GDPR Statement

1

Our commitment to GDPR

Nookly Ltd is fully committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018). We understand the sensitive nature of care data and treat data protection as a fundamental responsibility — not a legal formality.

We are registered with the Information Commissioner's Office (ICO) and take all reasonable steps to ensure your data is handled lawfully, fairly, and transparently.

2

Roles under GDPR

Nookly as Data Controller

Nookly Ltd is the data controller for:

• Personal data of website visitors (enquiry forms, cookies, analytics)
• Account holders and users of the Nookly platform
• Business contact information of care provider organisations

Nookly as Data Processor

When care providers use the Nookly platform to record information about residents and service users, Nookly acts as a data processor on behalf of the care provider (who is the data controller). We process this data strictly according to the care provider's instructions and our Data Processing Agreement (DPA).

Care providers are responsible for ensuring they have appropriate legal bases to process the personal and special category data of the people in their care.

3

Lawful bases for processing

We process personal data under the following lawful bases:

• Contract (Article 6(1)(b)): Processing necessary to fulfil our service agreement with you
• Legitimate interests (Article 6(1)(f)): For service improvement, security, and fraud prevention
• Legal obligation (Article 6(1)(c)): Where required by law or regulation
• Consent (Article 6(1)(a)): For marketing communications and optional cookies

For special category data (health information in care records), we rely on:

• Substantial public interest (Article 9(2)(g)): For health and social care purposes
• Health or social care (Article 9(2)(h)): For provision of health or social care services
• Explicit consent (Article 9(2)(a)): Where obtained directly from data subjects

4

Your rights under UK GDPR

As a data subject, you have the following rights. To exercise any of these rights, contact us at nooklycare@gmail.com. We will respond within 30 days.

You also have the right to withdraw consent at any time where processing is based on consent, and the right to lodge a complaint with the ICO at ico.org.uk or by calling 0303 123 1113.

5

International data transfers

We store and process all personal data within the United Kingdom. Where we use third-party service providers located outside the UK, we ensure appropriate safeguards are in place (such as UK adequacy regulations or standard contractual clauses) before any transfer occurs.

6

Data security measures

We implement technical and organisational measures to protect personal data including:

• End-to-end encryption of data in transit (TLS 1.3) and at rest (AES-256)
• Role-based access control — staff only access data relevant to their role
• Multi-factor authentication for all platform accounts
• Comprehensive audit logging of all access and changes to data
• Regular penetration testing and security reviews
• Cyber Essentials Plus certification
• Staff data protection training and awareness
• Data Processing Agreements with all sub-processors

7

Data breach procedures

In the event of a personal data breach that is likely to result in a risk to individuals' rights and freedoms, we will:

• Notify the ICO within 72 hours of becoming aware of the breach (where required)
• Notify affected data subjects without undue delay where the breach is likely to result in high risk to them
• Document the breach, its effects, and the remedial action taken

To report a suspected data breach, contact us immediately at nooklycare@gmail.com

8

Data Processing Agreements

As required by UK GDPR Article 28, Nookly enters into Data Processing Agreements (DPAs) with all care provider organisations that use our platform. The DPA sets out:

• The subject matter and nature of the processing
• The duration, type of personal data, and categories of data subjects
• The obligations and rights of the controller
• Security measures and sub-processor arrangements

To request a copy of our standard Data Processing Agreement, contact nooklycare@gmail.com