GDPR Compliance

How Core Oprs meets its obligations under the EU/UK GDPR.

At Data Core Oprs Limited, we are committed to ensuring the privacy and protection of our users' data. We fully support the General Data Protection Regulation (GDPR) and have implemented its principles into our core operations.

Controller Information

Data Controller: Data Core Oprs Limited
Service/Brand: Core Oprs
Email: contact@coreoprs.com

Our Commitment to GDPR

Our team has worked to ensure that Core Oprs is compliant with GDPR. We are dedicated to helping our customers meet their GDPR requirements as well.

Lawful Bases for Processing

• Contract (Art. 6(1)(b)): To provide and maintain the Core Oprs platform and related services.
• Legitimate Interests (Art. 6(1)(f)): To secure our services, prevent abuse, improve features, and measure usage.
• Consent (Art. 6(1)(a)): For optional communications (e.g., marketing) where consent is obtained.
• Legal Obligation (Art. 6(1)(c)): To comply with accounting, taxation, and regulatory requirements.

Categories of Personal Data We Process

• Account Data: name, email, password hash, organization membership.
• Organization Data: company name, users, venues/clients, roles.
• Operational Data: shift assignments, attendance timestamps/locations, incident metadata.
• Technical Data: IP address, device/browser information, API key metadata and request logs.

Purposes of Processing

• Provide, operate, and maintain the Core Oprs platform.
• Authenticate users and secure access (including API authentication and RLS).
• Record operational events (e.g., shifts, check‑ins, incidents) for customers.
• Monitor performance and service reliability.
• Detect, prevent, and investigate fraud and security incidents.
• Comply with legal obligations and enforce terms.

Your Rights as a Data Subject

Under GDPR, you have several rights regarding your personal data. We are committed to upholding these rights. As a user of Core Oprs, you have:

• The Right to Access: You can request a copy of the personal data we hold about you.
• The Right to Rectification: You can request that we correct any inaccurate or incomplete data.
• The Right to Erasure ('Right to be Forgotten'): You can request that we delete your personal data.
• The Right to Restrict Processing: You can request that we limit the processing of your personal data.
• The Right to Data Portability: You can request a copy of your data in a machine-readable format.
• The Right to Object: You can object to us processing your personal data.

How to Exercise Your Rights

You can exercise your rights at any time by contacting our Data Protection Officer. We have implemented tools within the Core Oprs application to help you manage your data, including data export and deletion functionalities in your account settings.

For any specific requests or questions regarding your data, please contact us at contact@coreoprs.com with the subject line "GDPR Request".

Retention

We retain personal data for as long as necessary to provide the Service and fulfill the purposes outlined above. Logs and backups are held for limited periods and then deleted or anonymized. You may request deletion of your data as permitted by law.

Processors and Sub‑processors

We engage reputable service providers to host and process data on our behalf (e.g., cloud hosting, database, email delivery, analytics). These providers act under written contracts and only process data according to our instructions.

International Transfers

Where personal data is transferred outside the UK/EU, we use appropriate safeguards such as Standard Contractual Clauses (SCCs) and supplementary measures to protect your data.

Security Measures

• Role‑based access controls and Row Level Security (RLS) in the database.
• Encryption in transit (TLS) and at rest provided by our cloud database.
• Hashed API keys with request logging and monitoring.
• Regular backups and least‑privilege operational practices.

Cookies and Similar Technologies

We use strictly necessary cookies for authentication and session management. Optional analytics or preference cookies (if used) will be disclosed in our Cookie Notice and, where required, obtained via consent.

Data Incidents

We maintain procedures to detect and respond to personal data incidents. Where required by law, we will notify affected customers/users and regulators without undue delay.

Changes to This Page

We may update this GDPR information from time to time. Material changes will be posted on this page with an updated date.

Data Processing Agreement (DPA)

For our business customers who act as data controllers, we offer a Data Processing Agreement (DPA) that outlines our commitments and responsibilities as a data processor. Please contact us to obtain a copy of our DPA.

Contact Us

If you have any questions about our GDPR compliance or data protection practices, please do not hesitate to contact us.

• Data Protection Officer: Max Mestiri
• Email: contact@coreoprs.com