Data Processing Agreement

1. Roles

Your organisation is the controller of staff personal data entered into CareTrack. We are the processor and act only on your documented instructions, which include your use of the service's features.

2. Subject matter and duration

Processing lasts for the term of your subscription plus any agreed wind-down period. The subject matter is staff compliance record keeping.

3. Categories of data and data subjects

• Data subjects: your employees, bank staff and managers.
• Data: names, job titles, work contact details, employment start dates, training and check records, expiry dates, notes and uploaded certificates (which may include DBS reference details and right-to-work evidence).

4. Security measures

• Encryption in transit and at rest.
• Row-level access rules so each organisation sees only its own data.
• Role-based access so managers see only their assigned sites.
• Private document storage with per-request authorisation.

5. Sub-processors

We use the following sub-processors to provide the service:

• Supabase — cloud hosting, database, authentication and file storage.
• Stripe — payment processing for subscriptions (we never store card numbers).
• Lovable — application hosting, transactional email and AI document extraction.

We will give notice of intended changes to this list and you may object on reasonable grounds.

6. Assistance and breach notification

We will assist you with data subject requests and, where required, notify you without undue delay after becoming aware of a personal data breach affecting your data.

7. Deletion and return

On termination we will delete or return your data within an agreed period, except where retention is required by law. Account owners can raise a deletion request from Settings → Data & privacy.

8. Audit

On reasonable written request we will provide information necessary to demonstrate compliance with these terms.

9. Contact

Data protection queries under this agreement: caretrackhq@outlook.com.