary to arrange appropriate support, protect people or operate the Platform.

7. DBS and criminal-offence information

DBS information and criminal-offence information receive additional legal protection.

Steadlo will only process this information where an appropriate Article 6 basis and applicable conditions under the Data Protection Act 2018 apply.

Enhanced DBS and Adult Barred List information will only be obtained at a level Steadlo is legally entitled to request for the relevant role.

Access to this information is restricted to people who require it for legitimate verification, compliance or safeguarding purposes.

Where required, Steadlo will maintain an Appropriate Policy Document covering this processing.

8. Why we use personal information

We use information to:

Operate Steadlo

• create and administer accounts;
• receive support requests;
• recommend private support workers;
• manage bookings;
• manage availability;
• enable communications;
• maintain care and visit records; and
• provide customer support.

Verify private support workers

We use information to:

• verify identity;
• verify right to work;
• complete or review DBS checks;
• verify references;
• check relevant training and qualifications;
• verify insurance; and
• maintain worker approval status.

Matching and continuity

We may use information about:

• support requirements;
• skills;
• availability;
• location;
• familiarity;
• preferences;
• compatibility;
• reliability; and
• Price.
• Interests

This helps Steadlo recommend appropriate workers or shifts.

User-directed replacement

Users may provide advance instructions telling Steadlo how to respond when a confirmed visit becomes at risk.

We may process support requirements, worker availability, preferences, familiarity, reliability, location and authorised price limits to carry out those instructions.

Where the user's settings permit automatic replacement, Steadlo uses those settings to carry out the user's prior instruction.

Payments and subscriptions

We may use information to:

• administer subscriptions;
• authorise booking payments;
• process worker payments;
• process cancellation payments;
• manage refunds and disputes;
• reconcile transactions; and
• maintain financial records.

Safeguarding

We may process information to:

• receive safeguarding concerns;
• assess risk;
• investigate incidents;
• protect people from harm;
• communicate with affected users;
• make or support safeguarding referrals;
• cooperate with local authorities;
• cooperate with police;
• cooperate with the Disclosure and Barring Service; and
• comply with other legal safeguarding responsibilities.

Safeguarding information may include sensitive personal information where necessary.

Improve Steadlo

We may analyse Platform activity to:

• understand how Steadlo is used;
• improve Platform features;
• improve matching;
• improve continuity;
• identify technical problems;
• improve safety; and
• develop new services.

Legal and compliance purposes

We may process information where necessary to:

• comply with legal obligations;
• prevent fraud;
• establish or defend legal claims;
• respond to regulators;
• respond to lawful requests; or
• protect Steadlo, its users or other people.

9. Our lawful bases

Depending on the processing activity, we may rely on:

Contract where processing is necessary to provide a service requested by you or take steps before entering into a contract.

Legal obligation where processing is required by law.

Legitimate interests where processing is reasonably necessary to operate, secure or improve Steadlo and those interests are not overridden by your rights.

Consent where appropriate.

Vital interests in limited circumstances where processing is necessary to protect someone's life.

Additional conditions apply to special-category and criminal-offence information.

10. Payments

Steadlo uses payment providers including Stripe.

Payment providers may process:

• card details;
• bank information;
• identity information;
• transaction information; and
• information required for fraud prevention or regulatory compliance.

Steadlo does not store full payment-card numbers.

We may retain:

• payment identifiers;
• amounts;
• authorisations;
• payment status;
• worker payment records;
• cancellation-payment records;
• refunds;
• invoices; and
• other transaction records.

11. Insurance

Approved private support workers must have an acceptable insurance cover.

Workers may provide qualifying personal insurance or, where eligible, use Steadlo's group insurance arrangement.

The group policy is arranged through Mark Bates Ltd, an FCA-regulated insurance broker.

Where a worker uses the group arrangement, Steadlo may share information reasonably required to establish, administer or verify insurance with:

• Mark Bates Ltd;
• the applicable insurer;
• relevant underwriters; and
• parties involved in administering a claim.

This may include:

• name;
• address;
• contact details;
• insurance declarations;
• work information;
• insurance status;
• incident information; and
• information connected to an insurance claim.

Those organisations may also process information under their own privacy notices and legal responsibilities.

12. Safeguarding information and disclosures

Where Steadlo receives a safeguarding concern, we may share relevant personal information with organisations where necessary and lawful.

These may include:

• local authority adult safeguarding teams;
• children's safeguarding services where relevant;
• police;
• emergency services;
• the Disclosure and Barring Service;
• the Care Quality Commission where relevant;
• insurers; and
• other organisations legally responsible for protecting a person from harm.

We will limit disclosures to information reasonably necessary for the safeguarding purpose.

Where appropriate, information may be disclosed without consent where the law permits or requires this, including where necessary to protect someone from serious harm.

13. Who else receives personal information

Other Steadlo users

Private support workers receive information reasonably necessary to understand and deliver a support request they are considering or have accepted.

People arranging support may see relevant information about private support workers, including:

• profile details;
• skills;
• experience;
• availability;
• rates;
• reviews; and
• verification status.

Employers, councils and organisations

Where access to Steadlo is purchased or funded by an employer, council or other organisation, Steadlo may share information necessary to administer the arrangement.

We will not give an employer access to an employee's detailed support needs, care notes or health information.

Councils may receive information where required to administer a Direct Payment, funded arrangement or other lawful purpose.

