GDPR & Data Protection

Ferb is built for information that deserves care. Most of what passes through a shared folder — assessments, plans, reports, letters about a child — is personal data, and some of it is special category data about health or special educational needs.

We handle that information in line with the UK GDPR and the Data Protection Act 2018, and we expect everyone using Ferb to do the same.

Controller: for your account details, billing, website usage and support messages, Ferb decides how the data is used and is the data controller.

Processor: for the documents, notes and folder content added by a customer, that customer is the controller and Ferb processes the data only on their documented instructions — to store it, display it to the people they invite, and keep an access log.

If you need a data processing agreement for your school, practice or local authority, contact us and we will provide one.

Contract: to create your account, provide folders and sharing, and take payment for a paid plan.

Legitimate interests: to keep the service secure, prevent misuse, maintain audit logs, and improve the product. We balance these interests against your rights and never use folder content for marketing.

Legal obligation: to keep records we are required to keep, and to respond to lawful requests from public authorities or safeguarding bodies.

Consent: for anything optional that is not necessary to run the service, such as optional analytics cookies. You can withdraw consent at any time.

Health, disability and special educational needs information is special category data. It is added by the customer, under their responsibility and their lawful basis — typically a substantial public interest, a legal obligation in education or social care, or explicit consent.

We do not ask for this information, we do not analyse folder content, and we do not use it for any purpose beyond storing it, showing it to the people the owner invited, and keeping the access record.

Access: ask for a copy of the personal data we hold about you.

Correction: ask us to fix information that is wrong or incomplete.

Erasure: ask us to delete your data where we no longer need it and there is no legal reason to keep it.

Restriction and objection: ask us to pause or stop a particular use of your data.

Portability: ask for the data you gave us in a structured, machine-readable format.

To exercise any of these, email hello@ferb.app from the address linked to your account. We reply within one month. We may ask for proof of identity where necessary.

If your request concerns the content of a folder, the folder owner is the controller, so we will pass the request to them and support them in responding.

We use a small number of vetted providers for hosting, file storage, email delivery and error monitoring. They act on our instructions under written terms and are not permitted to use your data for their own purposes.

Data is primarily stored within the UK and the European Economic Area. Where a provider processes data outside that area, we rely on the UK International Data Transfer Addendum or Standard Contractual Clauses together with appropriate safeguards.

Folder content is kept until the folder owner deletes it or the account is closed. Account details are kept for the life of the account.

When an account is closed, active data is deleted and residual copies are removed from backups within a limited period. We keep the minimum records required for legal, tax and security purposes.

Access is by invitation, invitations are tied to a specific email address, shared folders are view-only for recipients, and folder owners can revoke access at any time.

Access events are logged so that an owner or administrator can see who viewed or downloaded a file. Connections are encrypted in transit.

If we become aware of a breach affecting personal data, we assess it without delay and notify affected customers and, where required, the Information Commissioner’s Office within 72 hours. We tell you what happened, what we have done, and what you may need to do.

If you are unhappy with how we have handled your information, please contact us first at hello@ferb.app so we can put it right.

You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.