Data Processing Agreement (DPA)

For Agency Partners

1. Scope and Purpose

This Agreement sets out the terms, requirements, and conditions on which FosterReady (the "Processor") will process Personal Data on behalf of the Agency (the "Controller").

2. Roles and Responsibilities

• The Processor shall process Personal Data only on written instructions from the Controller.
• The Processor shall ensure that persons authorized to process the personal data have committed themselves to confidentiality.
• The Processor assists the Controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR (Security, Breach Notification, DPIA).

3. Sub-processing

The Processor engages specific sub-processors (e.g., cloud hosting providers) to support the delivery of the Service. A current list of sub-processors is available upon request.

4. International Transfers

Data is primarily stored within the UK/EEA. Any transfer of personal data to a third country outside the UK/EEA shall only take place in compliance with Chapter V of the GDPR.