Data processing terms for Care clients

Version 2026-11-v1. Last updated 2 November 2026.

This page sets out how the portal fits with the data processing agreement for Care clients (UK GDPR Article 28). The agreement is published at https://www.clarwyn.co.uk/dpa.html and forms part of your Care contract. It applies to personal data that you, as controller, put into the portal or that we see while helping you, and we process only on your written instructions, which are your tickets, quotes and plan.

What the portal adds

• Subject matter and duration: handling your support tickets, for as long as your Care plan lasts.
• Types of data and people: contact details of your staff, and anything your staff or customers' data that appears in a ticket, or in a screenshot you email to us. Please keep personal data in tickets to what is needed, and never include passwords.
• Sub-processors for the portal: Cloudflare (hosting, database and email sending), and the AI assistant service listed in the agreement. The list, the 30 days' notice of changes and your right to object are in the agreement. Stripe is not a sub-processor for Care clients' ticket data.
• Location: stored in Cloudflare's European region where we can choose; some processing and support access may happen in the United States, under the transfer safeguards described in the privacy notice.
• Security: as in the privacy notice: passkeys, encryption, access limited to the people and assistants working for Clarwyn IT, and an audit log.
• Personal data breach: we tell you without undue delay and within 48 hours of becoming aware, as the agreement says.
• When Care ends: within 30 days we delete (or, if you ask first, return) your ticket content and any screenshots you emailed to us, except records the law requires us to keep.
• Helping you with data requests: forward any request to support@clarwyn.co.uk and we will help you respond.

If anything here differs from the published agreement, the published agreement and your approved quote take priority.