Legal
Privacy policy
1. Who we are
Sendsorta Limited (“Sendsorta”, “we”, “us”) provides Forum by Sendsorta, an operating platform for Parent Carer Forums and similar organisations.
- Registered in England and Wales, company number 15313070
- Registered office: 71-75 Shelton Street, London, England, WC2H 9JQ
- Registered with the Information Commissioner’s Office, reference ZB651996
- Privacy contact: info@sendsorta.co.uk
2. Which parts of the service this policy covers
This matters, because we hold two different roles depending on the information involved.
Where we are the controller
We decide how and why information is used, and this policy applies, in respect of:
- this website, including the demo and the forum directory;
- people who register interest in a forum that is not yet set up;
- our customer relationships: account administration, billing, support and security.
Where we are the processor
Once a forum is set up on the platform, that organisation is the controller of everything inside its own workspace: its members, volunteers, meetings, evidence, finances and documents. We process that information only on its documented instructions, under a separate data processing agreement.
If you are a member of a Parent Carer Forum and want to know how your forum uses your information, ask your forum directly. Its own privacy notice governs how it handles your information.
3. Information we collect
3.1 When you browse this website
This website is cookie free, tracker free and free of third-party analytics. It leaves your device exactly as it found it, so there is no cookie banner here.
Our hosting provider processes standard server request data, including your IP address, in order to deliver pages and protect against abuse.
3.2 When you use the demo
The demo contains entirely fictional data. We record which role was being explored and which area was opened, for example “representative” and “opened finance”. We record the persona alone. Each record holds a role and an area, and that is the whole of it, so it stays unlinked to you.
3.3 When you register interest in a forum
If your local forum is listed but not yet set up, you can register interest. We collect your email address, the forum you chose, and any message you write.
Separately and optionally, we ask whether we may email you national SEND news while that forum remains unclaimed. This is a distinct yes-or-no choice with its own dated record. Declining does not affect your registration of interest, and consent is never bundled into or implied by it. If you withdraw your interest, or the forum is claimed and set up, you are removed from that mailing list before the next send.
Your registration of interest is not shared with the forum as a membership record if it is later claimed.
3.4 The forum directory
We list Parent Carer Forums in England using organisational information those forums already publish, such as the forum name, council area and published contact address. This is normally organisational information, though a published contact address can sometimes identify a person.
Our lawful basis is legitimate interests: helping parent carers find their local forum, and letting a forum claim and correct its own listing. If you are named in a listing and object, or the details are wrong, contact us and we will correct or remove it.
3.5 When you become a customer
For organisations that take out a subscription we hold contact details for the people who administer the account, billing and invoice records, correspondence and support requests, and security and audit metadata about significant account actions.
3.6 Information we deliberately do not collect
The platform does not hold identifiable information about children as structured data: no child names, dates of birth, schools, EHCP details or diagnoses. Membership records belong to the parent carer.
4. Why we use your information, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Deliver this website and keep it secure | Legitimate interests: operating and protecting our own site |
| Understand which parts of the demo are explored | Not personal data, as no identifier is stored with it |
| Record and act on your interest in a forum | Taking steps at your request, with a view to providing the service |
| Send national SEND news to people who asked for it | Consent, withdrawable at any time |
| Publish and maintain the forum directory | Legitimate interests: helping parents find their forum, with a route to object |
| Administer accounts, subscriptions and support | Performance of our contract with your organisation |
| Send essential service, security and billing messages | Performance of our contract, and legitimate interests in service security. These are not marketing. |
| Keep accounting and tax records | Legal obligation |
| Investigate misuse, incidents and security concerns | Legitimate interests in protecting the service and its users |
Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights. You can ask us for that assessment.
5. Marketing
We do not sell personal information, and we do not use it for behavioural advertising. We only send optional email where you have asked for it, and every such message includes a way to stop. Essential messages about your account, security or an invoice are not marketing and cannot be switched off while the account is active.
