Privacy policy

FirstFlag is a product of Levity Leads Ltd, 85 Great Portland Street, London W1W 7LT, registered in England and Wales under company number 15957245 ("we", "us"). We are the data controller for personal data processed through this website and the FirstFlag service. You can reach us at rees.calder@levityleads.com.

When you contact us or subscribe we collect your name, work email address, firm name and billing details. When you use the site we collect standard technical data such as IP address, browser type and pages visited, via server logs and, where enabled, Google Analytics.

The FirstFlag service itself compiles information about care providers from public sources: the Care Quality Commission (published under the Open Government Licence v3) and Companies House. This includes the names and roles of company directors as published on the public register.

We use your data to provide and bill for the service, respond to enquiries, and send service updates. We do not sell personal data. We do not send marketing email without your consent. Our lawful bases are performance of a contract, legitimate interests (operating and improving a business intelligence service built on public records) and consent where required.

We use a small number of processors to run the service: hosting infrastructure, payment processing (Stripe) and analytics (Google Analytics, where enabled). Each processes data under its own agreement with us and only on our instructions. We may disclose data where the law requires it.

We keep account and billing data for as long as you hold a subscription and thereafter as required for tax and accounting purposes (normally six years). Enquiry correspondence is kept for up to two years. Public-register data is refreshed from source and holds no special retention period.

Under UK data protection law you can request access to, correction of, or deletion of your personal data, object to or restrict processing, and request portability. Write to rees.calder@levityleads.com and we will respond within one month. If you are unhappy with our handling you can complain to the Information Commissioner's Office (ico.org.uk).

The public site sets no cookies beyond those needed for analytics, where enabled. The internal dashboard sets a single session cookie for authentication. We do not use advertising cookies.

We will post any changes to this policy on this page and update the date above. This policy is governed by the law of England and Wales.