Legal

Data processing agreement

Version 2026-10-26. This agreement is published in English; the English text governs. Este acuerdo se publica en inglés y el texto en inglés es el que rige.

It sets out how Carme handles the personal data an agency puts into the platform, as required by Article 28 of the UK GDPR and the EU GDPR; section 12 adds what US state health data laws ask of a processor. An agency that wants a countersigned copy can ask at privacy@carmesrm.com.

1. Parties and scope

1.1 This Data Processing Agreement (DPA) is between Carme, the provider of the platform at carmesrm.com (Carme, we), and the agency that accepts it (the Agency, you).

1.2 It forms part of the agreement under which Carme provides the platform to the Agency: any order or agreement signed with us, the terms of service, and this DPA (together, the Agreement). If they conflict on the protection of personal data, this DPA prevails.

1.3 It applies to all personal data that Carme processes on the Agency’s behalf in providing the platform (Agency Personal Data), described in Annex 1.

1.4 The Agency accepts this DPA by signing an order that refers to it, or by accepting the terms of service when creating its Carme account. The terms version accepted is recorded on the Agency’s account.

2. Definitions and roles

2.1 Data Protection Law means the UK GDPR, the Data Protection Act 2018 and, where they apply to the processing, the EU GDPR (Regulation (EU) 2016/679) and any other law of a country in which the Agency operates that governs the processing. Terms such as controller, processor, personal data, special category data, data subject, processing and personal data breach have the meanings given in the GDPR.

2.2 For Agency Personal Data, the Agency is the controller and Carme is the processor. The Agency decides why and how the data is used; Carme processes it only to provide the platform.

2.3 Carme is a controller only for the account and sign-in details of the Agency’s own staff users (as needed to secure and bill the service), billing and contract records with the Agency, and visitors to Carme’s public website. Those are covered by our privacy notice, not by this DPA.

2.4 Sub-processor means a third party engaged by Carme that processes Agency Personal Data. Platform Personnel means Carme’s own staff and contractors.

3. Carme’s obligations as processor

3.1 Instructions. Carme processes Agency Personal Data only on the Agency’s documented instructions, unless the law of the UK or an EU member state requires otherwise; in that case Carme tells the Agency first, unless that law forbids it. The Agreement, the Agency’s configuration of the platform (modules switched on, who is invited, what is shared with whom) and the actions of its users are the Agency’s complete instructions. Carme will tell the Agency promptly if it believes an instruction breaks Data Protection Law.

3.2 No other use. Carme does not sell Agency Personal Data, does not use it to train any machine-learning model, does not share it, does not show the Agency or any other agency figures drawn from another agency’s data, does not use it for benchmarking or analytics offered to anyone else, and never contacts the Agency’s intended parents, surrogates or donors for its own purposes.

3.3 Confidentiality. Carme ensures that Platform Personnel authorised to process Agency Personal Data are bound by a duty of confidentiality, and that access is limited to those who need it to run, secure or support the platform.

3.4 Platform access by Carme. Platform Personnel do not routinely view Agency Personal Data. They may access an Agency’s account only to provide support the Agency has asked for, to investigate a security incident or fault, or where the law requires. When they sign in to the Agency’s account or preview its portals from inside Carme, that is recorded in the Agency’s audit log, which the Agency’s administrators can read. Direct access to the database, which is limited to named Platform Personnel, is not recorded in that log.

3.5 Security. Carme implements the technical and organisational measures in Annex 2, appropriate to the risk of special category data, in line with Article 32 GDPR.

3.6 Sub-processors. Carme engages Sub-processors only as set out in section 4.

3.7 Data subject requests. Taking into account the nature of the processing, Carme assists the Agency, through the platform’s tools (access, export, correction and deletion) and otherwise where needed, to respond to requests from data subjects. If Carme receives a request directly, it passes it to the Agency without undue delay and does not answer it itself unless the Agency instructs it to.

3.8 Compliance assistance. Carme assists the Agency with its obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation), taking into account the nature of the processing and the information available to Carme.

3.9 Return and deletion. At the end of the Agreement Carme returns and deletes Agency Personal Data as set out in section 9.

3.10 Information and audits. Carme makes available the information needed to demonstrate compliance with this DPA and allows for audits as set out in section 8.

