Privacy Policy

1. Controller and contact

Controller: Africa Procurement Group Ltd, registered in England and Wales number 10553435, registered office Devonshire House, One Mayfair Place, London, England, W1J 8AJ.

Data protection contact: hello@careshieldcompliance.co.uk. We have not appointed a statutory Data Protection Officer; we are not a public authority and our core activities do not consist of large-scale monitoring or large-scale processing of special category data as controller. Responsibility sits with the director, Dr Washington Kapapiro.

2. What we collect, why, and on what basis

Our website analytics are first-party and cookieless. We do not use Google Analytics or any other advertising or analytics company: the measurements are recorded by our own servers, in our own database, and are never shared. We do not store your IP address, and we set nothing on your device for this purpose — no cookie, no local storage, no identifier of any kind.

To count a person rather than a page load, we derive a token from your IP address and browser description combined with a secret that changes every day, and store only the token. It cannot be reversed to an address, and because the secret changes at midnight the same visitor tomorrow is a new and unconnected token. We therefore cannot follow you between days, build a profile, or recognise a returning visitor — that is the deliberate cost of not tracking you. The page address is recorded; one-time links, such as a newsletter confirmation or unsubscribe link, are recorded only by their type and never with the token in them.

Where we rely on legitimate interests we have assessed the balance and recorded it. You may object; see section 7.

We do not seek special category data about you as a user of the Service. Health information belonging to the people your organisation supports may be entered into the Service by your organisation — we hold that as processor, not as controller, and it is governed by the Data Processing Agreement.

3. Where it comes from

• •From you, when you register, book a demonstration, contact us or use the Service.
• •From your employer, when they invite you as a staff user.
• •Automatically, from your device when you use the Service.
• •From you, when you subscribe to the Press Desk newsletter. That is a separate consent, held separately, and unsubscribing from it does not affect your account.
• •From public sources — a regulator's public register, a company website, Companies House, or a published directory — when we research an organisation that has contacted us, or that we intend to approach. Section 4 explains this.

4. If we contacted you first

We approach care organisations directly, by telephone, post and email, to tell them the Service exists. If we called or wrote to you and you have never heard of us, this section is the notice that UK GDPR Article 14 requires us to give you.

The absolute one is the right to object to direct marketing. There is no balancing test and we do not get to weigh it against our interests. Say stop, in any form, to anyone here, and we stop — permanently, across every channel, without asking why.

How to stop us: reply to any email, use the unsubscribe link, tell whoever calls you, or email hello@careshieldcompliance.co.uk. We action it within one working day and confirm it in writing.

On telephone calls specifically: we screen every number against the Telephone Preference Service and the Corporate Telephone Preference Service before dialling, as regulation 21 of the Privacy and Electronic Communications Regulations 2003 requires, and we screen again against our own do-not-call record. If you are registered with the CTPS and we called you anyway, that is our error — tell us and we will correct the record and tell you what went wrong.

We do not record telephone calls. Our staff keep a written note of what was discussed and what was agreed. If we ever begin recording, we will tell you at the start of the call and update this policy first.

On email specifically: regulation 22 of the same Regulations distinguishes between corporate subscribers — limited companies, limited liability partnerships and public bodies — and individual subscribers, which includes sole traders and unincorporated partnerships. We send marketing email only to corporate subscribers, and only where we hold evidence that the organisation is one: a company number, a corporate name, or a public body. An address we cannot evidence that way is held back and not mailed, even where we have it. Sole traders hear from us only if they have asked to.

Every marketing email we send to an organisation we contacted first carries this notice in its footer, with a one-click unsubscribe, and we record the date the first one was sent so we can show when you were told.

On measuring our email: we record whether a message we sent you was delivered, whether it was opened, and whether a link in it was clicked. An open is measured by a small image in the message, and a click by sending the link through our own server before it takes you on. We do this to know whether what we send is worth sending and to stop mailing addresses that never open anything — not to build a picture of you. We do not record what you do after you arrive on our site beyond the cookieless measurement described in section 3, we do not share this with anyone, and we do not use it to decide anything about you or your organisation. If you would rather not be measured this way, turn off images in your mail app or tell us to stop mailing you, in which case none of it is collected at all.

5. Who we share it with

We do not sell personal data and we do not share it for anyone else's marketing. We share it with the service providers listed in the Sub-processors document, each under a written contract restricting them to our instructions.

That list includes the providers of the large language models behind Care AI. Prompts and the account content needed to answer them are sent to those providers to generate a reply. We contract so that your content is not used to train their models and is not retained beyond what is needed to return the answer.

We also disclose where we are legally required to, and to professional advisers under a duty of confidence, and to a buyer if the business is sold — in which case you would be told.

6. How long we keep it

The full schedule, including the position on backups, is in the Data Retention and Deletion document.

7. Your rights

You have the right to be informed; of access; to rectification; to erasure; to restrict processing; to data portability; to object, including to direct marketing at any time; and not to be subject to certain solely automated decisions.

To exercise any of them, email hello@careshieldcompliance.co.uk. We will respond within one month. Where a request is complex or you have made several, we may extend by up to two further months and will tell you why within the first month. We may ask for proof of identity before acting.

If your organisation subscribes to Care Shield Compliance and your request concerns records held in their account — your acknowledgements, your training record, your supervision notes — the request is properly made to your employer, who controls that data. Tell us and we will point you to them and assist them in responding.

We do not make solely automated decisions producing legal or similarly significant effects about you. Care AI drafts and answers; it does not decide anything about you, and no human decision is taken on its output without a person reviewing it.

8. Complaints

Tell us first: hello@careshieldcompliance.co.uk. We will acknowledge within 30 days, keep you informed of progress, and tell you the outcome. That is what the Data (Use and Access) Act 2025 requires of us from 19 June 2026, and it is also simply how we want to handle it.

You may also complain to the Information Commissioner's Office at ico.org.uk, by telephone on 0303 123 1113, or in writing to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. You do not have to come to us first.

9. International transfers

Our infrastructure is hosted in the United Kingdom and the European Economic Area. Some of our providers, including the AI model providers, process limited data outside the UK. Where that happens we rely on UK adequacy regulations, or on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment. The Sub-processors document names each provider and where it processes.

10. Security

Encryption in transit and at rest, row-level access control in the database so one organisation cannot read another's records, least-privilege service credentials, session limits and idle timeout, rate limiting, automatic blocking of addresses and networks showing attack behaviour, logged administrative and support access, and monitored backups. The Security Statement describes the measures; the Security Incident and Breach Response document describes what happens when something goes wrong.

No system is perfectly secure and we do not claim otherwise. What we commit to is a defined set of controls, a tested restore, and honest and prompt notification.

11. Cookies

See the Cookie Policy. In short: the cookies that keep you signed in are strictly necessary and are always set. Statistical and appearance cookies are used under the exemptions introduced by the Data (Use and Access) Act 2025 and can be turned off. We set no advertising cookies.

12. Children

The Service is for care professionals and is not directed at children. We do not knowingly collect personal data from anyone under 18 as a user. Records about children supported by a subscribing organisation may be held in that organisation's account, where they are the controller.

13. Changes

We will post any change here with a new version number and date, and will tell you by email where the change is material.