For clients in the UK and EU — particularly those in healthcare, finance, and other regulated sectors — where your data is processed, and by whom, matters as much as the software itself. This page sets out how Core70 handles that, drawing on the UK delivery capability we have run for over a decade.
How we handle your data
Where your data is processed, and by whom, is decided before an engagement starts and written into the statement of work — not left to how the team happens to work. Two arrangements are available; you choose.
In-jurisdiction handling. For clients who require it, our UK delivery entity — Shinetech Europe Ltd — handles client data within the United Kingdom, and our wider engineering team works without access to production data: the people who touch your data, and the place where it is held, stay in-country. This is the arrangement we have used for UK organisations with strict data requirements, including NHS Trusts.
Named access under a data processing agreement. Where you ask our team to run your production environment, the engineers who can reach it are named in the contract, hold individual accounts with multi-factor authentication and least privilege, and every change is recorded. Where those engineers work from outside the UK, access is governed by a data processing agreement with the transfer safeguards your regulator expects (UK IDTA, EU SCCs), in place before any access is granted. You can see who has access, ask us to review it, or take it back at any time.
Our UK capability
Shinetech Europe Ltd is an established UK-registered entity, based in London, with its own locally employed team and more than a decade of operating history. It is a registered fee payer with the UK Information Commissioner's Office (ICO).
- UK-registered entity — Shinetech Europe Ltd, 8 Devonshire Square, London EC2M 4PL
- ICO registered — registered with the UK Information Commissioner's Office
- Locally employed UK team — delivery managers, account staff, and finance based in the UK
- Long-standing UK presence — over a decade of UK operating history, with established UK legal and accountancy partners
Certifications
Our UK data-handling work is backed by independently audited certifications:
- Cyber Essentials Plus — held by Shinetech Europe Ltd, certified by IASME. Cyber Essentials Plus includes a hands-on technical audit of security controls, beyond the self-assessed base certification.
- ISO 27001 — held by Shinetech Software, covering its information security management system.
G-Cloud 15 (Digital Marketplace) — Shinetech Europe Ltd is an approved supplier on the UK government's G-Cloud framework, listed for CATQR, our attendance-monitoring SaaS product. Admission to the framework requires passing Crown Commercial Service supplier checks covering financial standing, service definition, published pricing and terms. The framework covers that listed SaaS service; Core70 engineering engagements are contracted directly, not purchased through it. We mention it because the due diligence behind it is the same entity, and UK public-sector buyers recognise what it took to get there.
Proven across the NHS
Our UK data-handling model has been tested where the requirements are strictest. We have delivered to NHS Trusts and other UK public-sector and academic organisations, including:
- Homerton Healthcare NHS Foundation Trust
- Frimley Health NHS Foundation Trust
- Barts Health NHS Trust
- Lewisham & Greenwich NHS Trust
- Queen Mary University of London
- St George's University Hospitals NHS Foundation Trust
- Cambridgeshire & Peterborough NHS Foundation Trust
- Sheffield Children's NHS Foundation Trust
Homerton Healthcare NHS Foundation Trust
At Homerton Healthcare NHS Foundation Trust, we delivered the Class Attendance Tracker QR (CATQR) mobile app, replacing paper-based attendance records for mandatory staff training with a faster, more accurate digital process. With over 90% of staff now using the system, it has enabled smoother inductions, improved compliance reporting, and reduced disputes — while giving staff direct access to their own training records. CATQR is GDPR compliant and industry award-winning.
Recognised by NHS security leadership
Our security work has been publicly recognised by the people responsible for it inside the NHS. On Shinetech's Cyber Essentials Plus certification, Andy Landsberg, Cyber Security Manager at Frimley Health NHS Foundation Trust, said:
"We have worked with Shinetech Software over many years and are pleased they have achieved the Cyber Essentials Plus certification in recognition of the controls they have in place and the work they undertake to maintain data security, illustrating their adherence to best practice guidelines."
Data Processing Agreement
A Data Processing Agreement (DPA) is available on request, and forms part of the contractual arrangements once you become a Core70 client. It sits alongside your Master Services Agreement and sets out the specific data-handling commitments for your engagement.
If data protection is central to your decision, we're glad to walk through how this model would apply to your project before any commitment. Start a conversation.
This page describes capabilities available to UK and EU clients. The specific contractual commitments that apply to your engagement are set out in your Master Services Agreement and Data Processing Agreement. Certifications are held by the entities named above; scopes are available on request.