This page explains the intended data-processing arrangement for Community Command Centre customers. It is not a signed Data Processing Agreement and must be reviewed alongside your order, contract and your organisation’s own legal duties.
Roles
For information a customer organisation enters about its staff, contacts, learners, programmes or delivery, the customer normally decides why and how that information is used and acts as controller. Music Rehab Centre Ltd normally acts as processor when operating Community Command Centre on the customer’s documented instructions. Each party remains responsible for any information it controls independently.
Subject matter and duration
Processing supports the subscribed workspace, including authentication, organisation setup, team permissions, workflows, documents, courses, impact records, support and approved integrations. Processing continues for the subscription and any limited retention period required for security, recovery, legal, tax or dispute purposes.
People and information
Depending on customer use, information may concern staff, volunteers, partners, funders, suppliers, course participants or learners. It may include contact, role, programme, attendance, progress, workflow, document and support information. Customers must not enter passwords, bank credentials or unnecessary medical, safeguarding or special-category information into agent prompts or the setup questionnaire.
Customer instructions
The platform processes information to provide the contracted service and features the customer chooses to use. Requests that fall outside normal product operation should be documented through Technical Help. MRP will not intentionally use customer workspace information for unrelated purposes.
Confidentiality and security
Access is limited through authenticated accounts, organisation separation, role permissions, private storage controls and audit records. Customers are responsible for authorised users, accurate permissions, lawful collection, retention decisions and promptly removing access that is no longer required.
Service providers and transfers
Hosting, database, authentication, payment and communication providers may process limited information needed to deliver their services. Before contracting, customers may request the current provider categories and relevant transfer safeguards through musicrehabpr@gmail.com.
Incidents and assistance
MRP will investigate confirmed security incidents affecting customer data and notify the customer without undue delay where required. Reasonable assistance with data-subject requests, impact assessments or regulator enquiries may be requested through Technical Help, subject to identity and authority checks.
Return, export and deletion
Authorised owners can download a private workspace backup. Customers should export records they need before access ends. Deletion or controlled recovery requests must be verified and may be limited by lawful retention, security, backup and dispute requirements.
Before purchase
Organisations with detailed procurement, safeguarding, special-category data or international-transfer requirements should request a reviewed Data Processing Agreement before uploading that information. Email musicrehabpr@gmail.com.