About this notice
This notice explains what Fishing 4 Flowers Limited does with personal data.
Fishing 4 Flowers operates a special educational needs management platform used by schools, academy trusts and local authorities. That means it handles personal data in two distinct roles, and the difference determines who is responsible and who to contact.
| Role | What it covers | Who is responsible |
|---|---|---|
| Processor | Pupil, family and school staff data held in the platform | The school, trust or local authority — the controller |
| Controller | Website visitors, enquiries, business contacts, and Fishing 4 Flowers’s own security records | Fishing 4 Flowers |
Sections 2 to 7 describe the processing for which Fishing 4 Flowers is the controller. Section 8 describes the processor role and directs data subjects to the right organisation.
1. Who we are
| Item | Detail |
|---|---|
| Organisation | Fishing 4 Flowers Limited |
| Registered office | The Mill House, Salisbury Road, Steeple Langford, Salisbury, SP3 4NQ |
| Company number | 17024439 |
| ICO registration | ZC147128 |
| Data Protection Officer | Patrick Shone — pat@fishing4flowers.com |
2. Personal data collected, and why
2.1 Enquiries
| Item | Detail |
|---|---|
| Data | Name, email address, and any message or organisation supplied |
| Source | Provided directly by the individual, by email or through a contact route on fishing4flowers.com |
| Purpose | Responding to the enquiry and, where requested, sending product updates |
| Lawful basis | Consent for product updates. Legitimate interests for responding to an enquiry: the individual asked to be contacted |
| Retention | 24 months from the last contact, after which the record is deleted. Where the individual has consented to product updates, their contact details are kept until that consent is withdrawn |
2.2 Prospective and current customer contacts
| Item | Detail |
|---|---|
| Data | Name, work email address, telephone number, job role, employing organisation |
| Source | Provided directly, or obtained from the organisation’s own published contact information |
| Purpose | Contracting, service correspondence, due diligence, support, and account administration |
| Lawful basis | Contract, where the individual is a party or acts for a party. Legitimate interests otherwise: operating a business relationship with the organisation employing them |
| Retention | For the duration of the relationship, and afterwards for the period required for contractual and limitation purposes |
2.3 Records of security incidents
| Item | Detail |
|---|---|
| Data | Records of personal data breaches and security incidents, which may name individuals affected or involved |
| Source | Generated by Fishing 4 Flowers in the course of managing an incident |
| Purpose | Accountability under Article 5(2) and Article 33(5), which require every breach to be documented, including breaches assessed as not notifiable |
| Lawful basis | Legal obligation |
| Retention | six years from closure of the incident |
Where an incident concerns data held on a school’s behalf, Fishing 4 Flowers acts as processor for the underlying data and the school is notified. The incident record itself is maintained by Fishing 4 Flowers for its own accountability.
2.4 Cookies and similar technologies
The platform sets cookies that are strictly necessary to sign a user in, keep the session secure against cross-site request forgery, and protect the service against automated abuse. These do not require consent. It also stores display preferences that a user has actively chosen, such as light or dark appearance, on that user’s own device.
Fishing 4 Flowers uses two service providers that receive technical data from the platform. Both process it in the European Economic Area, and neither is used for advertising or for any purpose of their own.
| Service | What it receives | Stored on the device |
|---|---|---|
| Error and performance monitoring | Diagnostic details of an error, and for a signed-in user an internal account number. No name or email address. No session recording | Nothing |
| Product analytics | Page addresses visited, and for a signed-in user an internal account number. No name or email address. No session recording, and no automatic capture of what a user clicks or types | An identifier, so that repeat visits can be recognised |
The identifier stored by the product analytics service is not strictly necessary, and Fishing 4 Flowers does not currently ask for consent before it is set. Work to remove it, so that the service operates without storing anything on the device, is in progress. This notice will be updated when that change is released.
Neither service receives pupil records. Addresses of pages within the platform may contain internal record numbers, and are transmitted to both services as part of ordinary diagnostic and page-view data.
2.5 What is not collected
Fishing 4 Flowers does not use personal data for advertising, does not sell or share personal data for marketing by others, and does not build profiles of website visitors. Personal data held on behalf of schools is never used for Fishing 4 Flowers’s own purposes, including product development or the training of artificial intelligence models.
3. Automated decision-making
Fishing 4 Flowers does not make decisions about any individual by automated means, and does not carry out profiling that produces legal or similarly significant effects.
The platform uses a large language model to generate draft support plans for pupils. Those drafts are reviewed and actively finalised by school staff before they are relied upon, so the decision is made by a person. That processing is carried out on the school’s instruction; the school is the controller and describes it in its own privacy information.
4. Who personal data is shared with
Personal data is shared with service providers engaged by Fishing 4 Flowers. Each is engaged under the provider’s data processing terms, which permit it to act only on Fishing 4 Flowers’s instructions and impose obligations no less protective than those Fishing 4 Flowers owes to a controller. The current list, with the role, location and transfer basis of each, is maintained in the Sub-processor Register, published alongside this notice, which also records the position on evidencing those terms.
