FeaturesPricingAbout UsCareersContact UsFAQBlogSign in

Data Processing Agreement

Supplier: YERADO LIMITED (Company Number: 14008556)
16 Croftdown Road, Birmingham, B17 8RB
Email: [email protected]
Data Protection Officer: Prior Analytics Ltd

Processing Overview

This agreement covers Lief's provision of an online software solution for the recording, storage, analysis, and reporting/downloading of customer data related to staff, residents, and facilities.

Categories of Personal Data Processed

The following categories of personal data are processed under this agreement:

  • Contact information (email, phone, address)
  • Identity details (name, date of birth, national insurance number)
  • Professional records (employment history, qualifications)
  • Special category data (health records, ethnicity, religion)
  • Financial information (pay, banking details)
  • DBS and background check information
  • Incident and safeguarding records
  • Care plans and risk assessments
  • Daily logs and session notes
  • Medication records
  • Educational and training records
  • Photographic and biometric data
  • Location and attendance data
  • Communication records
  • Legal status and immigration information
  • Court orders and legal documentation
  • Family and contact information
  • Complaints and feedback records
  • Vehicle and asset records
  • System access and audit logs

Core Obligations of the Supplier

Lief (the Supplier) agrees to:

  • Process data only in accordance with documented customer instructions
  • Implement appropriate encryption and security measures to protect personal data
  • Notify customers of data breaches within 24 hours of becoming aware
  • Maintain strict confidentiality and restrict third-party access
  • Assist with data subject requests within 14 working days
  • Delete or return all personal data within 30 days of agreement termination
  • Maintain records of all processing activities

Sub-processors

The customer provides prior authorisation for the Supplier to engage sub-processors. The Supplier remains fully responsible for their compliance with this agreement. Current sub-processors include:

  • AWS — server hosting and infrastructure (UK)
  • Airtable — sales and demo scheduling (US, GDPR compliant)

The Supplier will notify customers of any intended changes to sub-processors and provide an opportunity to object.

Data Subject Rights

The Supplier will assist the customer in fulfilling data subject rights requests (access, correction, deletion, restriction, portability) within 14 working days of the request being received.

Security Measures

The Supplier implements the following technical and organisational security measures:

  • Encryption in transit and at rest
  • Role-based access control
  • Regular security audits and penetration testing
  • Staff data protection training
  • Incident response procedures
  • Business continuity and disaster recovery planning

Audits

The customer may request an audit of the Supplier's data processing activities. 30 days' written notice is required, except in cases of a suspected or confirmed data breach.

Liability and Governance

  • Liability is capped at £2,400 per event (excluding fraud, negligence, or personal injury claims)
  • This agreement is governed by the law of England and Wales
  • Data must be deleted or returned within 30 days of agreement termination

Contact

For any data protection queries or to exercise your rights, contact: [email protected]