Last updated: 31 August 2026
This document is issued in English, which is the governing language. If a signed contract or Data Processing Agreement with your organisation says something different, that signed document takes priority.
This page summarises how Arestechub processes personal data on behalf of customers of Corieva. It is an overview for information governance, DPO and procurement teams. The signed Data Processing Agreement (DPA) is the binding processor contract under UK GDPR Article 28.
This page is not itself a DPA. It does not authorise processing beyond a customer's instructions. If this page and a signed DPA differ, the signed DPA wins.
For council and most agency deployments, the customer is the data controller and Arestechub is the data processor. Joint-controller arrangements are not assumed. Cross-authority sharing of a child's case context is a controller decision (and may be controller-to-controller sharing); we only facilitate it on instruction and with access controls and logging.
Arestechub remains controller of its own business records, as described in the Privacy policy.
We process personal data to provide Corieva: voice capture and transcription, structured case notes mapped to the customer's forms and Local Map, photograph filing, Visit Guide briefings, report drafting for human review, translation of family-facing content, allocation and handover support, audit trails, and submission into the customer's case management system.
Processing is for the customer's children's services functions, not for Arestechub's independent purposes. We do not sell case data, use it for advertising, or pool it to train a shared model for other customers.
AI features (transcription, field mapping, drafting, translation, briefing and match suggestions) run in the UK on customer instruction. Prompts and outputs are processed as customer personal data. We do not use that data to train a general-purpose model or a model shared with another customer.
Data subjects typically include children, parents and carers, household members, practitioners, managers, and other professionals named in a case.
Personal data typically includes identity and contact details, case history, visit records, voice audio and transcripts, photographs, assessments, court-report drafts, translations, allocation data, and special category and criminal offence data that appears in statutory social care records.
We process controller data only on documented instructions, including the DPA, the order form, product configuration, and lawful written instructions from authorised customer contacts. We will tell the customer if, in our view, an instruction infringes UK GDPR or the Data Protection Act 2018, unless the law prohibits that notice.
All production children's services data is stored and processed in UK data centres. We do not transfer that data outside the United Kingdom. Backups follow the same location rule. AI inference and any council-specific model training or tuning use the same UK location rule.
Case data is stored in encrypted form at rest, logically separated per customer, with encrypted backups and retention aligned to the DPA. Voice, image and document objects are stored with restricted access. Offline device caches, where enabled, are temporary, encrypted where supported, and cleared on sync, logout or revocation.
Customer users retrieve data through authenticated application access, APIs or case-system submission, according to roles the customer controls. Administrators can retrieve audit histories.
Arestechub personnel retrieve or access customer data only as needed for support, security, hosting operations, or legal duty, under least privilege, with logging. We do not browse case records for curiosity, training demos, or product marketing.
Disclosure to a third party other than an approved sub-processor requires customer instruction or a legal requirement. If the law requires us to disclose without prior notice, we will still notify the customer unless prohibited.
AI is used only to help the customer produce and quality-check documentation. It does not take a significant decision about a child without meaningful human involvement, in line with UK GDPR Articles 22A to 22D as amended by the Data (Use and Access) Act 2025. Special category children's data is not put through solely automated significant decision-making.
Inference, transcription and generation take place in UK data centres. Customer case data is not sent to a public generative-AI service or to a processor outside the UK. Council-specific style models, if enabled, are trained only on that council's material and are logically isolated.
We will assist the controller with transparency wording for staff and, where they choose, for families: that AI may draft text which a practitioner then reviews. We will also assist with DPIA content on AI risk, bias, accuracy and human review.
We implement appropriate technical and organisational measures, taking into account the high risk of children's social care data. These include UK hosting, encryption in transit and at rest, role-based access, audit logging, environment segregation, staff confidentiality, vulnerability management, backup and restoration, and independently assessed controls (including ISO 27001-certified facilities and Cyber Essentials Plus). A DPIA and security assessment are available to customer IG teams on request.
We retain processor data as the controller instructs and as needed to provide the service, including backup cycles. Statutory children's social care retention (including looked-after records often kept until age 75) is the controller's decision. We do not apply a shorter processor convenience period that would destroy records the controller still needs, and we do not keep live case data after the controller has instructed deletion or return except for residual backups that then expire, or where law requires us to freeze data.
At the end of the service, we will return or delete controller personal data as the DPA specifies, except where UK law requires storage. That includes AI prompts, drafts, embeddings or council-specific drafting material derived from the controller's records.
We use sub-processors for hosting and service delivery. They are bound by written contracts imposing UK GDPR Article 28-equivalent duties. We remain responsible to the customer for their work. The current list is available on request. We will not add a sub-processor that would move children's services data out of the UK.
We will assist the controller, taking into account the nature of processing, with data-subject rights, DPIAs, ICO consultation, and information needed to demonstrate compliance. Rights requests received by us that relate to controller data will be directed to the controller without undue delay, unless the controller has instructed a different channel.
We will notify the controller without undue delay after becoming aware of a personal data breach affecting their data, with enough information for the controller to meet ICO and individual notification duties. We will cooperate on investigation, containment and remediation.
We will make available information reasonably necessary to demonstrate Article 28 compliance and allow audits as set out in the DPA, including through certifications, DPIA extracts, and security questionnaires, scheduled so as not to compromise other customers' security.
People we authorise to process customer data are under a duty of confidentiality and are limited to what they need to perform their role.
Request the DPA template, sub-processor list, DPIA and security assessment via hello@corieva.com or privacy@corieva.com.