Security and data protection

NLCRC processes personal data as a controller for our own clients, donors, and portal users, and as a processor where B2B agreements require it. We maintain a Data Protection Policy (version 1.0, June 2026) reviewed annually.

Lawful bases include contract, legal obligation, and legitimate interests for B2B support. We apply data minimisation — especially for community device programmes where referrers, not NLCRC, gate beneficiary eligibility.

LIVEUXI ERP enforces role-based access control, authenticated staff sessions, and segregated permissions (e.g. sanitisation technicians vs general workshop staff).

Client portal accounts use verified email sign-in with two-factor authentication available for booking, shop, and repair tracking.

Storage media in our reuse pipeline is quarantined until NIST SP 800-88 / IEEE 2883 Purge completes. Immutable audit logs link certificates to chain-of-custody events.

We maintain internal incident procedures. Where we act as processor, we notify controllers without undue delay when we become aware of a personal data breach affecting your data, in line with our DPA and UK GDPR Article 33 obligations.

Clients should report suspected incidents via agreed contacts promptly so we can contain, investigate, and document impact.

We use sub-processors for hosting, email, payments, and identity where required to deliver services. A summary is available on request with our DPA. We prefer UK/EEA hosting for client systems where contractually agreed.