Privacy policy

This policy explains what personal data FittonMillett Ltd collects, why, what we do with it and what your rights are. It is written in plain English on purpose. If anything is unclear, email hello@fittonmillett.com.

1. Who we are

FittonMillett Ltd, trading as FittonMillett Consultants (FMC), is a private limited company registered in England and Wales, company number 15226381. Registered office: Unit C Piccadilly Business Centre, Aldow Enterprise Park, Blackett Street, Manchester M12 6AE.

We are registered with the Information Commissioner's Office (ICO). Registration number: ZB702474.

We do not have a data protection officer and are not required to appoint one. Matt Fitton, Director, is responsible for data protection. Contact for anything in this policy: hello@fittonmillett.com.

2. When this policy applies, and when it does not

We are the data controller for the personal data of:

• Visitors to fittonmillett.com
• People who contact us, download a resource, book a call or use a tool on our site
• Prospective clients and the people we speak to at them
• Clients and their staff, in relation to our relationship and the services we provide
• People who buy the Recruitment Health Check and Blueprint
• People who buy a masterclass ticket or attend a masterclass
• People named by a buyer as having recommended us
• Suppliers and partners
• People who give us a testimonial or quote

This policy covers that data.

This policy does not cover candidate, applicant or staff data held inside an applicant tracking system or portal that we build or support for a client. For that data the client is the controller and we are a processor acting on their instructions under a written data processing agreement. If you have applied for a job with a care provider that uses a system we built, the care provider's own privacy notice tells you how your data is handled. If you send us a request about that data, we will pass it to the client.

3. The data we collect and where it comes from

Data you give us:

• Contact details: name, email address, phone number, job title, organisation name
• Enquiry details: what you tell us about your organisation, your recruitment and what you need, whether in a form, an email, a message or a call
• Information entered into our tools, such as the recruitment cost calculator, where the tool sends it to us
• Purchase details: name, email address and payment confirmation passed to us by Stripe. We never see or hold your card number
• Health Check and Blueprint details: the access code we issue you and the email address it was sent to, and when you submit the Health Check, your name, email address, organisation, newsletter choice, your score for each of the nine stages and your total score. We do not receive your individual answers or the plan generated for you
• Masterclass details: the name and email address of each ticket holder, the ticket type, and, if you choose to answer, who recommended you and your answer to the follow-up email question
• Contract details: information in agreements you sign with us through PandaDoc
• Anything you share with us during an engagement
• Messages: if you are a 90-Day Reset or Recruitment Lead Programme client, the messages you send us by WhatsApp between sessions. We use WhatsApp Business on our work phone. Messages are end-to-end encrypted. Please do not send staff or candidate names by WhatsApp.
• Testimonials: your words, the name, job title and organisation you choose to show, or none if you choose to be anonymous, and a record of your permission and the date you gave it

Data we collect automatically:

• Technical data from our hosting provider, such as IP address and request logs, which are needed to serve the site and protect it
• Cookies that keep you signed in to the Health Check and Blueprint tool, or the 90-Day Reset workbook if you are a Reset client, for 7 days after you sign in, and cookies that keep you signed in to the masterclass workbook if you hold a masterclass ticket, for up to 7 days after you sign in and never beyond the date your access to that masterclass ends. If your browser has saved your access code, it is sent back to us when you return so we can check it is still valid. The masterclass workbook and the 90-Day Reset workbook also set a cookie that holds a key linking your browser to the progress saved on your device. It does not contain your workbook entries, which stay in your browser.
• Website usage data through Google Analytics 4, only if you click Accept on the cookie banner: pages visited, time on page, approximate location by region, device and browser type, and how you reached the site. No Google Analytics code loads until you accept

Data from other sources:

• Publicly available business information, for example from your organisation's website, the CQC or Ofsted register, Companies House or LinkedIn, when we research a prospective client or prepare for a call
• Introductions from referral partners, who pass on your name and contact details with your knowledge
• Recommendations: when a masterclass buyer tells us who recommended us, we receive that person's name from the buyer, not from the person themselves

We do not deliberately collect special category data about you. If you share something sensitive with us in the course of an engagement, we hold it only as long as needed for that engagement.

