Data Processing Agreement
This Data Processing Agreement (DPA) is made pursuant to Article 28 of the General Data Protection Regulation (GDPR) and forms part of the Terms of Service. It governs the processing of personal data by ClientFlow on behalf of our customers.
Version 2.2 | Last Updated: October 5, 2026
1. Parties
Data Controller
You, the customer (the entity determining the purposes and means of processing)
Data Processor
ClientFlow (processing personal data on your behalf)
1.1 Scope of Processing
This DPA applies to the processing of personal data where:
- ClientFlow processes personal data on behalf of the Controller as part of providing the Service
- The processing relates to the management of the Controller's client relationships
- The data subjects are the Controller's clients and business contacts
- ClientFlow is business-management software, not a medical-records or clinical system. Where the Controller records health or other special-category data about its clients, the Controller determines the lawful basis and obtains any explicit consent required, and ClientFlow processes that data only on the Controller's documented instructions
Processing Activities
- Storage and organisation of client contact information
- Recording and tracking of payment transactions
- Sending of authorised communications (reminders, notifications)
- Generation of analytics and reports based on aggregated data
2. Data Categories
| Category | Examples | Purpose |
|---|---|---|
| Account Data | Email, name, profile picture | Service access |
| Customer Data | Client names, phones, emails | CRM functionality |
| Payment Records | Amounts, dates, statuses | Payment tracking |
| Usage Data | Login times, feature usage | Security, improvement |
3. Processor Obligations
We Will:
- Process data only on your documented instructions
- Ensure personnel are bound by confidentiality
- Implement appropriate security measures
- Assist with data subject requests
- Notify you of data breaches within 72 hours
- Delete data upon termination (after retention period)
4. Security Measures
Technical
- TLS (transit)
- AES-256-GCM at rest (session notes, outcome records, integration credentials, payment tokens, two-factor secrets)
- OAuth 2.0 authentication
- Role-based access control
- Automated monitoring and alerting
Organisational
- Written security and data handling practices
- Incident response procedure
- Vendor and sub-processor reviews
- Confidentiality obligations for anyone with data access
- Change management for production systems
5. Sub-processors
We use the following authorised sub-processors:
| Provider | Service | Location | Transfer mechanism |
|---|---|---|---|
| Hetzner Cloud | Cloud infrastructure & hosting | Germany | Processed inside the EU/EEA |
| Vercel | Frontend hosting & delivery | Frankfurt, Germany (FRA1) | Standard Contractual Clauses + EU–US Data Privacy Framework |
| Cloudflare | Content delivery & file storage | Global edge network (EU primary storage) | Standard Contractual Clauses + EU–US Data Privacy Framework |
| iyzico | Payment processing | Istanbul, Turkey | Standard Contractual Clauses (not yet in force) |
| Resend | Transactional email delivery | United States | Standard Contractual Clauses |
| Sentry | Error monitoring & diagnostics | United States | Standard Contractual Clauses |
| Google (OAuth, Analytics) | Sign-in & authentication | United States | Standard Contractual Clauses + EU–US Data Privacy Framework |
| Firebase Cloud Messaging | Push notifications | United States | Standard Contractual Clauses + EU–US Data Privacy Framework |
| Expo (push relay, OTA updates) | Push notifications | United States | Standard Contractual Clauses |
| WhatsApp Business API | WhatsApp messaging | Ireland (contracting) + global (Meta infrastructure) | Standard Contractual Clauses |
| Apple (Sign in with Apple) | Sign-in & authentication | United States | Standard Contractual Clauses |
| Anthropic (Claude) | AI assistant & chatbot processing | United States | Standard Contractual Clauses + EU–US Data Privacy Framework |
| OpenAI | AI assistant & chatbot processing | United States | Standard Contractual Clauses + EU–US Data Privacy Framework |
| Groq | AI assistant & chatbot processing | United States | Standard Contractual Clauses (not yet in force) |
| Meta (Facebook Login) | Sign-in & authentication | Ireland (EEA controller) + global (Meta infrastructure) | Standard Contractual Clauses (not yet in force) |
| Google (reCAPTCHA) | Bot & abuse protection | United States | Standard Contractual Clauses (not yet in force) |
| Google (Gmail, customer-connected) | Transactional email delivery | United States | Standard Contractual Clauses (not yet in force) |
| Google (Calendar sync, customer-connected) | Calendar sync | United States | Standard Contractual Clauses (not yet in force) |
| Microsoft (Outlook mail, customer-connected) | Transactional email delivery | United States | Standard Contractual Clauses (not yet in force) |
| Apple (iCloud Mail, customer-connected) | Transactional email delivery | United States | Standard Contractual Clauses (not yet in force) |
| Apple (iCloud Calendar, customer-connected) | Calendar sync | United States | Standard Contractual Clauses (not yet in force) |
| Yahoo (Yahoo Mail, customer-connected) | Transactional email delivery | United States | Standard Contractual Clauses (not yet in force) |
| OpenStreetMap (map tiles, address search) | Map display & address search | United Kingdom and Netherlands (tile requests: global CDN) | Standard Contractual Clauses (not yet in force) |
| CARTO (dark-theme map tiles) | Map display & address search | United States | Standard Contractual Clauses (not yet in force) |
Sub-processor Changes
We will notify you of any intended changes to sub-processors:
- At least 14 days' advance notice before adding or replacing sub-processors
- Notification via email to your registered account email address
- You may object to changes within 14 days by contacting us
- If your objection cannot be resolved, you may terminate the affected services
5.1 Audit Rights
The Controller has the right to verify compliance with this DPA:
- Request relevant documentation and certifications
- Conduct audits with at least 30 days' written notice
- Audits shall be conducted during normal business hours
- Auditor must sign a confidentiality agreement
Audit Scope
- Security measures and technical safeguards
- Sub-processor compliance
- Data handling procedures
- Incident response capabilities
Costs for audits shall be borne by the Controller unless the audit reveals material non-compliance.