4. Sub-processors

4.1 General authorisation. The Agency gives Carme general written authorisation to engage the Sub-processors listed in Annex 3, and further Sub-processors under 4.3.

4.2 Optional services. Sub-processors marked optional in Annex 3 receive Agency Personal Data only if the Agency switches the related feature on. The Agency can switch each one off at any time in its settings.

4.3 Changes. Carme will give the Agency at least 30 days’ notice, by email to its administrators and by updating this page, before adding or replacing a Sub-processor. The Agency may object on reasonable data-protection grounds within that period. If the parties cannot resolve the objection, the Agency may end the affected part of the Agreement without penalty and receive a pro-rata refund of any prepaid fees for it.

4.4 Flow-down. Carme imposes on each Sub-processor, by written contract, data protection obligations no less protective than those in this DPA, in particular sufficient guarantees of appropriate technical and organisational measures. Carme remains fully liable to the Agency for each Sub-processor’s performance of those obligations.

5. International transfers

5.1 Primary location. The platform’s database, sign-in and file storage are hosted in the European Union (Dublin, Ireland), and the application servers run in the same region. Encrypted backups are kept in the EU.

5.2 Transfers. Some Sub-processors may process Agency Personal Data outside the UK and the EEA, mainly in the United States (see Annex 3). Carme makes such a transfer only where it is covered by a valid transfer mechanism: an adequacy decision or regulation (including the EU–US Data Privacy Framework and its UK Extension, where the recipient is certified), or the European Commission’s Standard Contractual Clauses with, for UK data, the UK International Data Transfer Addendum, together with any supplementary measures needed.

5.3 Transfers by the Agency. Where the Agency is outside the UK and the EEA, or gives access to users outside them, that access is a transfer made by the Agency, which is responsible for its lawfulness.

5.4 Assistance. On request, Carme will give the Agency the information it reasonably needs to complete a transfer risk assessment.

6. Security

6.1 Carme maintains the measures in Annex 2 for the life of the Agreement. It may update them, provided the overall level of protection does not fall.

6.2 The Agency’s part. The Agency is responsible for the security choices the platform leaves to it: who it invites and in what role, what it shares with each intended parent, surrogate or other party, its users’ passwords and devices, whether two-step sign-in is required for each role (it starts switched on for staff of a new agency), and the lawful basis for the data it uploads.

7. Personal data breaches

7.1 Carme will notify the Agency without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Agency Personal Data. Notice goes by email to the Agency’s administrators.

7.2 The notice will describe, as far as then known: what happened and when; the categories and approximate number of data subjects and records affected; the likely consequences; the measures taken or proposed; and a contact at Carme. Where not everything is known at once, Carme will give the information in phases as it becomes available.

7.3 Carme will take reasonable steps to contain the breach and reduce its effects, and will cooperate with the Agency so that the Agency can decide whether to notify its supervisory authority (within 72 hours of becoming aware) and the data subjects. Carme will not notify the Agency’s data subjects or regulators about the breach itself unless the Agency agrees or the law requires it.

7.4 Notifying a breach is not an admission of fault or liability.

8. Assistance, records and audits

8.1 Carme keeps a record of its processing activities on the Agency’s behalf as required by Article 30(2) GDPR.

8.2 On written request, no more than once a year (or at any time after a personal data breach or at a regulator’s request), Carme will answer the Agency’s reasonable security questionnaire and provide relevant documentation, including its current description of security measures, Sub-processor list and incident procedure.

8.3 If that information is not enough to show compliance, the Agency (or an independent auditor bound by confidentiality who is not a competitor of Carme) may audit Carme’s compliance with this DPA, on at least 30 days’ notice, during business hours, at the Agency’s cost, and in a way that does not compromise other customers’ data or Carme’s security. Sub-processors are audited by relying on their own certifications and reports where available.

8.4 Carme does not yet hold an independent certification of its own (such as ISO 27001 or SOC 2), and will say so in any questionnaire.

9. Return and deletion

9.1 During the Agreement the Agency can export its data at any time, and delete records using the platform’s tools.

9.2 On termination, Carme will keep the Agency’s account available in read-only form for 30 days so the Agency can export its data, and will provide a full export in a machine-readable format (CSV and the original uploaded files) on request during that period.

