Data Processing Agreement

Last updated: 20 July 2026  •  Version 1.0  •  UK GDPR Article 28 compliant

1. Definitions

"Controller" means you, the Customer — the registered provider of a children's home, who determines the purposes and means of processing children's personal data.

"Processor" means KingCare Ltd (company number 17359237), which processes personal data on your behalf and according to your instructions.

"Personal Data" has the meaning given in the UK GDPR.

"Special Category Data" means personal data revealing health information, including physical and mental health, wellbeing and medical records relating to children in your care.

"Children's Data" means any personal data about children in your care that is entered into the KingCare platform by you or your staff.

"Services" means the KingCare software platform as described in the Terms of Service.

"Sub-processor" means any third party engaged by KingCare to process personal data as part of the Services.

2. Scope of processing

3. Processor obligations

KingCare shall, as Data Processor:

1. Process Children's Data only on your documented instructions, unless required by applicable law
2. Ensure that persons authorised to process Children's Data are bound by confidentiality obligations
3. Implement and maintain appropriate technical and organisational measures (see Section 5)
4. Not engage sub-processors without prior general or specific written authorisation from you (Section 6 constitutes general authorisation for listed sub-processors)
5. Assist you in responding to data subject rights requests within the timeframes required by UK GDPR
6. Assist you in meeting your obligations under UK GDPR Articles 32–36 (security, breach notification, DPIA, prior consultation)
7. Delete or return all Children's Data at the end of the service relationship, at your choice
8. Make available all information necessary to demonstrate compliance with this DPA
9. Notify you without undue delay (and within 72 hours where possible) of any personal data breach affecting Children's Data

4. Controller obligations

You, as Data Controller, shall:

1. Ensure you have a lawful basis for collecting and entering Children's Data into the platform
2. Provide appropriate notices to data subjects (children's families, staff) about processing
3. Ensure that Special Category Data (health information) is processed under a valid Schedule 1 DPA 2018 condition (e.g., safeguarding of children — paragraph 18)
4. Not instruct KingCare to process data in a way that would breach applicable law
5. Maintain your own records of processing activities as required by UK GDPR Article 30

5. Security measures

KingCare implements the following technical and organisational security measures:

5.1 Technical measures

• All data transmitted over public networks encrypted with TLS 1.2 or higher
• All data at rest encrypted using Microsoft Azure Transparent Data Encryption (AES-256)
• Passwords hashed using PBKDF2 with HMAC-SHA256 (10,000 iterations minimum)
• Role-based access control: staff only access records within their organisation
• Organisation-level data isolation: each organisation's data is logically separated in a shared database with row-level tenancy enforcement
• Audit logs recording all access to and modification of Children's Data

5.2 Organisational measures

• Access to production systems is restricted to authorised personnel only
• All personnel with access to personal data are bound by confidentiality obligations
• Security incidents are escalated and responded to within 24 hours of detection
• This DPA and related security policies are reviewed at least annually

6. Sub-processors

You authorise KingCare to engage the following sub-processors. KingCare will notify you of any intended changes to this list (additions or replacements) with at least 14 days' notice, giving you the opportunity to object.

Stripe is the only sub-processor located outside the United Kingdom and the EEA. It processes billing contact information only and has no access to Children's Data. Stripe's data processing agreement forms part of its services agreement; confirmation on file.

7. International transfers

All personal data processed by KingCare, including special category data relating to children, is stored at rest in the United Kingdom on Microsoft Azure (UK South region). Email and communication services are provisioned with a United Kingdom data location. Application hosting is provided by Render Inc. from its Frankfurt, Germany region within the European Economic Area. No personal data is transferred outside the United Kingdom or the EEA in the normal course of processing.

Transfers from the United Kingdom to the EEA are permitted under the UK's adequacy regulations, so no additional transfer safeguards are required for that routing. Support access originating from outside the EEA is subject to our hosting provider's data processing terms; we are confirming the current contractual position.

8. Data subject rights

Where a child, their representative, or a staff member exercises a data subject right (access, erasure, rectification, portability) that relates to data processed by KingCare on your behalf:

• KingCare will promptly notify you of any such request received directly by KingCare
• KingCare will not respond to such requests except on your documented instruction
• KingCare will assist you technically in fulfilling such requests (e.g., data exports, targeted deletion)

You remain responsible for responding to data subjects within the statutory timeframes (one month under UK GDPR, extendable by two further months in complex cases).

9. Personal data breaches

In the event of a personal data breach affecting Children's Data, KingCare shall:

1. Notify you without undue delay and, where feasible, within 72 hours of becoming aware of the breach
2. Provide all available information about the breach: nature, categories of data, approximate number of individuals affected, likely consequences, and measures taken or proposed
3. Cooperate fully with your investigation and remediation efforts
4. Assist you in making any required notification to the ICO and/or affected data subjects

10. Audit rights

You have the right to audit KingCare's compliance with this DPA. In practice, audits will be conducted by:

• Reviewing this DPA and any supporting documentation provided by KingCare
• Requesting written confirmation of specific security measures
• Where necessary, an on-site audit conducted on reasonable notice (at least 30 days) and at your cost

KingCare may satisfy audit requests by providing current third-party audit reports (ISO 27001, SOC 2) from its sub-processors where available.

11. Return and deletion of data

On termination of the Service agreement, or on your written request:

• KingCare will provide a complete export of your Children's Data in JSON or CSV format within 14 days of request
• Following export confirmation, or after 90 days of account closure (whichever is earlier), KingCare will securely delete all Children's Data from its systems
• Deletion will be confirmed in writing
• Backup copies will be deleted within a further 30 days (consistent with backup rotation schedules)

Certain data may be retained where required by law (e.g., billing records for HMRC purposes — these do not include Children's Data).

12. Liability

Each party's liability under this DPA is subject to the limitations set out in the Terms of Service. Nothing in this DPA limits either party's liability to data subjects or supervisory authorities under applicable data protection law.

13. Governing law

This DPA is governed by the laws of England and Wales and is subject to the jurisdiction of the courts of England and Wales.

14. Contact

For all data protection matters relating to this DPA:
KingCare Ltd
Email: branson@kingcare.uk
ICO Registration: ZC253491
Registered address: Leicester, England, United Kingdom