Privacy notice for OrCore Compliance

Last updated: 27 October 2026

This notice explains how OrCore Ltd uses personal data on OrCore Compliance (cqccompliance.orcore.org), the question tool that helps care providers write their CQC policies. It follows UK data protection law (UK GDPR and the Data Protection Act 2018).

It adds to the main OrCore privacy notice at orcore.org/privacy, which covers our other services.

Who we are

OrCore Ltd is the controller for the personal data described here. We are registered in England and Wales, company number 17520251.

Registered office: 82a James Carter Road, Mildenhall, Bury St. Edmunds, IP28 7DE.

ICO registration number: ZC275844.

Contact: athena@orcore.org

What we collect

Your interview answers. These are about your business: how it is set up and how it works. Some answers include the work names and work contact details of people in your business, such as your registered manager, nominated individual or complaints lead.

If you name colleagues, please let them know you've shared their work details with us.

Questions you type into this site, and messages you leave for us using "Contact a human", including any email address you give us so we can reply.

Your resume code, and the dates and times your interview was started, last saved and finished.

On your device: your browser's local storage keeps your interview link and resume code, so you can carry on where you left off on the same device.

Server logs: our web server records each visit, including your IP address, the page requested, the time and your browser type. We use these to keep the site secure and to slow down repeated failed attempts, for example at guessing resume codes. Our application also keeps a separate technical log of pages requested and browser type, without your IP address.

What we don't collect

We don't ask for information about the people you care for, or for anyone's health information. Please don't include it.

If the site spots obvious personal or health details in an interview answer, it warns you and asks you to check before saving. If it spots them in a question or message for us, it doesn't send it and asks you to write it again without those details.

This check only catches obvious cases, such as NHS numbers, National Insurance numbers, dates of birth or a named person with a diagnosis, so please take care with what you type.

We don't use analytics, advertising or tracking of any kind on this site.

Why we use it, and our lawful basis

To run your interview and prepare your draft policies: steps you ask us to take before entering into a contract with us.

People named in your answers: our legitimate interests, and yours, in preparing your policies.

To reply to your questions and messages: our legitimate interests in answering what you asked us.

To keep the site secure and limit misuse, using server logs and limits on repeated attempts: our legitimate interests in protecting the service and the people using it.

Who sees it

The OrCore team. Interviews, questions and messages are only visible on a password-protected page for OrCore staff.

Our hosting provider, which runs our server in the UK.

If you email us, your email is handled by our email provider, Google Workspace, as described in our main privacy notice.

Any companies we signpost you to only get your details if you contact them yourself.

We don't sell your data, we don't use it for marketing, and we don't make decisions about you by automated means. The site shows fixed questions and fixed answers written by the OrCore team.

We may also share data if the law requires it.

How long we keep it

Unfinished interviews: deleted twelve months after they were last saved.

Finished interviews and your draft policies: kept for six years after our work with you ends, as part of our business records.

Questions and messages: deleted twelve months after we reply, unless they lead to work with you.

Web server logs: deleted after about fifteen days. The application's technical log: deleted after ninety days.

Backup copies: we copy the site and its data before each update. We delete these copies by hand, and aim to do so within ninety days.

Logs are deleted automatically. Interviews, questions, messages and backups are deleted by the OrCore team by hand, so this can take up to a month after these dates.

Local storage on your device: it stays in your browser until you clear this site's data in your browser settings.

Your rights

You have the right to: get a copy of your personal data; correct it; have it deleted; restrict how we use it; object to our use of it based on legitimate interests; and, for data you gave us to take steps towards a contract, receive it in a reusable format.

To use any of these rights, email athena@orcore.org. Including your resume code helps us find your interview. It's free, and we reply in one month or less. Deletion requests are carried out by hand by the OrCore team.

Complaints

If you're unhappy with how we use your data, please tell us first at athena@orcore.org and we'll try to put it right.

You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.

Cookies and local storage

The interview sets no cookies. It uses one local storage entry in your browser to remember your interview link and resume code on this device. This is strictly necessary for carrying on where you left off, so it doesn't need your consent.

A cookie is only set for OrCore staff when they sign in to the staff page.

The site loads nothing from other companies, and has no analytics, advertising or tracking cookies.

Changes to this notice

If our practices change, we will update this notice and the date at the top.