UK GDPR Article 28(3) requires a written contract containing the terms below. Clauses 3 to 11 and the Annexes exist to satisfy that requirement and should not be trimmed without advice. Annex 2 describes controls that are actually in place; anything not implemented has been stated as such rather than omitted or overstated.
1.1 This Data Processing Agreement ("DPA") forms part of the Agreement between Purinode Ltd (company number 17395630), operator of the Trine platform ("Processor", "we") and the Provider ("Controller", "you").
1.2 In relation to Provider Data, you are the controller and we are the processor.
1.3 In relation to account administration, authentication, billing, support correspondence and platform security telemetry, we act as an independent controller. That processing is described in our Privacy Notice and is outside the scope of clauses 3 to 11.
1.4 "Data Protection Law" means the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003, each as amended or replaced.
1.5 Purinode Ltd is registered with the Information Commissioner's Office under registration reference ZC235279. Our privacy lead is a director of Purinode Ltd, contactable at [email protected]. We have assessed whether we are required to appoint a statutory Data Protection Officer under Article 37, and our current determination, made using the Information Commissioner's Office screening guidance, is that we are not. That determination is recorded in our governance register and is reviewed at least annually and on any material change in the scale of processing.
2.1 This DPA applies for as long as we process Provider Data, and survives termination of the Agreement until deletion is complete under clause 10.
3.1 We will process Provider Data only on your documented instructions, unless required to do otherwise by law. Where we are so required, we will inform you before processing unless the law prohibits it.
3.2 Your documented instructions comprise: the Agreement, this DPA, your configuration and use of the platform, and any further written instruction you give that we accept.
3.3 We will inform you if, in our opinion, an instruction infringes Data Protection Law.
3.4 We will not sell Provider Data, use it for our own marketing, or disclose it other than as permitted by this DPA.
3.5 We will not use Provider Data to train machine learning models. No AI or transcription service is engaged as a sub-processor at the date of this version. If one is engaged, it will be added to Annex 3 under the notice procedure in clause 7 and will be contractually prohibited from retaining or training on Provider Data.
4.1 The subject matter, duration, nature and purpose of processing, the types of personal data and the categories of data subjects are set out in Annex 1.
5.1 We will ensure that persons authorised to process Provider Data are subject to an appropriate duty of confidence, whether contractual or statutory.
5.2 Access to Provider Data by our personnel is limited to those who need it to provide, support or secure the platform, and is logged.
6.1 We will implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the nature of the data, which includes special category data and information relating to vulnerable adults.
6.2 The measures in place are described in Annex 2. We may update them, provided the level of protection is not reduced.
7.1 You give general written authorisation for us to engage sub-processors.
7.2 The sub-processors engaged at the date of this DPA are listed in Annex 3.
7.3 We will give at least 30 days' notice before adding or replacing a sub-processor, by email to your registered administrator and by updating Annex 3.
7.4 You may object on reasonable data protection grounds within that notice period. If we cannot resolve your objection, you may terminate the affected subscription without penalty and receive a refund of prepaid fees for the unexpired period.
7.5 We remain liable to you for the acts and omissions of our sub-processors, and will impose on them data protection obligations no less protective than those in this DPA.
8.1 Provider Data held in the Trine application and its file storage is stored at rest in the United Kingdom (Microsoft Azure, UK South).
8.2 All requests to and from the Trine application pass through the network of our content-delivery and security sub-processor, which handles them at its nearest location (normally in the United Kingdom for UK users) and does not store Provider Data at rest. Transactional email sent by the platform is processed in the United States by our email sub-processor. Where enabled, push notifications to the Trine mobile app are relayed through the United States by our push-notification sub-processor. Mobile app crash reports are processed by our crash-reporting sub-processor, a United States company, and stored in its European Union data region. That processing is covered by the transfer mechanisms stated in Annex 3 and by a transfer risk assessment we maintain and review.