6. Who else is involved
We use a small number of providers to run the service. Each is bound by a contract restricting what it may do with the information.
| Provider | What it does |
|---|---|
| Supabase | Database hosting, authentication, private file storage and server-side functions, running on Amazon Web Services |
| Cloudflare | Website hosting and delivery |
| Resend | Essential authentication and invitation email |
| DeepSeek | Optional AI drafting, only where a customer has enabled it and an authorised person requests it. It is also the model behind the local offer question box in the member app, where it is sent the question and the council entries that matched it, and is told nothing about who asked |
| Google Firebase Cloud Messaging | Mobile push notifications, where enabled |
We may also share information with professional advisers, auditors and insurers where necessary, and with law enforcement or another public body where the law requires it.
Our current provider list, with locations and safeguards, is available from the privacy contact above.
7. Sending information outside the UK
Our primary hosting region is in the European Economic Area. Some providers, or their own support teams and subprocessors, may process information outside the UK.
Where information leaves the UK we rely on either UK adequacy regulations, or the International Data Transfer Agreement or Addendum approved under UK GDPR, together with a transfer risk assessment. You can ask us which applies to a particular provider.
8. How long we keep it
| Information | Kept for |
|---|---|
| Registration of interest in a forum | Until you withdraw it, or the forum is claimed and set up |
| Consent records for optional email | Six years after consent ends, as evidence that we handled it properly |
| Customer account and contact records | Duration of the subscription plus 12 months |
| Invoices and accounting records | Seven financial years, as required by law |
| Security and audit records | Seven years, and never edited |
| Support correspondence | 90 days after the request is closed |
| Backups | A rolling window, targeted at 30 days. Deletions work through as backups rotate. |
| Demo exploration records | Indefinitely, as they contain no personal data |
9. Your rights
Under UK data protection law you have the right to:
- be told how your information is used;
- get a copy of the information we hold about you;
- have inaccurate or incomplete information corrected;
- ask us to delete information;
- ask us to restrict how we use it;
- object to processing, including an absolute right to object to direct marketing;
- receive information you gave us in a portable format;
- withdraw consent at any time, without affecting anything done lawfully beforehand; and
- not be subject to a decision made purely by automated means that has a legal or similarly significant effect on you. We do not make such decisions.
These rights are not all absolute. We may need to keep an accounting or audit record the law requires us to hold. If we cannot do what you ask, we will explain why.
To exercise any right, email info@sendsorta.co.uk. We may need to verify your identity. We will respond within one month, and will tell you if we need longer because the request is complex.
If your request concerns information inside a forum’s own workspace, we will pass it to that forum, since it is the controller.
10. Complaints
Please tell us first if you are unhappy, so we can put it right. You also have the right to complain to the Information Commissioner’s Office at any time.
- ico.org.uk/make-a-complaint
- Helpline 0303 123 1113
- Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
11. How we protect information
Each organisation’s data is isolated from every other organisation’s and enforced in the database itself rather than only in the application. Access is governed by named permissions and scopes, files are held in private storage reached only through short-lived links, significant actions are written to an append-only audit trail, environments are kept separate, and recovery procedures are tested.
No internet service can promise zero risk. If a breach occurs and is likely to result in a risk to your rights, we will report it to the ICO within 72 hours where required, and tell you where the law obliges us to.
12. Children
This website and the platform are for adults acting for an organisation or registering as a parent carer. They are not directed at children, and we do not knowingly collect information from children. Tell us if you believe we have.
13. Changes to this policy
If we change this policy we will update the date at the top. Where a change is material we will make it visible in the service, or contact you where the nature of the change requires it. We will not quietly start using your information for a new and incompatible purpose.
14. Contact us
Email info@sendsorta.co.uk, or write to us at Sendsorta Limited, 71-75 Shelton Street, London, England, WC2H 9JQ.
See also our terms and conditions.