--- title: "Data Processing Agreement | FosterFlow.uk | FosterFlow" source_url: "https://fosterflow.uk/dpa" canonical_url: "https://fosterflow.uk/dpa" retrieved_by: "AnswerRail Edge Engine v1.1.0-parity-v20 (https://answerrail.com)" provenance: "Compiled for deterministic AI retrieval by AnswerRail Edge (RFC 9110 / RFC 9421)" description: "FosterFlow Data Processing Agreement (DPA) satisfy Article 28 of the UK General Data Protection Regulation (UK GDPR) for Fostering Agencies." rfc_compliance: "RFC 9110 / RFC 9309 / RFC 9421" version: "1.1.0" release_version: "v1.1.0-parity-v20" signing_kid: "ar_ed25519_2026_k1" jwks_uri: "https://answerrail.com/.well-known/http-message-signatures-directory" edge_network: "Cloudflare Workers Anycast (330+ Global PoPs)" verified_latency: "<15ms (Warm Edge Cache HIT) / 80-250ms (Cold AST Compile)" --- > **Canonical Source:** [https://fosterflow.uk/dpa](https://fosterflow.uk/dpa) > > *FosterFlow Data Processing Agreement (DPA) satisfy Article 28 of the UK General Data Protection Regulation (UK GDPR) for Fostering Agencies.* # Data Processing Agreement (DPA) Effective Date: April 15, 2026 This Data Processing Agreement ("DPA") supplements the Terms of Service. It forms a legally binding contract between **Tearamo Ltd (trading as FosterFlow)**, Company No. **16992542**, ICO Registration **ZC089122**, Registered Office: **High Street Road, Faversham, Kent, ME13 9EJ** ("Processor") and the Fostering Agency, Local Authority, or registered B2B client ("Controller"). It satisfies the requirements of Article 28 of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. ## 1. Roles, Lawful Basis, and Scope - **Controller:** The Fostering Agency or Local Authority client who dictates the purpose and means of processing institutional placement records under UK GDPR Art. 6(1)(c)/(e) and Art. 9(2)(g)/(h). - **Processor:** Tearamo Ltd (trading as FosterFlow), acting strictly on the Controller's instructions to provide software infrastructure. (Note: Where Independent Carers use FosterFlow outside an agency contract as a personal reflective and carer-compliance diary using de-identified initials/first-names in accordance with their Supervising Social Worker / Fostering Service's recording policy under UK GDPR Art. 6(1)(f) Legitimate Interests / Art. 9(2)(h) Health & Social Care provision, Tearamo Ltd acts as independent Data Controller for their account). - **Scope:** The processing of Personal Data and Special Category Data (child health/welfare records, encrypted voice recordings stored in Cloudflare R2 for playback and audit, transcripts, and reports) generated by carers and staff affiliated with the Controller. - **DPO Contact:** [[email protected]](https://fosterflow.uk/cdn-cgi/l/email-protection#90f4e0ffd0f6ffe3e4f5e2f6fcffe7bee5fb) ## 2. Processing Instructions & Audio Storage The Processor shall treat Personal Data and Special Category Data as Confidential Information. The Processor will only process Data to provide, secure, and maintain the FosterFlow platform, and will never use it for its own marketing or AI foundational model training. Encrypted voice recordings are stored in Cloudflare R2 for carer/supervisory playback and audit verification until deleted by the carer or governed by the applicable statutory retention policy. ## 3. Authorised Sub-Processors The Controller authorises the Processor to engage the following sub-processors. The Processor remains fully liable for the performance of its sub-processors under Article 28(4) UK GDPR: | Sub-Processor | Purpose | Location | Safeguards | | :--- | :--- | :--- | :--- | | Supabase | Database (PostgreSQL & RLS) | UK / EU / US | UK IDTA / SCCs, AES-256 Encryption at Rest | | Clerk | Authentication & Identity | US / Global | UK IDTA / SCCs, SOC 2 Type II | | Cloudflare R2 | Encrypted Audio & Media Storage | UK / EU / Global | UK IDTA / SCCs, AES-256 Encrypted Buckets | | Deepgram (`nova-2`) | Zero-Data-Retention Voice-to-Text Transcription | US / EU | Zero-Data-Retention API, No Model Training, SCCs | | Google