8.3 Where any sub-processor processes Provider Data outside the UK, we will ensure a valid transfer mechanism is in place, being UK adequacy regulations, the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, together with any supplementary measures identified by the transfer risk assessment.
8.4 The location and transfer mechanism applicable to each sub-processor is stated in Annex 3.
9.1 Data subject rights. Taking into account the nature of the processing, we will assist you by appropriate technical and organisational measures in responding to requests to exercise data subject rights. Where a request is made directly to us, we will not respond to it substantively but will refer it to you without undue delay.
9.2 Personal data breach. We will notify you of a personal data breach affecting Provider Data without undue delay and, where reasonably practicable, within 24 hours of becoming aware of it. The notification will describe the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed. Where full information is not available, we will provide it in phases.
9.3 We will not notify the Information Commissioner or data subjects on your behalf unless you instruct us to do so in writing.
9.4 DPIAs and prior consultation. We will provide reasonable assistance with data protection impact assessments and prior consultation with the ICO, so far as they relate to our processing and taking into account the information available to us.
10.1 On termination, you may obtain an export of Provider Data as described in the Cancellation and Data Export Policy.
10.2 Deletion is currently performed manually by us against a documented procedure rather than by an automated workflow. This does not reduce our obligation to delete.
10.3 After the export window closes, we will delete Provider Data from the active platform within 30 days and will confirm deletion in writing.
10.4 Deleted data persists in backups only until those backups expire on their normal cycle. Point-in-time recovery data is retained for 35 days and database dumps for no more than 30 days. We maintain a backup process with a hard maximum age for every retained dump and monitoring for backup failure. We do not restore deleted Provider Data from backup except in a disaster recovery scenario; if a disaster recovery restore reintroduces deleted Provider Data, we will reapply the relevant deletion instructions as soon as reasonably practicable.
10.5 Where we are required by law to retain any Provider Data, we will inform you what is retained and why, and will continue to protect it under this DPA.
11.1 We will make available to you the information reasonably necessary to demonstrate compliance with Article 28 of the UK GDPR.
11.2 We will allow for and contribute to audits, including inspections, conducted by you or an auditor you appoint, on reasonable notice. Routine audits will normally be limited to once in any 12-month period, unless additional audits are reasonably necessary to demonstrate compliance with Data Protection Law, following a personal data breach, or where required by a competent regulator.
11.3 Audits will be scheduled with us in advance, conducted during business hours, must not unreasonably disrupt our operations, and are subject to confidentiality. You will bear your own costs and, where an audit requires more than one working day of our time, our reasonable costs, except where the audit follows a personal data breach, is required by a competent regulator, or reveals a material failure by us to comply with this DPA.
11.4 We may offer current security documentation or an independent assessment in response to an audit request where that reasonably addresses its scope. This does not remove your right to an inspection where that information is not sufficient to demonstrate compliance.
12.1 Liability under this DPA is subject to the limitations in clause 13 of the Terms and Conditions, including the separate cap at clause 13.4, save to the extent those limitations are not permitted by Data Protection Law.
Subject matter. Provision of the Trine care compliance and operations platform.
Duration. For the term of the Agreement, plus the export and deletion periods in clause 10.
Nature of processing. Collection, recording, organisation, structuring, storage, retrieval, consultation, use, transmission, restriction, erasure and destruction, carried out by automated means within the platform.
Purpose. To enable the Controller to maintain staff and candidate records, recruitment and pre-employment checks, training and supervision records, compliance documents, routine checks, meetings, incidents, complaints, safeguarding matters, risk records and related operational information.
Categories of data subject.
Types of personal data.
Special note. The Controller determines what is uploaded. The Processor does not require, and does not ask for, resident-identifiable clinical records beyond what is necessary for the Controller's own record-keeping.
