Data processing addendum

Roles

When an organisation uses NurturaCare to serve its members, the organisation is the controller and NurturaCare is the processor. We process personal data only on documented instructions from the controller.

Our obligations

• Process personal data only on documented instructions, including for international transfers.
• Ensure personnel with access are bound by confidentiality.
• Implement the technical and organisational measures described in our security page.
• Engage subprocessors only under equivalent terms, with advance notice of changes.
• Assist the controller with data subject requests, impact assessments and regulator engagement.
• Delete or return personal data at the end of the engagement, subject to legal retention.
• Make available the information needed to demonstrate compliance and allow audits.

Sub-processing and transfers

A current subprocessor list is published and versioned. Controllers receive notice before a new subprocessor is engaged and may object. International transfers rely on the appropriate transfer mechanism for the jurisdictions involved.

Security incidents

We notify the controller without undue delay after becoming aware of a personal data breach, with the information needed for the controller to meet its own notification duties.