Cloud Vertex AI / Gemini (`gemini-2.5-flash`) | Zero-Data-Retention AI Structuring & Summarisation | UK / EU / Global | Zero-Data-Retention Enterprise API, No Model Training | | Stripe | Payments & Billing | UK / US | PCI-DSS Level 1, UK IDTA / SCCs | | Mailgun | Transactional Email | EU / US | TLS Encryption, UK IDTA / SCCs | | Upstash | Redis Rate Limiting | UK / EU / Global | Ephemeral IP/Counter State, Encryption in Transit | | GoHighLevel | Agency CRM (B2B Lead & Account Contacts Only) | US | UK IDTA / SCCs, Zero Child/Placement Data | | Sentry | Error Monitoring & Telemetry | US / EU | 100% DOM Replay Masking, PII Redaction | ## 4. Tenant Security & Isolation The Processor implements strict Row Level Security (RLS) and application-layer placement scoping ensuring logical tenant separation. Information cannot be queried across Agency boundaries. All data in transit is encrypted using strictly enforced TLS 1.3 and at rest via AES-256. ## 5. Data Breach Notification In the event of a confirmed Personal Data Breach, the Processor shall notify the Controller without undue delay, and in any event within 72 hours of becoming aware of the breach. The Processor will assist the Controller in its obligations to notify the Information Commissioner's Office (ICO) and relevant regulatory bodies. ## 6. Retention, Return, and Deletion of Data Retention and deletion are governed by whether records belong to an Independent Carer diary or an Agency-linked institutional placement: - **Independent Carer Self-Service Cancellation / Deletion:** Where an Independent Carer cancels or deletes their standalone subscription, data enters a 30-day export grace period for offline backup and is then permanently purged (including encrypted audio files in Cloudflare R2). - **Agency-Linked Institutional Placements (Statutory Schedule):** Institutional placement records controlled by a Fostering Agency or Local Authority are retained in accordance with the Controller's statutory schedule under the **Fostering Services (England) Regulations 2011**: **Regulation 30 (Child Case Records)** — retained for **75 years from the child's date of birth** (or 15 years from date of death if the child dies under 18); and **Regulation 22(6) (Foster Carer Records)** — retained for **10 years from the date on which the foster carer's approval is terminated**. - **30-Day Export Grace Period & Archive Tier on Contract Termination:** Upon termination of an Agency subscription, the Agency portal enters a 30-day read-only export window to download full chronological PDFs and JSON archives, or the Controller may transition to the Archive Compliance Tier to retain hosted read-only access for statutory retention. - **Safeguarding & LADO Freeze Override:** If a child or carer record is flagged with an active Safeguarding or LADO Investigation Freeze, all automated purge routines are suspended until explicitly released by the Controller. - **Ofsted NMS 26 Daily Locking Guideline:** To enforce data integrity required under **Ofsted Fostering NMS (2011) Standard 26 (Case records)**, daily log entries are frozen and cryptographically sealed (SHA-256) within 24 hours of creation, requiring append-only formal amendments thereafter. ## 7. Data Subject Rights Assistance The Processor provides automated export tools (the 1-Click DSAR Vault) allowing the Controller to fulfil Data Subject Access Requests (DSAR) independently. If direct technical assistance is required, the Processor's DPO ([[email protected]](https://fosterflow.uk/cdn-cgi/l/email-protection#593d2936193f362a2d3c2b3f35362e772c32)) will provide support within a commercially reasonable timeframe. ## 8. Governing Law This DPA is governed by the laws of England and Wales and the exclusive jurisdiction of the courts of England and Wales. --- ## 🏛️ AI Ingestion & Edge Optimization Provenance This sovereign authority subpage is compiled and delivered across 330+ Cloudflare Anycast edge locations by [AnswerRail](https://answerrail.com) for [https://fosterflow.uk/dpa](https://fosterflow.uk/dpa).