Data Processing Agreement

This agreement forms part of the Terms of Service and meets the requirements of Article 28 of the UK GDPR.

1. Roles

The agency is the controller. CarerLink is the processor and processes personal data only on the agency's documented instructions — that is, to provide the service.

2. Subject matter and duration

Processing of staff compliance records for as long as the agency has an account, plus any retention period it sets, then deletion.

3. Types of data and data subjects

Data subjects: the agency's applicants, employees, bank and agency workers, and volunteers. Data: identity and contact details, employment details, training and supervision records, right to work and DBS reference details, health-related absence information, disciplinary records, and uploaded documents. Special category and criminal offence data may be included.

4. Processor obligations

• Confidentiality of everyone with access.
• Appropriate technical and organisational security (encryption, role-based access, audit logging, private storage).
• Help the controller with data subject requests, breach notifications and impact assessments.
• Notify the controller of a personal data breach without undue delay.
• Delete or return all data at the end of the service, at the controller's choice.
• Make available information needed to show compliance, and allow audits.

5. Sub-processors

[List of sub-processors — hosting, database, email — and their locations to be added. The controller will be told about changes in advance.]

6. International transfers

[Details of data location and any transfer safeguards to be added.]

7. Signatures

Accepted electronically by the agency's Owner at sign-up.