Privacy Policy

This Privacy Policy explains how Fountains Fell Limited, trading as Willow, collects, uses, and protects your personal data when you use our website and services at withwillow.co.uk (the “Service”).

1. Who we are

The Service is operated by Fountains Fell Limited, a company registered in England and Wales (company number 17259959), trading as Willow.

• Registered office: Popes Head Court Offices, Peter Lane, York, YO1 8SU
• Contact for any privacy matter: support@withwillow.co.uk
• ICO registration number: [ICO REFERENCE NUMBER]

For the personal data described in this policy, Fountains Fell Limited is the data controller, except where we act on your behalf and under your authority to contact third parties (see section 7).

2. The data we collect

We collect only what we need to help you manage a loved one’s affairs.

Information you give us about yourself. When you create an account we collect your name, email address, and (optionally) your phone number and postal address. If you invite other people to collaborate on an estate, we collect the email addresses you provide for them.

Information about the person who has died.To build your checklist and, where you ask us to, to contact organisations on your behalf, we collect details about the deceased — their name, date of birth, date of death, address, and information about their circumstances (such as whether they were married, owned property, ran a business, or owned a vehicle).

Your checklist and case information. We store the answers you give to our questionnaire, which tasks you have completed, notes you add, and the list of organisations you need to notify, including account references and the status of each notification.

Documents you upload. Where you choose to use our notification service, you may upload sensitive documents such as a death certificate, a will, a grant of probate or letters of administration, identity documents, and proof of address. These are described more fully in section 5.

Delegation records. If you ask us to contact organisations on your behalf, we record the consent you give us, the version of the consent wording shown to you, and the date, time, your IP address, and browser information at the moment you gave it. We keep this so that we can demonstrate you authorised us to act.

Technical and usage information. Like most websites, we collect limited technical data automatically, such as your IP address, device and browser type, and how you use the Service. This is covered in our Cookie section (section 9).

We do not ask for or knowingly collect data from anyone under 18.

3. Why we use your data, and our lawful basis

Under UK data protection law we must have a lawful basis for using your personal data. Ours are set out below.

We use your data to provide the Service— creating your account, generating your personalised checklist, saving your progress, and letting you and any people you invite collaborate on an estate. Our lawful basis is the performance of our contract with you.

We use your data to carry out notifications on your behalf when you ask us to, including preparing and sending letters and emails to the organisations on your list. Our lawful basis is the performance of our contract with you, supported by your explicit consent for any special-category or sensitive information involved.

We use limited data to keep the Service secure, prevent fraud, and meet our legal obligations, and to understand and improve how the Service is used. Our lawful basis here is our legitimate interests in running a safe, reliable, and improving service, balanced against your rights, and compliance with our legal obligations where the law requires us to act.

Where we rely on consent— for example for non-essential cookies, or for processing special-category data — you can withdraw that consent at any time without affecting anything we did beforehand.

4. A note on data about people who have died

UK data protection law applies to living individuals, so information about the person who has died is not “personal data” in the same way your own information is. We nevertheless treat information about the deceased as confidential and protect it with the same security measures we apply to everything else. Where that information also reveals something about a living person — for example a surviving spouse named on a joint account — that living person’s data is protected by this policy in full.

5. Sensitive documents and special-category data

Some of what you share with us is especially sensitive — a death certificate, identity documents, or information that reveals health or family circumstances. Some of this is “special-category data” under UK law, which carries extra protection.

We only collect these documents where you actively choose to use our notification service and upload them yourself. We process them on the basis of your explicit consent, solely to carry out the notifications you have asked us to make. We store them in access-controlled storage protected by row-level security so that only you, the people you have authorised on your estate, and the Willow team member handling your case can reach them.

6. Who we share your data with

We do not sell your data, and we never will. We share it only in the following ways.

With organisations you ask us to contact.When you delegate notifications to us, we share the relevant details and documents with the banks, utilities, government bodies, and other organisations on your list — but only to the extent needed to notify them, and only because you have authorised us to do so on your behalf.

With the people you invite. If you add members or an adviser to an estate, they can see the case information and documents associated with that estate.

With service providers who help us run Willow. We use a small number of carefully chosen suppliers who process data on our behalf under contract, and only on our instructions:

• Supabase— our database, authentication, and document storage. Your data, including uploaded documents, is held in a United Kingdom data centre.
• Vercel— website hosting and delivery.
• Resend— sending transactional and notification emails.
• PostHog— product analytics, to understand how the Service is used.
• Google— advertising measurement (Google Ads) and, via Vercel, website analytics.

Where the law requires it. We may disclose data if compelled by law, a court order, or a regulator, or to establish, exercise, or defend legal claims.

On a business transfer. If Willow is ever sold or reorganised, your data may be transferred to the new owner, who would remain bound by this policy.

7. When we act on your behalf

A core part of Willow is contacting organisations foryou. When you use this service, you authorise us to act as your agent — we write to those organisations in your name, using the authority and documents you provide. We act on your instructions and under your authority, not on our own account. You remain in control: you decide which organisations we contact, and you can withdraw your authority at any time by contacting us, although we cannot undo notifications already sent.

8. International transfers

We have chosen suppliers and storage arrangements that keep your data in the United Kingdom wherever we can — your database records and uploaded documents are held in a UK data centre. Some of our service providers are international organisations that may process limited data (such as technical or analytics data) outside the UK. Where that happens, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, so that your data receives equivalent protection. You can ask us for details of these safeguards using the contact details above.

9. Cookies and analytics

We use cookies and similar technologies to make the Service work and to understand how it is used. Strictly necessary cookies — for example to keep you logged in — are always on, because the Service cannot function without them. Non-essential cookies, including those for product analytics (PostHog), website analytics (Vercel), and advertising measurement (Google Ads), are only set if you agree through our cookie banner. You can change your choices at any time through the cookie settings on the site or your browser controls.

10. How long we keep your data

We keep personal data only for as long as we need it, then delete it or anonymise it. Our standard periods are:

• Account and profile data— kept while your account is active and deleted within 30 days of you closing your account.
• Case, checklist, and notification data— kept for as long as you are administering the estate, and deleted on your request or after 12 months of account inactivity, whichever comes first.
• Death certificates, authority-to-act, and other uploaded documents — deleted within 90 days of completing the notifications you delegated to us, unless you ask us to keep them.
• Delegation consent records — kept for 7 years so that we can evidence the authority you gave us, then deleted.

Where the law requires us to keep certain records for longer, we will keep those records for the period required and no longer.

11. Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• correct data that is wrong or incomplete;
• erase your data in certain circumstances;
• restrict or object to how we use it;
• portability— receive your data in a usable format, or have it sent to another provider; and
• withdraw consent at any time where we rely on it.

To exercise any of these, email support@withwillow.co.uk. We will respond within one month. There is normally no charge.

If you are unhappy with how we have handled your data, you can complain to the UK regulator, the Information Commissioner’s Office (ICO), at ico.org.uk or on 0303 123 1113 — though we would always prefer the chance to put things right first.

12. How we protect your data

We protect your data with measures including row-level security on our database so users can only reach their own records, access controls on uploaded documents, encryption in transit, UK-based storage, and contractual obligations on every supplier who handles data for us. No system is perfectly secure, but we take this responsibility seriously and keep our measures under review.

13. Changes to this policy

We may update this policy from time to time. When we make material changes we will update the date at the top and, where appropriate, let you know by email or through the Service.

14. Contact us

For any question about this policy or your data, email support@withwillow.co.uk or write to:

Fountains Fell Limited (trading as Willow)
Popes Head Court Offices, Peter Lane, York, YO1 8SU

See also our Terms of Service.