6. Data Retention & Deletion
We retain personal data only as long as necessary for the purposes described, or for as long as applicable tax and commercial law requires.
| Timeline | Action |
|---|---|
| On account deletion request | Customer data is permanently erased with your account: within a day after the 30-day grace period that follows a deletion request on our website (which you can cancel until the grace period ends), or within 3 days when the account is deleted in the iOS app. The invoices, receipts and estimates you issue to your own clients are your records — they are erased with your account on the same timeline. |
| After account erasure | ClientFlow's own accounting records of your subscription (our invoices to you) are kept in anonymised form (no personal data) for at least as long as tax and commercial law require. |
| On termination | When you delete your account, personal data is erased within 31 days (within 3 days in the iOS app), except the records we must retain (such as audit logs and anonymised billing records); encrypted backups rotate out within 90 days. Cancelling a subscription does not delete data |
7. CCPA Provisions
Under CCPA, we act as a "Service Provider" and:
- Process data only for specified business purposes
- Do not sell personal information
- Assist with consumer rights requests
- Implement reasonable security measures
8. Data Breach Notification
In the event of a personal data breach, we commit to the following:
Notification Timeline
- Notify you within 72 hours of becoming aware of a breach
- Provide initial assessment of the breach scope and impact
- Deliver detailed written notification within 5 business days
Notification Content
- Nature of the breach including categories and approximate number of data subjects affected
- Privacy contact details for follow-up questions
- Description of likely consequences of the breach
- Measures taken or proposed to address the breach
- Measures to mitigate possible adverse effects
We will cooperate fully with your investigation and any regulatory enquiries, and assist with breach notifications to supervisory authorities and affected individuals as required by applicable law.
9. International Data Transfers
When personal data is transferred outside the European Economic Area (EEA), we rely on the safeguard shown for each recipient on our sub-processors page, which also shows where a safeguard is not yet in force:
Transfer Mechanisms
EU Adequacy Decisions
Transfers to countries deemed adequate by the European Commission
EU-US Data Privacy Framework
For US-based processors certified under the DPF
Standard Contractual Clauses (SCCs)
EU Commission approved clauses (2021 version) for other transfers
We conduct transfer impact assessments where required and implement supplementary measures (technical, organisational, and contractual) when necessary to ensure an essentially equivalent level of protection.
You may request copies of the relevant transfer mechanisms upon request.
10. Liability and Indemnification
Processor Liability
ClientFlow shall be liable for damages caused by processing that does not comply with this DPA or where we have acted outside or contrary to lawful instructions of the Controller.
Controller Liability
The Controller shall be liable for damages caused by processing that violates applicable data protection law or does not comply with the Controller's obligations under this DPA.
Limitations
- Neither party shall be liable for indirect, incidental, or consequential damages
- Total aggregate liability under this DPA is limited to fees paid in the 12 months preceding the claim
- These limitations do not apply to breaches of confidentiality, wilful misconduct, or gross negligence
Each party agrees to indemnify the other against third-party claims arising from the indemnifying party's breach of this DPA or applicable data protection laws.
11. Termination and Data Return
Duration
This DPA remains in effect for the duration of the Service Agreement and for as long as we process personal data on your behalf.
Upon Termination
- At your choice, we will return or delete your personal data within 31 days, except the records we must retain (such as audit logs and anonymised billing records)
- You may request data export in a commonly used machine-readable format
- We will certify deletion upon request
- Data may be retained where required by applicable law
Sections relating to confidentiality, liability, and data protection rights shall survive termination of this DPA.