9.3 After that period, Carme will delete Agency Personal Data from the live platform when the Agency asks in writing to privacy@carmesrm.com, and will confirm in writing when it is done. Until then the data stays protected under this DPA and is not used for any purpose.

9.4 Backups. Copies in encrypted backups are not altered individually; they expire on their normal cycle, no more than 35 days after deletion from the live platform, and are not restored in the meantime except to recover from a disaster, in which case deleted data is deleted again.

9.5 Carme may keep Agency Personal Data longer only where UK or EU member state law requires it, and then only that data, kept confidential and processed for no other purpose.

10. Liability

10.1 Each party’s liability under this DPA is subject to the limitations and exclusions of liability in the Agreement.

10.2 Nothing in this DPA limits either party’s liability to data subjects or regulators under Article 82 GDPR, or any liability that cannot be limited by law.

11. Term, changes and governing law

11.1 This DPA lasts as long as Carme processes Agency Personal Data, and survives the end of the Agreement until deletion under section 9 is complete.

11.2 Carme may update this DPA where needed to comply with Data Protection Law or a regulator’s guidance, giving at least 30 days’ notice. Any other change that reduces the Agency’s protection needs the Agency’s agreement. Each version is dated at the top of this page.

11.3 This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction, except where the Standard Contractual Clauses require another law or forum for their own purposes.

12. US state health data addendum

12.1 When it applies. This section applies to Agency Personal Data that is “consumer health data”, “medical information” or a similar category under a US state law that applies to the Agency, including the Washington My Health My Data Act (RCW chapter 19.373), Nevada’s consumer health data law (Senate Bill 370 of 2023, codified in NRS chapter 603A), the consumer health data provisions of the Connecticut Data Privacy Act (Conn. Gen. Stat. § 42-515 and following), the California Confidentiality of Medical Information Act (Cal. Civ. Code § 56 and following) and, where it applies, the California Consumer Privacy Act (together, US Health Data Laws). It adds to the rest of this DPA; where the two differ for that data, the more protective rule applies.

12.2 Roles. For that data the Agency is the regulated entity, controller or business, and Carme is its processor, service provider or contractor, as those laws use the terms. This DPA is the binding contract between them that those laws require, and sections 3.1 and 3.2 are the Agency’s processing instructions and the limits on Carme’s processing.

12.3 Only on instructions. Carme processes consumer health data only to provide the platform to the Agency, on the Agency’s instructions, and for no other purpose. Carme does not retain, use or disclose it outside its direct business relationship with the Agency.

12.4 No sale, no advertising, no own use. Carme does not sell consumer health data or offer it for sale, does not share it with third parties for their own purposes, does not use it for targeted or cross-context behavioural advertising, does not combine it with data from other sources, does not show any agency figures drawn from another agency’s data, and does not use it for its own purposes.

12.5 Confidentiality and access. Only Platform Personnel who need access to run, secure or support the platform may reach consumer health data, each under a duty of confidentiality, and Carme protects it with the measures in Annex 2.

12.6 Consumer requests. Carme helps the Agency answer requests made under US Health Data Laws, including to confirm what is held and give access to it, to list the processors and third parties that received it (Annex 3), to delete it, and to withdraw consent to its collection or sharing. Most of this the Agency can do itself with the platform’s tools. Where it needs Carme, Carme will act without undue delay on the Agency’s written instruction and in time for the Agency to meet its statutory deadline (45 days under the Washington, Nevada and Connecticut laws), provided the Agency passes the request on promptly. A request that reaches Carme directly is passed to the Agency under section 3.7.

12.7 Deletion. When the Agency tells Carme that a consumer’s health data must be deleted, Carme deletes it from the live platform, to the extent the Agency has not already done so with the platform’s tools, and tells each Sub-processor that holds it to do the same. Copies in encrypted backups expire as set out in section 9.4. On termination, section 9 applies.

12.8 Sub-processors. The obligations in this section flow down to Sub-processors under section 4.4, including the duty to delete.

12.9 No geofencing. Carme does not create, and will not create, a virtual boundary (geofence) around any place that provides in-person health care, mental health, or reproductive or sexual health services, to identify or track consumers, collect their data or send them messages or advertisements. The platform does not collect the precise location of devices.

