Skip to content

Legal

Data processing agreement

The Article 28 terms that apply when your agency's records are processed by us. Published rather than sent on request.

Last updated:

Written in plain English to be read rather than to be bulletproof. Have your own adviser review it before you rely on it, and tell us if they want it changed. We would rather read a redline than lose you to a clause.

This agreement applies between you (the agency using Rostavo, the controller) and us (Rostavo, the processor) for the personal data we process on your behalf. It forms part of our terms of service, and it takes effect when you start using the software. You do not need to sign anything for it to apply, and you may ask us for a countersigned copy.

It covers everything your agency stores about its staff, its candidates, its clients and the people they care for. It does not cover your own account and billing details, where we are the controller: those are in the privacy policy.

1. What we may do with it

We process the data only on your documented instructions, which are: operating the software for you, keeping it working, and doing what you ask when you ask for support. Using the software is itself an instruction. We do not use your agency's data to advertise to anybody, we do not sell it, and we do not use it to train machine-learning models. If a law ever required us to process it some other way we would tell you first unless that law forbade it.

2. Confidentiality

Everybody with access is bound to confidentiality and only has access where their job needs it. Support access to an agency's account is logged with the identity of the person who used it, and a support session that stands in as one of your users shows a banner in that session throughout, so nobody can be inside your account invisibly.

3. Security

We keep the technical and organisational measures in Annex II, which lists what is actually implemented rather than what would sound good. We may change them, but not in a way that materially weakens security.

4. Other companies we use

You give us general authorisation to use the sub-processors in Annex III. Each is bound by terms no weaker than these, and we stay responsible to you for what they do. If we add or replace one we will say so on this page and email the account owner at least 30 days before it starts processing anything. If you object on reasonable data-protection grounds within those 30 days and we cannot offer an alternative, you may stop using the service and we will refund the unused part of the period you have paid for.

5. Where the data is

Processing happens where our infrastructure is, and we say where that is on the security page rather than burying it. That is Oracle Cloud Infrastructure's Frankfurt region, in Germany, so the personal data you entrust to us is processed inside the EU and no restricted transfer arises from our hosting. Until 17 October 2026 it ran from Oracle's Hyderabad region in India, under the standard contractual clauses in our agreement with Oracle; that arrangement is no longer relied upon for hosting.

For transfers between us and you, the UK Addendum and the EU standard contractual clauses are incorporated by reference where they are needed, with this agreement supplying the descriptions they require.

6. Helping you answer people

When somebody exercises a right, the tools are in the software and you do not need us:

  • Access and portability. Settings gives you the whole account as one structured file, at any time.
  • Erasure. Erasing a worker, a client or an applicant destroys their attachments, free text, messages and login, keeping only an anonymised record where law requires the financial history kept. A soft delete is not an erasure and we do not count it as one.
  • Rectification. Every field a person could ask you to correct is editable by you.

If a request reaches us directly we will not answer it ourselves. We will pass it to you and tell you we have, because you are the controller and it is your answer to give. Where you need help beyond the built-in tools we will give it, and we will not charge for the first request in any year.

7. If something goes wrong

If we become aware of a personal data breach affecting your data we will tell you without undue delay and in any case within 48 hours, with what we know, what we are doing, and what we do not yet know. We will not wait until we have the full picture, because your own 72-hour clock starts when you find out and not when we finish investigating. We will help you make any notification you have to make.

8. Audit

We will give you the information you reasonably need to show you are meeting Article 28, and we will answer a security questionnaire. If you need to audit us, or have somebody do it for you, we will cooperate on reasonable notice, no more than once a year unless something has actually gone wrong, and at your cost except where the audit finds a material failure by us, in which case it is ours.

9. When you leave

Export everything first; the tool is in the software and it keeps working while your account is open. We delete on request and not on a timer. Close the account from Settings → Data protection, or ask us, and it is destroyed then, including the files on disk and the logins attached to it. We do not run an automatic deletion after a dormancy period, and we would rather say so than imply a tidiness we have not built: a lapsed payment is not a decision to destroy records you may still be required to produce. Backups age out on their own 14-day cycle rather than being edited, so a copy can persist that long afterwards. We keep only what the law requires, which is invoice records, and nothing else.

10. Liability and precedence

The limits of liability in the terms of service apply to this agreement too. Where this agreement and those terms disagree about personal data, this agreement wins.

Annex I: what is processed

  • Subject matter: providing the Rostavo software to your agency.
  • Duration: for as long as your account is open, plus the deletion period in clause 9.
  • Nature and purpose: scheduling work, managing staff and clients, recruiting, tracking documents and training, messaging, invoicing, payments and payouts, and reporting.
  • Categories of data subject: your office staff, your workers and candidates, your clients, and the people they care for, who may include children.
  • Types of personal data: names, contact details, addresses, dates of birth, work history, references, right-to-work and background-check status, uploaded documents and certificates, availability, time worked and location at check-in, messages, visit notes and photos, invoices and amounts, and bank or payment details where you use payouts or card payment.
  • Special category data: possible and expected. Care notes, allergy and dietary information, health and access needs, and anything a user types into a free-text field. Data about children is likely in childcare and care verticals. Treat it as present.

Annex II: security measures

  • Separation. Every record carries the agency that owns it and the filter is applied by the framework on every query, not remembered by whoever wrote the screen. It has its own test suite, and a scheduled job audits for any login that has drifted between agencies.
  • Access control. Roles decide which parts of the system a person can open, enforced server-side on every request rather than by hiding buttons. Families and workers cannot reach the back office at all.
  • Authentication. Passwords are at least 12 characters and checked against known breach corpora. Two-factor authentication is available to every role. Changing an email or password notifies the previous address as well as the new one and signs every other session out.
  • Encryption. TLS on every connection. Secrets are held in environment configuration, not in the codebase.
  • Private files. Documents and visit photos are on a private disk and served only after checking that the person asking is entitled to them.
  • Consent on photos. Permission to reuse a visit photo is recorded per photo, and "not asked" is stored as a different state from "no" so it can never be read as permission.
  • Backups. Nightly database dumps, retained 14 days.
  • Logging. An audit trail of significant changes, including who did them and whether it was done through support access.
  • No uninvited third parties. No analytics, session recording or advertising script loads without consent, session recording is never offered inside the product, and webfonts are served from our own origin. An automated test fails the build if any off-origin script appears in a page we serve.
  • Testing. An automated suite covering access control, tenant separation and erasure runs before every deploy.

What we do not have, said here rather than left to be discovered: we are not SOC 2 audited and not ISO 27001 certified. See security.

Annex III: sub-processors

  • Oracle Cloud Infrastructure. hosting and storage. Germany (Frankfurt), inside the EU. All data.
  • Resend. outbound email. Names, email addresses, and whatever a message contains.
  • Stripe. card payments, where you switch them on. Payer name, email and payment details. Card numbers never reach us.
  • Sentry. error reports. Technical diagnostics, which can incidentally include an identifier of the signed-in user.
  • Anthropic. AI-assisted shift matching, where enabled. A shift's time, length, town and notes, plus the name and internal match scores of up to fifteen candidates. No addresses, contact details or documents.
  • Checkr. background checks, only for agencies that have connected it. Candidate identity details needed to run the check.

That is the whole list. A company appears here when we are genuinely sending it data, not when we have merely built an integration.

Questions, or a redline

Email hello@rostavo.com. If your adviser wants changes we will read them, and if they are reasonable we will make them.