Data Processing Agreement

In this agreement:

• •'Controller' means the client organisation that determines the purposes and means of processing personal data
• •'Processor' means Support Doc Solutions, acting on the instructions of the Controller
• •'Data Subject' means any identified or identifiable natural person whose personal data is processed
• •'Personal Data' has the meaning given in UK GDPR Article 4
• •'Processing' has the meaning given in UK GDPR Article 4

Where you engage Support Doc Solutions to produce documentation that includes personal data about your service users (such as support notes, risk assessments, or welfare checks), you act as the data controller and we act as the data processor.

As controller, you are responsible for:

• •Ensuring you have a lawful basis for sharing personal data with us
• •Ensuring data subjects have been informed about how their data is used
• •Only sharing personal data that is necessary for the documentation requested

As processor, we are responsible for:

• •Processing personal data only on your documented instructions
• •Keeping personal data secure and confidential
• •Not engaging sub-processors without your prior consent
• •Assisting you in meeting your obligations under UK GDPR

In providing our documentation services, we may process the following categories of personal data about your service users:

• •Names and dates of birth
• •Support needs and care history
• •Risk information
• •Housing and tenancy details
• •Health and wellbeing information (where relevant to the documentation)

We process this data solely for the purpose of producing the documentation you have commissioned. We do not use it for any other purpose.

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, or disclosure. These measures include:

• •Secure, encrypted communication channels
• •Restricted access to personal data on a need-to-know basis
• •Secure deletion of personal data once the documentation has been delivered and the retention period has elapsed

We retain personal data shared with us for documentation purposes for no longer than 30 days after delivery of the completed documents, unless a longer retention period is required by law or agreed in writing.

After this period, personal data is securely deleted or anonymised.

If a data subject exercises their rights under UK GDPR (such as a request for access, erasure, or rectification) in relation to data we hold as processor, we will notify you promptly and assist you in responding within the required timeframe.

We will not respond directly to data subject requests without your authorisation, except where required by law.

In the event of a personal data breach affecting data we process on your behalf, we will notify you without undue delay and in any event within 48 hours of becoming aware of the breach.

We will provide you with sufficient information to allow you to meet your own notification obligations to the ICO and affected data subjects where required.

We do not currently engage sub-processors to process personal data on your behalf. If we need to do so in future, we will seek your prior written consent and ensure any sub-processor is bound by equivalent data protection obligations.