Certification
Hosting and infrastructure
Encryption
require_secure_transport enabled on the database, so unencrypted database connections are rejectedAccess control
Segregation
File and token handling
Logging and audit
Backup and resilience
Development and change control
Personnel
Incident response
| Sub-processor | Purpose | Location of processing | Transfer mechanism |
|---|---|---|---|
| Microsoft Corporation / Microsoft Ireland Operations Ltd (Microsoft Azure) | Application, database and file storage hosting | United Kingdom (UK South) | Not applicable — UK processing |
| AC PM LLC (Postmark) | Transactional email delivery | United States | EU-U.S. Data Privacy Framework, UK Extension. The UK Addendum to the EU Standard Contractual Clauses applies as an alternative where required, incorporated by reference into Postmark's Data Processing Addendum |
| Stripe Payments Europe Ltd | Payment processing. Engaged only where paid billing is enabled on your account | Global, including the United States. Stripe does not offer UK or EEA data residency | UK International Data Transfer Addendum, incorporated into Stripe's Data Transfers Addendum |
| 650 Industries, Inc. (Expo) | Relaying push notifications to the Trine mobile app (device push token, fixed category-level notification text, an in-app link and a care-home identifier). Engaged only when push notifications are enabled | United States | The EU-U.S. Data Privacy Framework UK Extension where the provider is certified, otherwise the UK International Data Transfer Addendum to the EU Standard Contractual Clauses in its data processing terms |
| Google LLC (Firebase Cloud Messaging) | Delivering push notifications to Android devices. Engaged only when push notifications are enabled | United States and global | EU-U.S. Data Privacy Framework, UK Extension; the UK Addendum in Google's data processing terms as the alternative |
| Apple Inc. (Apple Push Notification service) | Delivering push notifications to iOS devices. Engaged only when push notifications are enabled | United States and global | The EU-U.S. Data Privacy Framework UK Extension where the provider is certified, otherwise the UK International Data Transfer Addendum in its terms |
| Functional Software, Inc. (Sentry) | Crash and error reporting for the Trine mobile app. The app does not attach user details, and removes request content, authentication headers, cookies, console logs and record identifiers in web addresses before sending; reports include technical device and app details and a pseudonymous installation identifier | European Union (Sentry EU data region, Germany); the provider is a United States company | Storage in the EU is covered by the UK adequacy regulations for the EEA; access by the US company relies on the EU-U.S. Data Privacy Framework UK Extension, with the UK Addendum in Sentry's Data Processing Addendum as the alternative. Sentry applies server-side data scrubbing, is configured not to store IP addresses, and keeps reports for 30 days |
| Cloudflare, Inc. | Content delivery, encryption in transit (TLS termination), protection against attacks and automated abuse (including Cloudflare Turnstile on public forms), and DNS | Cloudflare's global network; requests are normally handled at the location nearest the user. Provider Data is not stored there at rest | EU-U.S. Data Privacy Framework, UK Extension. The EU Standard Contractual Clauses with the UK Addendum apply as an alternative, under Cloudflare's Data Processing Addendum |
Postmark note. Postmark's Data Processing Addendum is incorporated into its Terms of Service and applies automatically; no separate execution is required. Message content and activity data are stored for 45 days. This is the standard retention period on our plan and cannot currently be reduced. Transactional emails may contain time-limited access links, and a link may remain valid for part of that retention period. Passwords are never sent by email.
Stripe. Stripe acts as an independent controller in respect of payment card data. We do not receive or store full card details.
Push notification text. Push notifications carry fixed, category-level text only (for example "You have an overdue action"), never a name or a record's details, because they can appear on a device's lock screen.
Cloudflare note. For Turnstile, Cloudflare acts as our sub-processor to detect automated abuse and, separately, as an independent controller when it uses the same limited technical signals (such as IP address and browser characteristics) to improve its bot detection, as described in its Turnstile Privacy Addendum.
Not sub-processors. Google Workspace is used for our own business email and identity and does not process Provider Data. No AI or transcription service is engaged.