4. What we use your data for and our legal basis

Responding to enquiries and providing quotes. Legal basis: taking steps at your request before entering a contract.

Delivering services and products you have bought, including the Health Check and Blueprint, diagnostics, mentoring programmes and system builds. Legal basis: performance of a contract.

Managing our relationship with you: invoicing, payment, account queries, onboarding and support. Legal basis: performance of a contract, and legitimate interests in running our business.

Recording and transcribing our own sales and discovery calls, as described in section 5. Legal basis: legitimate interests in keeping an accurate record of what was discussed and agreed. You can object at the start of any call.

Researching and contacting prospective clients in the care sector. Legal basis: legitimate interests in marketing our services to businesses that may benefit from them, balanced against your interests. We only do this business to business.

Thanking people who recommended us, including sometimes posting them a small gift. Legal basis: legitimate interests in thanking people who recommend our work. If you were named and would rather we did not contact you, tell us and we will delete your details.

Sending you information about our services, content and offers where you have asked for it or where we have a business relationship with you. Legal basis: consent where you sign up, or legitimate interests where you are an existing client or have enquired about a similar service. You can opt out at any time.

Publishing testimonials and quotes on our website, in social media posts and in promotional lines. Legal basis: consent. You can withdraw it at any time by emailing hello@fittonmillett.com. We will take it off our website and delete our own posts that use it. We cannot remove copies other people have shared.

Understanding how our website is used so we can improve it. Legal basis: consent, given through the cookie banner. You can withdraw it at any time using the Cookie settings link in the site footer.

Understanding how care providers score across the nine stages of the Health Check so we can improve the product. Legal basis: legitimate interests. We use aggregated scores for this and do not single out any organisation.

Keeping accounting, tax and company records. Legal basis: legal obligation.

Protecting our business, establishing or defending legal claims, and keeping our systems secure. Legal basis: legitimate interests and, where relevant, legal obligation.

Improving our products and services using what we learn from engagements. Legal basis: legitimate interests. We use anonymised or aggregated information for this wherever possible.

5. Call recording

We record and transcribe our own sales and discovery calls on video using Fathom. We do this so that we have an accurate record of what was discussed and agreed.

We never record or transcribe calls where we deliver a service to a client. That includes system build, support and retainer calls, Recruitment Diagnostic calls, and sessions on our mentoring programmes, the 90-Day Reset and the Recruitment Lead Programme.

You will be told at the start of a sales or discovery call that it is being recorded. If you do not want to be recorded, say so and we will stop the recording and take written notes instead.

Recordings and transcripts are kept for 12 months from the date of the call and then deleted, unless we need to keep a specific recording longer to deal with a dispute or a legal requirement.

Masterclasses. We record our live online masterclasses. The recording captures what is shown and heard, including the voice, video, display name and possibly chat messages of anyone attending live with their camera or microphone on. It is shared with every ticket holder for that masterclass until their access ends. Attendees are told in the joining email and at the start of the session. To stay off the recording, keep your camera and microphone off and use a display name you are comfortable with. Legal basis: legitimate interests in delivering the recording that each ticket includes.

6. AI tools

We use AI tools, including Claude by Anthropic, to help draft documents, summarise notes and prepare work. Where personal data is involved we keep it to the minimum needed for the task. We do not use AI tools to make decisions about you that have legal or similarly significant effects, and we do not allow our data to be used to train these providers' models where the provider offers that choice.

7. Who we share your data with

We do not sell personal data. We do not share it with advertisers.

We share data with service providers who process it on our behalf under contract and on our instructions. At the date of this policy these are:

• Microsoft 365: email, calendar, document storage and video calls
• Airtable: our client and contact records
• Make.com: automation that moves data between the systems above, for example from a website form into our records
• Netlify: hosting for this website
• Google Analytics 4: website usage statistics, only with your consent
• Stripe: card payments
• PandaDoc: contracts and e-signature
• Fantastical: call booking
• Fathom: recording and transcription of our sales and discovery calls
• Anthropic: AI tools as described in section 6

For clients whose applicant tracking system we build or support, the providers involved in that system, where they process data and the safeguards in place are listed in the client's data processing agreement.