12.10 California medical information. Carme keeps medical information confidential, discloses it only to provide the platform on the Agency’s instructions or where the law requires, never uses it for marketing, and stores and protects it with the measures in Annex 2.

12.11 If Carme cannot comply. Carme will tell the Agency promptly if it can no longer meet its obligations under this section or a US Health Data Law, including where a record cannot be deleted without breaking the integrity of the audit trail, which no user can edit or delete; in that case Carme will say what remains and why. The Agency may then take reasonable steps to stop and remedy any processing it has not authorised, including suspending the affected processing.

12.12 Breaches. Section 7 applies to consumer health data.

12.13 The Agency’s part. The Agency decides which US Health Data Laws apply to it and is responsible for meeting the obligations they place on a regulated entity or controller, including publishing any required consumer health data privacy policy, obtaining any consent required to collect or share consumer health data, and responding to consumers within the statutory deadlines. The platform does not collect those consents for the Agency.

Annex 1: Details of the processing

Annex 2: Technical and organisational measures

These describe the platform as it runs today.

Separation between agencies and people

• Every table holding Agency Personal Data is protected by access rules enforced in the database itself (row-level security), not only in the interface, so one agency’s users cannot read another’s data even through the API.
• Within an agency, access follows role: administrator, coordinator, viewer and lawyer for staff; an intended parent sees only their own journey; a surrogate sees only her own records, and on a journey with two surrogates each sees only what is hers. Visibility is set document by document, and each conversation has fixed members.
• Uploaded files are stored per agency and per journey, and each request is checked against the same rules.
• An internal security review on 24 October 2026 attempted cross-agency and cross-person access; the gaps it found were fixed and are covered by automated tests. No third-party test has been done yet.

Sign-in and accounts

• Passwords of at least 10 characters, checked against common and known-breached passwords, and not the user’s own name or email.
• Two-step sign-in (authenticator app, with an emailed code as a guarded fallback) available to all users; switched on for all staff of a new agency, which the Agency’s administrator can change for each role; always required for platform administrators; the Agency can require it for families too. Resetting someone’s two-step sign-in ends all their sessions.
• Bot protection on the sign-in page; accounts are created only by invitation or through Carme’s own agency sign-up.
• Disabled users are blocked and all their sessions ended.

Encryption

• TLS on every connection.
• Encryption at rest on the database and file storage.
• Carme’s own backups are encrypted before they are stored, on Carme’s equipment or offsite.

Audit and monitoring

• An audit log records every change to records (who, when, and the record after the change), cannot be edited or deleted by any user, and is readable by the Agency’s administrators. Reads and message sends are not in the log; messages themselves are kept. Sign-in to the Agency’s account by Platform Personnel from inside Carme is logged; direct database access is not.
• Automated monitoring every 15 minutes covers scheduled jobs, application errors, email delivery and backups, with alerts to Carme.
• Email delivery and bounces are recorded.

Resilience and backups

• Hosting in one EU region (Dublin, Ireland).
• Daily backups by the database provider.
• A separate nightly, verified and encrypted backup of the database and files, taken by a scheduled job on Carme’s own encrypted computer, with the offsite copy kept for 30 days in the EU under a 30-day immutability lock.
• Deployments can be rolled back instantly.

Organisation

• A written incident-response procedure covers rollback, key rotation and breach notification.
• Secrets are held in the hosting provider’s encrypted configuration, never in code.
• Access to production systems is limited to named Platform Personnel.
• Optional third-party services can be switched off per agency.
• The portals and emails carry the Agency’s name, logo and colours, with a small “Powered by Carme” line at the foot of each email. Carme never contacts the Agency’s clients for its own purposes.

Not yet in place

• No ISO 27001 or SOC 2 certification.
• No independent penetration test yet.
• No customer-managed encryption keys.

Annex 3: Sub-processors

Not sub-processors: Stripe handles Carme’s billing with the Agency and receives no data about the Agency’s clients. Monday.com: if the Agency imports from its own Monday account, Monday is the Agency’s own provider, and Carme reads from it only on the Agency’s instruction.

Questions about this agreement: privacy@carmesrm.com.