Privacy Policy & Data Protection

1. Data Controller Identification

This Privacy Policy applies to New Era Support Ltd ("we", "us", or "our"), a healthcare, supported housing, and staffing recruitment company registered in England & Wales.

Our registered office address is Flat 10 The Compasses, 11 Farley Hill, Luton, Bedfordshire. We are committed to maintaining the trust of our job candidates, healthcare client providers, and website visitors in accordance with the UK General Data Protection Regulation (UK GDPR) and the Privacy and Electronic Communications Regulations (PECR).

2. Personal Data We Collect

We collect and process personal information depending on your interaction with our platform:

• Healthcare Job Applicants & Staff Candidates: Full name, date of birth, gender, telephone number, personal email address, residential address, postcode, curriculum vitae (CV), professional references, identity verification documents (Passport, National ID), photo ID cards, proof of address, Enhanced Disclosure and Barring Service (DBS) certificates, nursing registration credentials (NMC/SSSC), and training certificates.
• Healthcare Clients & Care Providers: Organization name, manager contact name, official email address, business telephone number, facility location, staffing requirements, shift urgency, and invoicing details.
• General Website Visitors: IP addresses, browser types, session interactions, and cookie preferences stored via essential local browser keys.

3. Legal Basis for Processing

We process your personal information under the following legal bases:

• Contractual Fulfillment: Processing necessary to place healthcare personnel into shifts or evaluate job applications.
• Legal & Regulatory Obligation: Statutory CQC (Care Quality Commission) safeguarding compliance, UK Right-to-Work verification, and employment legislation.
• Legitimate Interests: Operating and securing our business, verifying candidate credentials, and delivering emergency staffing services.

4. Data Storage & Security Measures

We implement industry-standard technical and organizational security controls to protect your data:

• Candidate compliance documents (Passports, DBS certificates, CVs) are stored in secure Supabase Cloud Storage Vaults with restricted access.
• Admin portal sessions enforce 20-minute automatic inactivity timeouts and encrypted HTTP-only session cookies.
• All file uploads enforce a strict 5 MB file size limit and in-browser image compression to prevent unauthorized memory exploits.

5. Third-Party Data Sharing

We do not sell, rent, or trade personal data to third parties. Data is shared exclusively with:

• Regulatory Bodies: Care Quality Commission (CQC) auditors and local social care authorities for safeguarding inspections.
• Verification Agencies: Disclosure and Barring Service (DBS) checking agencies and professional reference providers.
• Transactional Service Providers: Resend API for automated email dispatch and Supabase PostgreSQL database infrastructure.

6. Your Legal Rights Under UK GDPR

Under UK data protection laws, you have the following rights:

• Right of Access: Request copies of personal data held about you.
• Right to Rectification: Request correction of inaccurate or incomplete records.
• Right to Erasure ("Right to be Forgotten"): Request deletion of data where legal retention periods have expired.
• Right to Restrict Processing: Request suspension of data processing under specific conditions.