Legal
Data processing agreement
How Fostem handles the records your agency keeps in Fostem, as UK GDPR Article 28 requires.
Version 1.0 · Effective 7 November 2026
This agreement is between the agency that uses Fostem (“the Controller”) and Urban Carers Ltd, company number 15419139, registered office [registered office address] (“the Processor”, “Fostem”). It forms part of the Fostem Terms of service and applies automatically when the agency accepts them. If you would like a signed copy for your records, email hello@fostem.com.
Words such as “personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meanings in the UK GDPR and the Data Protection Act 2018 (“Data Protection Law”).
1. Roles
For personal data the Controller and its users put into Fostem (“Agency Data”), the Controller is the controller and Fostem is the processor. Fostem processes Agency Data only on the Controller’s documented instructions. These terms, and the Controller’s use of the features of the service, are those instructions. If Fostem believes an instruction breaks Data Protection Law, it will tell the Controller.
2. Details of the processing
| Subject matter and purpose | Providing the Fostem service: storing, organising, displaying, flagging, alerting on, reporting on, importing and exporting the agency’s fostering records. |
|---|---|
| Duration | For the term of the subscription and until Agency Data is deleted under section 10. |
| Data subjects | Children placed with or referred to the agency; foster carers and members of their households; birth family members and other people mentioned in records; agency staff; people applying to foster; panel members and other professionals. |
| Types of personal data | Names, contact details, dates of birth, placement details, daily logs, notes, documents, plans, reviews, checks (such as DBS checks and references), training, payment and bank details for carers, and recruitment records. |
| Special category and criminal offence data | Health information (including medication and mental health), information about ethnicity, religion and sexual life where the agency records it, safeguarding concerns and allegations, and information about criminal records and offences (such as DBS information). |
3. Fostem’s obligations
Fostem will:
- process Agency Data only to provide the service, and never sell it, use it for marketing or use it to train AI models;
- make sure everyone authorised to process Agency Data is bound by confidentiality;
- keep Agency Data secure using the measures in Annex 1;
- help the Controller, taking into account the nature of the processing, to respond to data subjects exercising their rights (the service lets the Controller find, correct, export and delete records itself);
- help the Controller with security, breach notification, data protection impact assessments and consultation with the ICO, in relation to Fostem;
- make available the information needed to show compliance with this agreement, and allow audits as set out in section 9.
4. Access by Fostem staff
Fostem’s business tools show only counts and contact details for agencies, never children’s records. Fostem staff do not access Agency Data unless the Controller asks for support that needs it, or it is necessary to keep the service secure or working, or the law requires it. Any such access is limited to what is needed.
5. Sub-processors
The Controller gives general authorisation for Fostem to use sub-processors. Fostem’s current sub-processors for Agency Data are:
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase Inc. | Database, sign-in, file storage and server functions | London, UK (AWS eu-west-2) |
| Resend | Sending service emails (sign-in links, alerts, reminders). Alert emails do not contain children’s details. | United States |
| Stripe | Payments and invoices (billing contacts only) | UK, EU and United States |
Fostem will give the Controller at least 30 days’ notice of any new sub-processor (by email to the owner and on this page). The Controller may object on reasonable data protection grounds; if we cannot resolve the objection, the Controller may end the agreement and receive a refund of prepaid fees for the remaining period. Fostem will put a written contract in place with each sub-processor giving at least the same protection as this agreement, and remains responsible for them.
6. International transfers
Agency Data is stored in the UK. Where a sub-processor processes personal data outside the UK, Fostem will make sure the transfer is lawful under Data Protection Law, using UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the sub-processor is certified) or the ICO’s International Data Transfer Addendum with appropriate supplementary measures.
7. Personal data breaches
Fostem will tell the Controller without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Agency Data. It will give the information it has about the nature and likely consequences of the breach and the steps taken, and will update the Controller as it learns more. Fostem will take reasonable steps to contain and fix the breach. The Controller remains responsible for any notification to the ICO and to data subjects.
8. The Controller’s obligations
The Controller confirms that it has a lawful basis, and where needed a condition for special category and criminal offence data, for the Agency Data it puts into Fostem, and that its instructions comply with Data Protection Law. The Controller is responsible for who it invites, the roles it gives them, and removing access when people leave.
9. Audits
Fostem will answer reasonable written questions about its security and data protection. If the Controller needs more, it may audit Fostem’s compliance with this agreement once a year, on at least 30 days’ notice, during business hours, at its own cost and subject to confidentiality, or more often if required by the ICO or after a personal data breach. An audit will not give access to other customers’ data.
10. Return and deletion
The Controller can export all Agency Data at any time. When the subscription ends, the Controller can still sign in and export Agency Data for 90 days, after which Fostem deletes Agency Data from the live service. Backups are overwritten within a further 35 days. If the Controller asks, Fostem will delete Agency Data sooner or provide a full export. Fostem may keep Agency Data only where the law requires it.
11. Liability
Each party is liable for its own breaches of this agreement and of Data Protection Law, subject to the limits in the Terms of service, except that those limits do not restrict any amount a party must pay to a data subject or regulator because of the other party’s breach.
12. General
If this agreement conflicts with the Terms of service, this agreement applies to the processing of Agency Data. It is governed by the law of England and Wales.
Annex 1: Security measures
- Hosting: Agency Data is stored in a London (UK) data centre region with a major cloud provider.
- Encryption: all connections use TLS; data is encrypted at rest.
- Separation between agencies: row-level security rules inside the database make sure each agency can only access its own data, on every request.
- Access by role: users only see what their role needs; for example, carers only see children placed in their household, and allegations are restricted to managers.
- Integrity: submitted logs are locked and changes are added as notes; an audit log records important actions and cannot be edited.
- Sign-in: one-time email links, with invitations that only work for the invited email address.
- Payments safeguards: bank detail changes must be confirmed by a second person, and payment runs approved by someone other than the person who prepared them.
- Backups: daily backups of the database.
- Fostem staff: access to production systems is limited to the people who need it, using strong passwords and two-factor authentication.
- Email: alert and reminder emails do not include children’s details.
- Review: Fostem reviews these measures regularly and as the service changes.