Privacy Policy

1. Who we are

KORA is a product of SixByFive Ltd, a company registered in England and Wales. When we say “KORA”, “we”, “us” or “our” in this policy, we mean SixByFive Ltd operating the KORA platform at koraplatform.co.uk.

We take privacy seriously. KORA is used in settings that handle sensitive information about children and young people. We have designed our systems with that responsibility in mind.

2. What data we collect

Account and billing data

When you create an organisation on KORA, we collect your name, email address, organisation name, and billing information (handled by Stripe — we do not store card details ourselves).

Usage data

With your consent, we collect anonymised analytics via Google Analytics 4 to understand how people navigate our marketing site (koraplatform.co.uk). This data does not identify individuals and is not used in the KORA care platform.

Care platform data

Data entered into the KORA care platform (logs, records, young person profiles) is stored securely on UK-based servers. This data is owned by the care organisation and is processed by SixByFive Ltd as a data processor under your instructions.

Cookies

Our marketing site uses a single analytics cookie (set by Google Analytics) only when you consent. No tracking cookies are set without your explicit consent. Our consent preference is stored in your browser’s local storage.

3. How we use your data

• To create and manage your KORA account
• To process payments via Stripe
• To send transactional emails (password resets, purchase confirmations)
• To improve our marketing site using aggregated, anonymised analytics (with consent)
• To provide support when you contact us

We do not sell your data. We do not use care platform data for any purpose other than providing the KORA service to your organisation.

4. Who we share data with

We use a small number of trusted third-party processors:

• Stripe — payment processing (UK/EU data centres)
• Google Analytics — anonymised site usage (marketing site only, with consent)
• Mailcow / SMTP relay — transactional email delivery

All processors are bound by data processing agreements and comply with UK GDPR.

5. Data retention

Account data is retained for the duration of your subscription and for up to 12 months after cancellation. Care platform data is retained according to the schedule agreed with your organisation. You may request deletion at any time by contacting us.

6. Your rights

Under UK GDPR you have the right to access, correct, port, or delete your personal data; to object to processing; and to withdraw consent at any time. To exercise any of these rights, email us at privacy@koraplatform.co.uk.

You can withdraw analytics consent at any time by clicking “Decline” in the cookie banner or clearing your browser’s local storage.

7. Security

All data is transmitted over HTTPS. The care platform database is encrypted at rest. Access to production systems is restricted to authorised personnel and protected by strong authentication. We undergo regular security reviews.

8. Children’s data

The KORA care platform may be used to record information about children and young people in residential care. This data is entered by authorised care staff and is processed under the authority of the care organisation (the data controller). We process this data solely to provide the service and never use it for any other purpose.

9. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify account holders by email. The date at the top of this page always reflects when it was last updated.

10. Contact

Questions about this policy? Contact us at privacy@koraplatform.co.uk or write to: SixByFive Ltd, England.