About this trust centre
This page indexes the governance documentation Fishing 4 Flowers publishes about how it handles personal data.
Fishing 4 Flowers operates the Fishing 4 Flowers SEND platform, used by schools, academy trusts and local authorities. In that work it acts as a processor for pupil, family and staff data held in the platform, and as a controller for enquiries, business contacts and its own security records. The Privacy Notice sets out both roles and states which organisation is responsible for what.
Published documents
| Document | Version | What it covers |
|---|---|---|
| Privacy Notice | 1.3.0 | What personal data is collected and why, in both the controller and processor roles, and how a data subject exercises their rights. |
| Sub-processor Register | 1.12.0 | Every sub-processor engaged to deliver the platform, what each one does, where it holds data, and the notice given before a sub-processor changes. |
| Terms of Service | 1.1.0 | Who Fishing 4 Flowers is, what the platform does, the basis on which it is supplied, and what this page does and does not govern. |
Each document is published at a stable address and at a versioned one. The stable address always resolves to the current version; the versioned address is fixed and does not change once issued. A document cited in a school’s own records should cite the versioned address.
Documents issued on request
Schools, trusts and local authorities assessing the platform may request the Record of Processing Activities, the Data Protection by Design Statement, the Data Protection Risk Assessment, the Data Retention Policy, the Exit Plan and the Information Security Policy. These are issued to a named contact at the requesting organisation rather than published, because they describe controls in enough detail to be useful to an attacker.
Requests go to Patrick Shone at pat@fishing4flowers.com.
Sub-processors and change notice
The Sub-processor Register lists every sub-processor engaged to deliver the platform, what each one does, and the country in which it holds data. Controllers are given 30 days’ notice before a new sub-processor is engaged, and may object within that period under the data processing agreement.
Hosting and data location
| Item | Detail |
|---|---|
| Hosting provider | Laravel Cloud (on AWS) |
| Region | UK — eu-west-2 (London) |
| Authentication | Single sign-on only in production, via the school’s own identity provider |
| AI model | Anthropic Claude Sonnet 4.6 |
| AI provider | Amazon Bedrock (UK — eu-west-2) |
| AI training on customer data | Not used to train models |
The Privacy Notice and the Sub-processor Register state the position in full, including the retention periods that apply to each category of data.
Contact
| Item | Detail |
|---|---|
| Organisation | Fishing 4 Flowers Limited |
| Registered office | The Mill House, Salisbury Road, Steeple Langford, Salisbury, SP3 4NQ |
| Company number | 17024439 |
| ICO registration | ZC147128 |
| Data Protection Officer | Patrick Shone — pat@fishing4flowers.com |
A data subject whose personal data is held in the platform on behalf of a school should contact that school’s data protection officer in the first instance. Section 8 of the Privacy Notice explains why, and what Fishing 4 Flowers does to assist.
Changes to this page
This page is reviewed at least annually, and whenever a document is added to or withdrawn from the published set.
| Version | Date | Change |
|---|---|---|
| 1.1.0 | August 2026 | The model performing plan generation is named in the hosting and data location table. |
| 1.0.0 | August 2026 | First issue. |
Fishing 4 Flowers Limited · Company number 17024439 · ICO registration ZC147128 Data Protection Officer: Patrick Shone — pat@fishing4flowers.com