Privacy notice

Who we are

KinMatch is a service operated by McTip IT Limited, trading as KinMatch, a company registered in England and Wales (company number 07291011). Our registered office is 2b Penn House, Broad Street, Hereford, HR4 9AP. For privacy questions or to exercise your rights, contact [email protected].

Our role: controller or processor

KinMatch does two different things, and our legal role differs for each. For our public fostering-recruitment service, our website, our marketing and our own staff, we decide how and why data is used, so we are the controller and this notice governs that processing. When a Local Authority or fostering agency uses our platform to record approved carers and information about children and to match them, the Local Authority or agency is the controller and we act as their processor, only on their instructions. If your question concerns a carer or a child, please contact the relevant Local Authority or agency, or contact us and we will help direct your request.

What we collect

• Fostering enquiries (we are the controller): name, email, phone, postcode and the message you send us.
• Staff platform users (we are the controller for account identity): name and email, managed through our authentication provider, plus audit logs of actions taken in the platform.
• Carers, households and children (we are the processor): handled on behalf of a Local Authority or agency. Carers and household members: name, date of birth, contact details, address, ethnicity, religion, first language, DBS status and certificate number, and terms of approval. Children: identified by an anonymised reference and initials only. We never store a child’s full name. We may hold date of birth, gender, ethnicity, religion, first language, support needs, legal status, an approximate location from the origin postcode, and an access-controlled care-plan summary.

Cookies and analytics

We use strictly necessary cookies to run and secure the site, including your sign-in session. These do not require consent. We also use analytics (Google Analytics, loaded through Google Tag Manager) to understand how the site is used, but only if you accept via our cookie banner. Analytics cookies are not set unless you consent, and you can change or withdraw your choice at any time using Cookie preferences.

Special category and criminal-offence data

Some data we handle is special category data (racial or ethnic origin, religion, and health or disability) or criminal-offence data (DBS checks). Most of this is processed in our processor role, where the Local Authority or agency is responsible for the lawful basis and condition and we follow their instructions. Where we act as controller we only process such data where we have an appropriate lawful condition. We treat this data with extra care.

Why we use your data (where we are the controller)

Where our basis is consent, you can withdraw it at any time by contacting [email protected]. For matching and placement data, the Local Authority or agency (as controller) determines the lawful basis.

How we use AI

To save time, our platform can use an AI service (the Anthropic Claude API) to read pasted or forwarded text, such as a referral email or a carer approval document, and pull out structured details. This happens on our servers. The AI provider does not use this data to train its models. Each organisation can turn AI extraction off. AI assists a person; it does not make decisions on its own.

Matching and automated decisions

Our matching engine suggests how suitable a carer may be for a child and gives a weighted score with clear, per-factor reasons. A qualified professional always makes the actual placement decision. We do not make solely-automated decisions that produce legal or similarly significant effects about you (UK GDPR Article 22). The score is decision support only.

Who we share data with

We do not sell your data. We share it only with the service providers that help us run KinMatch, and with the Local Authority or agency you are dealing with. Our providers are listed, with their locations, on our subprocessors page. We may also share data where legally required, or to protect the safety of a child or another person.

Where data lives, and international transfers

Our primary database is in the United Kingdom (DigitalOcean, London), with encryption in transit and at rest. To be clear and honest, some of our providers are based in the United States, so some personal data (sign-in, email and AI extraction) is transferred there. We are not a UK-only system. For these transfers we use appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment.

How long we keep data, and how we protect it

We keep data only as long as necessary for the purposes above and to meet our legal and safeguarding obligations. For data we process on behalf of a Local Authority or agency, we keep it in line with their retention policy and return or delete it at the end of our contract. We use role-based access control, keep each organisation’s data separated, log access and actions for audit, encrypt data in transit and at rest, and minimise children’s data by design (reference and initials only, never full names).

Your rights

You have the right to access the data we hold about you, ask us to correct or erase it (subject to our legal and safeguarding obligations), restrict or object to certain processing, data portability where applicable, and to withdraw consent where we rely on it. Where we are the controller, email [email protected]. Where your request concerns data we hold as a processor, we will pass it to the relevant Local Authority or agency. You can also complain to the Information Commissioner’s Office at ico.org.uk. We would ask that you contact us first so we can try to help.

Changes to this notice

We may update this notice. The “last updated” date at the top shows the latest version, and material changes will be posted on this page.