Personal data is also disclosed where the law requires it, or to professional advisers under a duty of confidence.
5. Where personal data is held
Platform data is hosted on Laravel Cloud (on AWS), UK — eu-west-2 (London). Artificial intelligence inference is performed by Anthropic Claude Sonnet 4.6, served via Amazon Bedrock, UK — eu-west-2.
No transfer of pupil data outside the United Kingdom is required. Service providers located outside the United Kingdom are in the European Economic Area and are relied upon under adequacy regulations.
6. Your rights
Individuals have the right to:
- be informed about how their personal data is used, which is the purpose of this notice
- request a copy of the personal data held about them
- have inaccurate personal data corrected
- request erasure of personal data in certain circumstances
- restrict processing in certain circumstances
- receive their personal data in a portable format where processing is based on consent or contract and is automated
- object to processing based on legitimate interests
- withdraw consent at any time, where processing is based on consent, without affecting processing carried out before withdrawal
There is no charge for exercising these rights in ordinary circumstances, and a request is answered within one month.
To exercise a right, or to raise a concern, contact the Data Protection Officer: Patrick Shone, pat@fishing4flowers.com.
Anyone dissatisfied with how Fishing 4 Flowers has handled their personal data may complain to the Information Commissioner’s Office at ico.org.uk, or by telephone on 0303 123 1113. Raising a matter with Fishing 4 Flowers first is welcomed but is not a precondition.
7. Whether providing personal data is required
Providing personal data is not a statutory requirement. Where personal data is needed to enter into or perform a contract, or to answer an enquiry, that is stated at the point of collection; without it Fishing 4 Flowers may be unable to provide the service or respond.
8. Personal data held on behalf of schools
Most of the personal data Fishing 4 Flowers handles — pupil records, family contact details, school staff records — is processed on the instructions of the school, academy trust or local authority, which remains the controller.
The categories held are set out below. Much of this data is special category data under Article 9 UK GDPR, and most of it concerns children. It is listed here so that anyone reading this notice can see what the platform holds, even though the school, and not Fishing 4 Flowers, decides what is collected and is responsible for explaining it to pupils and families.
| Category | Special category / children |
|---|---|
| Pupil identity | Children |
| SEN and SEND profile | Special category (health/disability) + children |
| Individual Support Plans | Special category + children |
| Targets, interventions and reviews, in free text and frequently health-related | Special category (health) + children |
| Document extracts | Special category (health) + children |
| SEND cost ledger | Children (financial) |
| Contacts | Adults linked to SEND children |
| Staff and employee records | Adults |
| User accounts | Adults |
| Evidence document references | Special category (health) + children |
| Exam access arrangement records (JCQ) | Children (implies access need) |
| Operational metadata | Organisational |
The Record of Processing Activities describes each category in full, with its source, purpose and retention, and is available from pat@fishing4flowers.com.
For that data:
- The school decides what is collected, why, and for how long it is kept.
- The school provides the privacy information owed to pupils and families, and Fishing 4 Flowers supplies content and tooling to support it.
- Requests to access, correct or erase pupil data should be made to the school, not to Fishing 4 Flowers. Fishing 4 Flowers assists the school in answering them.
- Fishing 4 Flowers processes that data only as instructed, under a data processing agreement made under Article 28 UK GDPR.
Parents, carers and pupils should contact their school’s data protection officer in the first instance. Where a school asks Fishing 4 Flowers to assist, it will.
Schools and trusts assessing the platform may request the Record of Processing Activities, the Data Protection by Design Statement, the Data Protection Risk Assessment, the Sub-processor Register and the Information Security Policy from pat@fishing4flowers.com.
9. Changes to this notice
This notice is reviewed at least annually, and on any change to the personal data collected, the purposes, the service providers used, or the locations in which data is held. The version and date are shown at the head of the document, and material changes are recorded below.
| Version | Date | Change |
|---|---|---|
| 1.3.0 | August 2026 | The categories table gains document extracts — the text read from an evidence document, held encrypted under the pupil’s key. The model performing plan generation is named at section 9 rather than referred to only by the service that serves it. |
| 1.2.0 | August 2026 | Section 4 no longer states flatly that every service provider is bound by a written contract. The Sub-processor Register records that the executed references are still being compiled, and this notice now matches that position rather than asserting more than the register evidences. |
| 1.1.0 | August 2026 | Section 8 now lists the categories of personal data held on a school’s behalf, and states that much of it is special category data concerning children. |
| 1.0.0 | August 2026 | First issue. |
Fishing 4 Flowers Limited · Company number 17024439 · ICO registration ZC147128 Data Protection Officer: Patrick Shone — pat@fishing4flowers.com