We may also share data with our accountant, insurers, professional advisers, banks and payment providers where needed to run the business, and with regulators, courts or law enforcement where the law requires it.

If we sell or transfer the business, personal data may pass to the new owner under the same protections.

8. Where your data is processed

We are based in the United Kingdom and most of our processing happens here or in the European Economic Area.

Some of our providers process data in the United States or elsewhere outside the UK. Where they do, the transfer is covered by one of the safeguards recognised under UK law: the UK's International Data Transfer Agreement or Addendum, or the UK extension to the EU-US Data Privacy Framework where the provider is certified. You can ask us which safeguard applies to any provider.

9. How long we keep your data

We keep personal data only for as long as we need it for the purpose we collected it, and then delete or anonymise it. Our standard periods are:

• Enquiries that do not become a client: 12 months from last contact
• Client records, contracts, correspondence and project files: 6 years from the end of the engagement
• Accounting, invoicing and tax records: 6 years from the end of the financial year they relate to, as required by law
• Health Check and Blueprint purchases and submissions: 6 years, as client and accounting records
• Call recordings and transcripts: 12 months from the date of the call
• Names of people who recommended us: 12 months from the date we receive them
• Masterclass recordings: deleted from our Microsoft 365 storage when ticket holders' access to that masterclass ends. Each masterclass's ticket terms give its access end date.
• Website analytics cookies: up to 2 years, as set out in our Cookie policy. Clicking Reject in Cookie settings deletes them
• Marketing contacts: until you unsubscribe or we have had no engagement from you for 24 months
• Testimonials: shown until you withdraw your permission or we stop using them. We keep the record of your permission for 12 months after we stop using your quote, so we can answer any question about it.

Where you are a client and we hold candidate or staff data on your behalf in a system we built, deletion of that data is governed by your data processing agreement, not by this policy.

10. How we keep your data secure

We use established, reputable providers with their own security certifications, protect our accounts with strong passwords and multi-factor authentication, limit access to a need-to-know basis, and keep the number of places data is stored to a minimum. As a sole-director business, access to your data is limited to Matt Fitton and the providers listed above.

No system is completely secure. If we become aware of a breach affecting your data, we will assess it and, where required, report it to the ICO within 72 hours and tell you without undue delay.

11. Your rights

Under UK data protection law you have the right to:

• Access: ask for a copy of the personal data we hold about you
• Rectification: ask us to correct data that is wrong or incomplete
• Erasure: ask us to delete your data in certain circumstances
• Restriction: ask us to limit how we use your data in certain circumstances
• Portability: receive data you gave us in a structured, machine readable format where we process it on the basis of consent or contract
• Objection: object to processing based on legitimate interests, including call recording and business to business marketing
• Withdraw consent: where we rely on consent, withdraw it at any time. This does not affect processing that happened before you withdrew it

To exercise any of these rights, email hello@fittonmillett.com. We will respond within one calendar month. We may ask you to confirm your identity first. There is normally no charge.

If your request concerns data held in a client's applicant tracking system, we will pass it to that client, who is the controller.

If you are unhappy with how we have handled your data or your request, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to resolve it first.

12. Marketing

We market our services to care providers and the people who run them. We may contact you at a business email address or phone number where we reasonably believe our services are relevant to your role. Every marketing email we send includes a way to opt out, and you can also opt out at any time by emailing hello@fittonmillett.com. We will action that promptly and keep a record of it so we do not contact you again.

We do not use your data for targeted advertising on other platforms.

13. Cookies

Our website uses essential cookies to work, and analytics cookies only if you accept them through the cookie banner. Our Cookie policy at fittonmillett.com/cookies explains which cookies we use, what they do, how long they last and how to change your choice.

14. Children

Our website and services are for businesses and the adults who run them. We do not knowingly collect personal data from anyone under 18. If you believe we have, tell us and we will delete it.

15. Changes to this policy

We may update this policy from time to time. The current version is always published at fittonmillett.com/privacy with the date it was last updated. We will tell active clients by email about any change that materially affects how we use their data.

16. Contact

Questions, requests or concerns about this policy or your data: hello@fittonmillett.com

FittonMillett Ltd, Unit C Piccadilly Business Centre, Aldow Enterprise Park, Blackett Street, Manchester M12 6AE