Technology suppliers

We use suppliers supporting functions such as:

• hosting;
• databases;
• applications;
• authentication;
• communications;
• analytics;
• email;
• payments;
• security; and
• software development.

These include Google Cloud (hosting, our database and stored documents, in London), Stripe (payments), Brevo (email), Ideal Postcodes and postcodes.io (finding addresses from a postcode), Apple and Google (notifications to phones), Cloudflare (our web address) and, only if you agree to marketing cookies, Meta (advertising).

Professional advisers

We may share appropriate information with:

• lawyers;
• accountants;
• auditors;
• insurers; and
• other professional advisers.

Regulators and public authorities

We may disclose information where required by law, court order, safeguarding responsibilities, regulatory requirements or legitimate law-enforcement requests.

Business transactions

Information may be disclosed as part of a genuine investment, financing, acquisition, merger, restructuring or sale process, subject to appropriate confidentiality and data-protection safeguards.

14. Reviews

Steadlo may process information relating to reviews submitted following Platform bookings.

We may also process information to:

• detect fake reviews;
• investigate manipulation;
• moderate content;
• handle challenges to moderation decisions; and
• comply with consumer-protection obligations.

Reviews may be displayed publicly or to other Steadlo users depending on the relevant Platform feature.

Users should not include health, confidential or sensitive information about another person in a public review.

15. We do not sell identifiable personal information

Steadlo does not sell identifiable personal information.

We may create anonymised or aggregated information that no longer identifies individuals.

This may be used for:

• service improvement;
• research;
• statistical analysis;
• capacity analysis;
• benchmarking;
• understanding patterns in care and support; and
• developing Steadlo's technology.

16. International transfers

Where personal information is transferred to a country without an applicable UK adequacy decision, Steadlo will use safeguards required by UK data-protection law.

These may include approved contractual protections and appropriate transfer-risk assessments.

17. Security

We use technical and organisational measures designed to protect personal information.

These may include:

• account authentication;
• access controls;
• restricted staff access;
• secure cloud infrastructure;
• logging;
• monitoring;
• encryption where appropriate;
• security reviews; and
• incident-response procedures.

Where a personal-data breach legally requires notification to affected individuals or the Information Commissioner's Office, we will make the required notification.

18. How long we keep information

We do not retain personal information longer than reasonably necessary.

Retention depends on the information and the purpose for which it is held.

For example:

• account information may be retained while an account remains active and for an appropriate period afterwards;
• transaction and contractual records may be retained for tax, accounting, dispute and legal purposes;
• care notes and visit records may be retained where necessary for continuity, safeguarding, complaints or legal claims;
• verification information will be retained only for as long as reasonably required;
• financial records may need to be retained for at least six years in some circumstances;
• safeguarding information may be retained for longer where necessary because of the seriousness or continuing relevance of a concern.

Where information is no longer required, it will be deleted or anonymised where appropriate.

19. Automated systems and recommendations

Steadlo may use automated systems to support:

• worker matching;
• worker ranking;
• continuity monitoring;
• detection of at-risk visits;
• replacement recommendations;
• fraud prevention; and
• safety monitoring.

These systems may consider:

• skills;
• availability;
• location;
• familiarity;
• preferences;
• compatibility;
• reliability; and
• price.

Where Steadlo automatically carries out a replacement, this is done under replacement instructions previously selected by the user in their settings.

Where applicable data-protection law provides additional rights concerning a solely automated decision producing legal or similarly significant effects, affected individuals may request human intervention, express their view and contest the decision.

20. Marketing

Service messages required to operate your account may include:

• booking notifications;
• verification messages;
• payment updates;
• safeguarding communications;
• security messages; and
• important Platform changes.

These are not marketing messages.

Where Steadlo sends electronic marketing, it does so in accordance with applicable UK privacy and electronic-marketing rules. Where consent is required, we will request it. Users can unsubscribe from marketing at any time.

21. Cookies and analytics

Steadlo uses cookies and similar technologies to:

• operate the website;
• maintain security;
• remember preferences;
• understand Platform use;
• measure performance; and
• measure marketing effectiveness.

Where consent is legally required, non-essential cookies will not be used until the appropriate consent has been provided.

Further information will be provided through Steadlo's Cookie Policy or cookie-management interface.

Our cookies, and your choices about them, are on Cookies on Steadlo.

22. Children's information

Steadlo accounts are intended to be managed by adults.

Where support is arranged for someone under 18, an adult with appropriate responsibility or authority must manage the relevant account and information.

23. Your data-protection rights

Depending on the circumstances, you may have rights including:

• access to your personal information;
• correction of inaccurate information;
• deletion in certain circumstances;
• restriction of processing;
• data portability in certain circumstances;
• objection to certain processing;
• objection to direct marketing;
• withdrawal of consent where processing relies on consent; and
• rights relating to certain automated decisions.

To exercise your rights, contact:

support@steadlo.com

We may need to verify your identity before acting on a request.

24. Complaints

If you have concerns about how Steadlo handles your personal information, please contact us.

You also have the right to complain to the Information Commissioner's Office.

25. Changes to this Privacy Policy

We may update this Privacy Policy when our services, technology, suppliers or legal obligations change.

The latest version will be published through Steadlo Ltd.

Where a material change affects how personal information is used, we will provide additional notice where appropriate.

26. Contact

For privacy questions or requests:

Steadlo Ltd
Email: support@steadlo.com
Telephone: 01603 339390