PCS Privacy Information v1.2
Originally published: 18 September 2026 · Updated: 3 October 2026.
Data controller / service operator: Right First Time UK Ltd · Company No. 17493370.
PCS needs a limited set of account and family-case information to operate the pilot, provide the two-parent workflow, maintain records and protect access to each case.
Information PCS may hold
This can include account details, PCS access status, family-case identifiers, proposals and acceptances, contribution/payment ledger records, parent-to-parent messages, message categories and subjects, uploaded documents or images, file metadata and hashes, timestamps, login/security information and audit events created by the system.
If a parent uses the message safety-pause feature, PCS may also keep the family-case identifier, the user account that activated or lifted the pause, whether the pause is active and relevant timestamps. PCS does not require a parent to write a detailed allegation into the safety-pause record.
Why records are used
Records are used to operate the service, show each participating parent the current agreement and history, provide payment and communication records, investigate technical or security problems, protect case access and maintain an audit trail.
Who can see family-case information
Parent-to-parent case records are intended to be restricted to the two authorised users attached to that family case and appropriately authorised RFTUK administration where access is genuinely required for security, safeguarding, support, complaint handling or system administration.
One parent should not receive the other parent’s password, private account credentials or information unrelated to the shared family case.
Messages, attachments and safety pauses
Messages are timestamped and retained in chronological order. Uploaded files are stored in protected PCS storage and should only be served after login and case-access checks. The communication system records file metadata and a SHA-256 hash to help preserve the integrity of the uploaded record.
Where a safety pause is active, PCS stops new direct messages for that family case but keeps the existing message history available. The safety pause is a communication control; it is not a PCS finding about whether domestic abuse occurred.
Parents should avoid uploading unnecessary personal, medical, financial or third-party information. Only share what is reasonably relevant to the child or the PCS arrangement.
Protected contact and minimum necessary information
Where safety is a concern, PCS should avoid displaying a private address or contact detail to the other parent unless it is genuinely required for the service or there is another lawful reason to provide it. A parent should not upload another person’s private address, medical information or financial information merely because it is available.
When evidence is needed, use the minimum information that reasonably explains the issue. Redact unrelated account numbers, addresses or third-party details where appropriate before uploading.
Analytics and service usage
PCS uses first-party, privacy-minimised analytics to understand traffic, successful logins and which PCS pages or tools are being used. For public visits, PCS uses a daily rotating pseudonymous visitor identifier rather than storing the visitor's raw IP address in the analytics table.
When a parent is signed in, PCS may record the account ID, a safe page/tool label and the date/time. The analytics table does not copy message contents, agreement/evidence contents, form values, bank/card/payment details or arbitrary search/query text.
Analytics records are kept for up to 13 months unless RFTUK adopts a shorter period.
Record integrity and retention
PCS keeps records needed to operate the case and preserve its audit history. Sent parent messages are not designed to be edited or deleted by a parent after sending because doing so could make the chronology unreliable.
Retention periods and any later deletion/redaction process should be managed under RFTUK’s data-protection and records policies, taking account of the reason the record is held and any legal or safeguarding requirement.
Your information
If information held about you is inaccurate, you can ask RFTUK to review it. Requests concerning access, correction, privacy or a data-protection complaint should be handled through RFTUK’s published privacy/data-protection contact route.