CENTRIM LIFE LTD – PRIVACY POLICY (UK)

Company Number: 16529540

Registered Office: Victory House, 400 Pavilion Drive, Northampton Business Park, Northampton, NN4 7PA

Centrim Life Ltd ("Centrim Life", "we", "us", "our") is committed to protecting the privacy and security of personal data processed through:

  • The Centrim Life SaaS platform
  • The Centrim Life mobile and web applications
  • The Centrim Life corporate website (centrimlife.co.uk)

This Privacy Policy explains how we collect, use, store, and secure your personal data.

1. WHO WE ARE (DATA CONTROLLER / DATA PROCESSOR)

Depending on how our platform is used:

1.1 When we are the Data Processor

For all personal data entered into the Centrim Life SaaS platform by care homes, retirement villages, or staff users, Centrim Life acts as a Data Processor under UK GDPR.

The organisation using Centrim Life (the care provider) is the Data Controller.

1.2 When we are the Data Controller

We act as the Data Controller when:

  • Collecting data through our website (contact forms, cookies, analytics, marketing forms)
  • Collecting data from prospective customers
  • Managing our own sales, billing, and support operations
  • Managing support tickets submitted via Gleap
  • Managing error logs via Flare App

2. PERSONAL DATA WE COLLECT

2.1 Data collected through the Centrim Life application (Processor)

Data is entered by the care provider and may include:

I. Resident Data (determined by the care provider)
  • Name, room/unit
  • Dietary needs, allergies
  • IDDSI texture requirements
  • Feedback or incident records
  • Any notes or operational details added by staff

(Special Category Data may be included depending on customer configuration)

II. Staff & User Data
  • Name, role, email, phone (if provided)
  • Login credentials (hashed passwords), permissions
  • Activity logs
III. Visitor Data
  • Name, contact information
  • Visit logs
  • Sign-in/sign-out timestamps
IV. Operational Data
  • Maintenance jobs
  • Housekeeping workflows
  • Dining orders
  • Lifestyle activities
  • Facility records

Centrim Life only processes this data under the customer's instructions.

2.2 Data collected through the website and marketing activities (Controller)
I. Contact & Communication Forms
  • Name
  • Email
  • Phone number
  • Organisation details
  • Message contents
II. Marketing communications
  • Email address
  • Preferences & consent logs
III. Website analytics & cookies
  • IP address
  • Device/browser information
  • Pages visited
  • Session duration
  • Referrer URL

We may use Google Analytics, server-level logs, and security logs.

IV. Support Tickets (Gleap)
  • User email (optional)
  • Screenshots
  • Diagnostic logs
  • Steps leading to the issue
V. Error Logging (Flare App)
  • Error details
  • Request URL
  • User ID (if present in context)
  • Technical device/browser metadata

3. HOW WE USE PERSONAL DATA

3.1 As a Data Processor

We process data strictly to:

  • Provide the SaaS application
  • Support operational workflows
  • Maintain system security
  • Provide technical support

We do not use customer data for marketing, profiling, analytics, or any unrelated purpose.

3.2 As a Data Controller (for website & sales operations)

We process data to:

  • Respond to enquiries
  • Provide product demos
  • Send requested information
  • Improve the website
  • Maintain security and prevent misuse
  • Manage billing and customer account administration
  • Provide support services
3.3 Legal Bases

Depending on context:

  • Legitimate interests — responding to enquiries, securing systems
  • Performance of a contract — providing our services
  • Legal obligations — recordkeeping, finance
  • Consent — when subscribing to marketing emails

4. DATA SHARING & SUB-PROCESSORS

Centrim Life uses carefully selected sub-processors:

Sub-Processor Purpose Location
AWS UK (London Region) Hosting, infrastructure, storage United Kingdom
Postmark (EU/UK) Transactional email delivery EU/UK
Gleap (EU) In-app bug reporting & diagnostics EU
Flare App (EU) Error logging & crash reporting EU
E-Caret Solutions (UK-bound access only) Technical support & development assistance Access only to UK systems
  • We do not sell or share personal data with advertisers.
  • We do not transfer application or resident data outside the UK.

5. INTERNATIONAL TRANSFERS

  • All application data is stored exclusively within the United Kingdom.
  • Sub-processor services run in UK or EU data centres (GDPR adequate).
  • E-Caret Solutions staff access only UK-hosted systems and no data is stored offshore.
  • No international transfers occur under Chapter V UK GDPR.

6. DATA RETENTION

6.1 Application data (Processor)

Retention is determined by the Customer (Data Controller).

After termination:

  • Live data deleted within 30 days
  • Backups deleted within 30–60 days
  • Destruction certificate issued
6.2 Website, sales & support data (Controller)
  • Contact form enquiries: 24 months
  • Marketing email lists: until unsubscribe
  • Website analytics: 26 months
  • Support tickets: 12 months
  • Error logs: 30–90 days

7. SECURITY MEASURES

Centrim Life enforces:

  • UK-only hosting (AWS London)
  • Encryption at rest (AES-256)
  • Encryption in transit (TLS 1.2+)
  • Access control with MFA & SSO
  • Role-based access control (RBAC)
  • Network-level firewalls & WAF
  • Vulnerability scanning & pen testing
  • Audit logging and monitoring
  • Strict least-privilege access
  • Disaster recovery with RTO 1 hour, RPO 4 hours.

8. YOUR RIGHTS

Under UK GDPR you have rights to:

  • Access your data
  • Correct inaccurate data
  • Request erasure
  • Restrict processing
  • Object to processing
  • Data portability
  • Withdraw consent (marketing emails)

To exercise rights, contact: privacy@centrimlife.co.uk

Requests relating to data inside customer systems must be directed to the care provider who acts as Data Controller.

9. COOKIES

We use cookies for:

  • Essential website functionality
  • Analytics (Google Analytics / server logs)
  • Security and fraud prevention
  • Performance optimisation

Users can manage cookies via browser settings.

A full cookie policy can be generated separately.

10. CHILDREN'S DATA

  • Centrim Life does not target or market to children.
  • Resident data is entered by the care provider in compliance with safeguarding and lawful basis requirements.

11. CHANGES TO THIS POLICY

  • We may update this Privacy Policy periodically.
  • Changes will be posted on our website with the updated effective date.

12. CONTACT US

For privacy requests or concerns:

Data Protection Officer
Centrim Life Ltd
Victory House
400 Pavilion Drive
Northampton Business Park
Northampton, NN4 7PA

Email: privacy@centrimlife.co.uk

Phone: +44 (0) 1604 279636