Privacy Policy

This policy explains how Activity Central collects and uses personal data when you use our website and subscription service. The data controller is Activity Central Ltd, a company registered in England and Wales (company number 17510590), whose registered office is 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.

We collect the following personal data:

• Account details — your name (or your care home's name), email address, whether you've registered as a personal or care-home account, and a password. Your password is stored as a one-way hash and is never stored or visible in plain text.
• Billing details — your Stripe customer and subscription IDs and subscription status (e.g. active, past due, cancelled). Card numbers and other payment details are never seen or stored by us — they're handled entirely by our payment processor, Stripe.
• Calendar entries — any events you add to your activity or professional calendar (date, title, time).
• Usage records — which activities you've downloaded and which you've marked as completed, so the service can show your download and completion history.
• Email list — if you tick the box to hear from us, your name, email address, the date you agreed and where you joined, so we can send news and offers. You can leave the list at any time.
• Files, links and questionnaires — files you upload to a shared link are stored so the link works. Answers to an online questionnaire are emailed to the care home that set it up and are not kept by us.
• Messages to us — what you write when you contact us through the support form or by email.

We use this data to run your account, provide the subscription and the activity library, process billing, and keep basic records of what's been used.

We process account, billing, and calendar data because it's necessary to perform our contract with you (providing the subscription you've signed up for). We process basic usage records (downloads and completions) on the basis of our legitimate interest in understanding how the library is used and keeping it useful, in a way that doesn't override your own rights and interests. We send news and offers by email to account holders and subscribers only if you have agreed (your consent), and you can withdraw that at any time. Emails to care home businesses are covered in section 6.

We keep your account data for as long as your account is active, and for a reasonable period afterwards in case you wish to reactivate it or as needed to meet our legal and accounting obligations. If you ask us to delete your account, we'll remove your personal data except where we're required to keep limited records (for example, billing records) for legal reasons. If you leave our email list we keep a note of that so we never email you again by mistake.

We share personal data with the following types of service providers, who process it on our behalf:

• Our payment processor (Stripe), to take subscription payments and manage billing.
• Our hosting provider (Vercel) and our database provider, to run the website and store account data securely.
• Our file storage provider (Vercel), to store files you upload to shared links.
• Our email provider (Resend), to send account emails, support replies and, if you agreed, news and offers.
• Our business email provider (Microsoft Outlook, supplied through GoDaddy), which carries our support mailbox and the personal emails we send to care home businesses.

We don't sell your personal data, and we don't share it with anyone for their own marketing purposes.

We may email care homes and care providers (limited companies and similar organisations) to tell them about Activity Central.

Whose details we use. We use general business contact details that organisations publish themselves, such as the contact email address on a care home's own website, and public registers such as the Care Quality Commission's directory of services. We don't use personal email addresses, and we don't send this kind of email to sole traders or partnerships.

What we send. A small number of personal emails, sent from our own business mailbox and not through an automated mailing service. Each one says who we are, where we found the contact details, and how to opt out. If we don't hear back, we may send one follow-up.

Why we're allowed to. Our legitimate interest in telling relevant businesses about a service that is relevant to their work (UK GDPR), together with the electronic marketing rules, which allow us to email the business addresses of companies. You can object at any time.

How to unsubscribe. Reply “stop” or “no thanks” to any of our emails, use our unsubscribe page at https://activitycentral.co.uk/stop, or write to support@activitycentral.co.uk. We'll stop straight away and keep your email address on a do-not-contact list so that we don't contact you again. We keep it only for that reason. If you have also signed up for our news and offers, each of those emails has an unsubscribe link.

We keep a business's contact details only for as long as we need them for this, and we keep opt-out requests so that we can honour them. To ask where we found your details, to have them removed, or to use any of your other rights, see “Your rights” below.

We use a small number of cookies to keep you signed in and to support secure payment. See our Cookie Policy for details.

Under UK GDPR, you have the right to:

• Access the personal data we hold about you.
• Ask us to correct inaccurate data.
• Ask us to delete your data, in certain circumstances.
• Ask us to provide your data in a portable format.
• Object to certain processing based on legitimate interest.
• Withdraw your consent to news and offers emails at any time, using the unsubscribe link in every email or the choice in My account.

To exercise any of these rights, contact us at support@activitycentral.co.uk. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk.

Activity Central is intended for use by care home staff and adults supporting people living with dementia. It is not intended for use by children, and we do not knowingly collect personal data from children.

Some of our hosting and infrastructure providers may process data on servers located outside the UK. Where this happens, we rely on providers who put appropriate safeguards in place to protect your data to a standard consistent with UK data protection law.

We may update this policy from time to time. We'll post any changes on this page with a new "last updated" date.

If you have questions about this policy or how we handle your data, contact us at support@activitycentral.co.uk.