Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Nightingale Software Group ("Processor") and the customer organisation ("Controller"). It applies wherever Nightingale processes personal data on the Controller's behalf.

1. Roles of the parties

The Controller determines the purposes and means of processing personal data contained in its application records. Nightingale acts as Processor and processes that data only on the Controller's documented instructions, which include the instructions given through normal use of the Services.

Where Nightingale processes data about its own account holders for billing, security and service administration, Nightingale acts as an independent controller under its Privacy Policy.

2. Subject matter and duration

The subject matter is the provision of the Nightingale Services. Processing continues for the duration of the subscription, plus the retention period set out in clause 9.

3. Nature and purpose of processing

Collection, storage, organisation, retrieval, analysis, transmission, restriction, erasure and destruction of personal data, as necessary to deliver the Services subscribed to by the Controller.

4. Categories of data subjects

Depending on the applications used, these may include the Controller's employees and contractors, its customers and their contacts, job applicants and candidates, suppliers, and visitors.

5. Categories of personal data

Identification and contact details; employment and role information; scheduling, attendance and time records; operational and transactional records; communications content; and technical identifiers such as IP address and device information.

Special category data should not be entered into the Services unless the Controller has confirmed an appropriate lawful basis and the relevant application is designed to hold it.

6. Processor obligations

Nightingale will:

• process personal data only on documented instructions from the Controller;
• ensure personnel authorised to process personal data are bound by confidentiality;
• implement appropriate technical and organisational measures as described in clause 7;
• assist the Controller in responding to data subject requests;
• assist the Controller with data protection impact assessments and consultations with supervisory authorities, taking into account the information available to it;
• make available the information reasonably necessary to demonstrate compliance with this DPA.

7. Security measures

Technical and organisational measures include: encryption of data in transit and at rest; role-based access control with least-privilege defaults; database-level isolation between customer organisations; individually attributed and logged administrative access; append-only audit logging of significant actions; monitored infrastructure; and regular backups with tested restoration. These are described in the Security & Trust Centre.

8. Subprocessors

The Controller gives general authorisation for Nightingale to engage subprocessors. The current list is published at /legal/subprocessors.

Nightingale will give notice of any intended addition or replacement of a subprocessor before that subprocessor begins processing, allowing the Controller a reasonable opportunity to object on reasonable data protection grounds. Nightingale imposes data protection obligations on each subprocessor no less protective than those in this DPA and remains liable for their performance.

9. Data subject rights

Nightingale provides functionality within the Services enabling the Controller to access, correct, export and delete personal data. Where Nightingale receives a request directly from a data subject relating to Controller data, it will not respond substantively but will refer the request to the Controller without undue delay.

10. Personal data breach

Nightingale will notify the Controller without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Controller data. The notification will describe the nature of the breach, the categories and approximate number of data subjects and records affected so far as known, the likely consequences, and the measures taken or proposed.

Nightingale will cooperate with the Controller and take reasonable steps to mitigate the effects of the breach.

11. International transfers

Primary processing takes place in the United Kingdom and the European Economic Area. Where a subprocessor processes personal data outside those regions, the transfer is made under the UK International Data Transfer Addendum, EU Standard Contractual Clauses, or another approved transfer mechanism, together with any supplementary measures required.

12. Audit

Nightingale will make available information necessary to demonstrate compliance with this DPA and will contribute to audits conducted by the Controller or an independent auditor mandated by it, subject to reasonable notice, confidentiality obligations, and no more than once in any 12-month period unless required by a supervisory authority.

13. Return and deletion

On termination of the Services, the Controller may export its data for 30 days. After that period Nightingale will delete the personal data, except where retention is required by law, in which case the data remains subject to the confidentiality and security obligations of this DPA.

14. Precedence

In the event of conflict between this DPA and the Terms of Service in relation to the processing of personal data, this DPA prevails.

Contact

Data protection enquiries: privacy@nightingalesoftware.co.uk