Data Processing Agreement

1. Parties and scope

This Data Processing Agreement ("DPA") forms part of the Terms of Service between DARRAA LTD, trading as CareCompliant ("Processor", "we", "us") and the organisation that has subscribed to the CareCompliant platform ("Controller", "you").

It applies to all processing of personal data carried out by us on your behalf in connection with the Service.

2. Definitions

Terms defined in the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018 have the same meaning in this DPA. Key terms:

• Controller: the organisation that determines the purposes and means of processing.
• Processor: DARRAA LTD (trading as CareCompliant), processing personal data on behalf of the Controller.
• Sub-processor: any third party engaged by us to process personal data under this DPA.
• Personal data: as defined in UK GDPR Article 4(1).
• Data subject: staff members, service users, applicants, and other individuals whose data is processed in the platform.

3. Subject matter and duration

• Subject matter: provision of the CareCompliant platform as described in the Terms of Service.
• Duration: from the start of your subscription until the agreement ends and all personal data is returned or deleted in line with section 11.
• Nature and purpose: hosting, storing, transmitting, and analysing personal data to deliver CQC compliance, governance, training, incident, and audit functionality.

4. Categories of data subjects and personal data

Categories of data subjects:

• Employees, contractors, volunteers, and applicants of the Controller
• Service users and their representatives (where recorded in incidents or audits)
• The Controller's own staff administering the platform

Categories of personal data:

• Identity: name, date of birth, national insurance number, photograph
• Contact: email, phone, address
• Employment: role, start date, references, induction status
• Compliance records: DBS check numbers, right-to-work evidence references, training certificates
• Incident records: narrative, dates, staff and service user references, root cause, learning
• Audit findings and policy acknowledgements

Special category data: limited health-related information may be recorded in incident narratives. Criminal offence data may be referenced through DBS check metadata. You remain responsible for the lawful basis and Article 9/10 condition for processing this data.

5. Processor obligations

We will:

• Process personal data only on your documented instructions, including with regard to international transfers, except where required by law.
• Ensure that personnel authorised to process personal data are under an appropriate duty of confidentiality.
• Implement the technical and organisational measures set out in section 8.
• Assist you in fulfilling your obligations to respond to data subject requests (section 9).
• Assist you in ensuring compliance with Articles 32 to 36 of UK GDPR (security, breach notification, data protection impact assessments, prior consultation).
• Make available all information necessary to demonstrate compliance with this DPA.
• Notify you immediately if, in our opinion, an instruction infringes UK GDPR or other applicable data protection law.

6. Controller obligations

You warrant and undertake that:

• You have a lawful basis for processing all personal data you upload to the platform.
• You have provided appropriate privacy information to data subjects.
• Your instructions to us comply with UK GDPR and other applicable law.
• You will not upload personal data that falls outside the categories listed in section 4 without first agreeing this with us in writing.

7. Sub-processors

You provide general authorisation for us to engage sub-processors to assist in delivering the Service. Current sub-processors include:

We will give you at least 30 days' notice of any intended change to our sub-processors. If you reasonably object, we will work with you to find a resolution; if none is possible, you may terminate the affected parts of the Service.

Where a sub-processor is engaged, we will impose data protection obligations on them substantially equivalent to those in this DPA.

8. Security measures

We implement appropriate technical and organisational measures, including:

• Encryption: TLS 1.2+ in transit; AES-256 at rest for database and backups.
• Access control: role-based access, least privilege, two-factor authentication for administrative access.
• Tenant isolation: all data is scoped to organisation and branch at query level; no cross-tenant access is possible from the application.
• Network security: firewalls, private subnets, hardened infrastructure, automated security patching.
• Logging and monitoring: application and infrastructure logs, anomaly alerting.
• Backup and recovery: daily encrypted backups with defined retention; documented recovery procedures.
• Personnel: background checks, confidentiality obligations, annual data protection training.
• Change management: peer code review, automated testing, staged releases.
• Incident response: documented procedure aligned with UK GDPR Article 33.

9. Data subject requests

Where data subjects exercise their rights (access, rectification, erasure, restriction, portability, objection), you are responsible for responding. The platform provides tools to export, edit, and delete records so you can respond within the UK GDPR one-month window.

If we receive a request directly from one of your data subjects, we will forward it to you without undue delay and without responding to the data subject (other than to acknowledge receipt and direct them to you).

10. Personal data breaches

We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting your data. Our notification will include, to the extent known:

• The nature of the breach, including categories and approximate number of data subjects and records
• The likely consequences
• The measures taken or proposed to address the breach and mitigate its effects
• Contact details of our data protection point of contact

We will cooperate with you in good faith to support your obligations to notify the ICO and affected data subjects where required under Articles 33 and 34 UK GDPR.

11. Return or deletion of data

On termination of your subscription, you may, within 30 days:

• Export your data through the platform's export tools; or
• Request a full data export from us in a commonly used, machine-readable format.

After 30 days (or on your earlier written request), we will delete all personal data from production systems. Encrypted backups are rotated out within 90 days. We will confirm deletion in writing on request.

Where we are required by law to retain any personal data after termination, we will continue to protect it in accordance with this DPA and delete it when the legal requirement ends.

12. International transfers

Your data is stored in the United Kingdom by default. Where a sub-processor is located outside the UK, we will ensure an appropriate transfer mechanism is in place (UK adequacy decision, UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses), together with any supplementary measures required by the transfer risk assessment.

13. Audit rights

On reasonable prior written notice (no more than once per 12 months, unless required by a regulator or following a personal data breach), we will make available to you all information reasonably necessary to demonstrate compliance with this DPA, including summary reports of independent security assessments.

On-site audits will be mutually agreed in advance, must be conducted during business hours, and must be carried out under appropriate confidentiality obligations. Costs are borne by the requesting party.

14. Liability

The liability of each party under this DPA is subject to the limitations and exclusions set out in the Terms of Service, save where this is not permitted by UK GDPR.

15. Governing law

This DPA is governed by the laws of England and Wales. The courts of England and Wales have exclusive jurisdiction.

16. Contact

For data protection enquiries, including requests for a countersigned copy of this DPA:

Email: [email protected]
Post: Data Protection, DARRAA LTD (trading as CareCompliant), United Kingdom