Data processing agreement

Ezywatch Care · Last updated 6 October 2026

This agreement is part of our terms of service. It applies whenever Ezywatch Limited ("we", the processor) handles personal data for a care company using Ezywatch Care ("you", the controller), as required by Article 28 of the UK GDPR.

1. What we process

Subject and purpose	Providing Ezywatch Care to you: scheduling, visit recording, care plans, approvals, invoicing, payroll figures, staff compliance, reports, backups and support.
How long	For as long as you use the service, then until data is returned or deleted as set out in section 8.
People the data is about	Your clients and their contacts, your carers and office staff, job applicants whose checks you record, and the payers you invoice.
Types of data	Names, addresses and contact details; visit times and check-in/out locations; visit notes, tasks and concerns; pay and invoicing details; employment checks (right to work, identity, DBS, references), training and supervision records and scanned documents; sign-in and activity records.
Special category data	Health and care information in care plans, risk assessments and visit notes. Criminal records information from DBS checks.

2. Your instructions

We process the data only to provide the service and on your documented instructions, which are these terms and how you use and set up the service. We will tell you if we believe an instruction breaks data protection law.
If the law requires us to process data in another way, we will tell you first unless the law forbids it.
You are responsible for having a lawful basis for the data you put into the service and for telling your clients and staff how it is used.

3. Confidentiality

Everyone at Ezywatch Limited and Innovative Web Services Limited who can access your data is bound by confidentiality and only accesses it when needed, for example to provide support you asked for or to fix a problem.

4. Security

We use appropriate technical and organisational measures, including:

encryption of all data in transit (HTTPS) and at rest with our hosting providers;
each company's data kept separate within the service, and access limited by role and per-module permissions;
two-step login for office users, which you can require for your whole company;
uploaded documents kept in private storage, never publicly accessible;
a log of every change made in the office system, kept for 6 years;
nightly backups kept for 30 days, and the ability to restore the database to an earlier point.

5. Sub-processors

You give general permission for us to use these sub-processors. We have contracts with each that protect your data to the same standard as this agreement, and we remain responsible for them.

Sub-processor	What for	Where
Innovative Web Services Limited	Building and maintaining the software, support	UK
Laravel Cloud	Hosting the website, office system and app connection	London, UK
Neon	Database	London, UK
Cloudflare (through Laravel Cloud)	Storage of uploaded documents and backups	May be outside the UK
Resend	Sending emails such as invoices, alerts and sign-in links	May be outside the UK
postcodes.io	Finding the map location of a client's postcode (only the postcode is sent)	UK

We will email you at least 30 days before adding or replacing a sub-processor. If you object on reasonable data protection grounds, we will discuss it with you, and you may end the agreement without charge.

Stripe, which takes your subscription payments, receives only your company's billing details, not your clients' or staff's data, so it is not a sub-processor for your data.

6. Transfers outside the UK

Where a sub-processor handles data outside the UK, we make sure it is protected by a UK adequacy decision or by the safeguards UK GDPR requires, such as the International Data Transfer Addendum.

7. Helping you

People's rights: the service lets you find, correct, export and delete records. If someone contacts us directly about their data, we will pass the request to you without delay and help you answer it.
Data breaches: we will tell you without undue delay, and within 48 hours of becoming aware of a personal data breach affecting your data, with the information you need to report it to the ICO and tell the people affected.
Impact assessments: we will give you reasonable information to help with data protection impact assessments and consultations with the ICO.

8. When the agreement ends

You can ask for a copy of your data within 30 days of the agreement ending. After that we delete it from the service, and it drops out of our backups within a further 30 days, unless the law requires us to keep it. We will confirm deletion if you ask.

9. Checks

We will give you the information you reasonably need to show that this agreement is being followed. If that is not enough, you (or an auditor bound by confidentiality) may carry out an audit once a year, with at least 30 days' notice, at your cost, in a way that doesn't affect other customers' data.

10. Liability and priority

The liability terms in our terms of service apply to this agreement. If this agreement and the terms of service disagree about personal data, this agreement wins.