Data Processing Agreement

The care provider is the controller and Curelo is the processor of the personal data processed to provide the service (the "Data"). This DPA forms part of the agreement and satisfies Article 28(3) UK GDPR.

• Process the Data only on the controller's documented instructions, including as to international transfers, unless required by law (in which case we will inform the controller unless legally prohibited).
• Ensure persons authorised to process the Data are under confidentiality obligations.
• Implement appropriate technical and organisational measures (Article 32): encryption in transit and at rest, access control, multi-tenant isolation, audit logging, and tested backups.
• Engage sub-processors only under written terms imposing equivalent obligations, and maintain the sub-processor register; we will inform the controller of intended changes and allow objection.
• Assist the controller with data-subject rights, DPIAs, and consultation with the ICO, taking into account the nature of processing.
• Notify the controller without undue delay on becoming aware of a personal-data breach.
• At the controller's choice, delete or return the Data at the end of the service, save where storage is required by law.
• Make available information necessary to demonstrate compliance and allow for audits.

The Data is hosted in the UK/EEA. Any transfer to a third country is made only on the controller's instruction and subject to appropriate safeguards (adequacy or the IDTA / Article 46 mechanisms), as recorded in the sub-processor register.

• Subject matter: provision of care-home management software.
• Duration: the term of the agreement plus legally required retention.
• Nature & purpose: recording and managing residential care.
• Data subjects: residents, their representatives, and provider staff.
• Categories: identifying data, contact data, and special-category health data.