Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Flare Reply (“Processor”) and the Customer (“Controller”). It applies when we process personal data of leads and other individuals on the Customer’s behalf (“Customer Personal Data”). It is designed to meet India’s Digital Personal Data Protection Act, 2023 (where we are a Data Processor for the Customer as Data Fiduciary), Article 28 of the EU and UK GDPR, and similar laws.

An agency that manages client workspaces is the Controller towards us for those workspaces and is responsible for its own agreement with each client.

We process Customer Personal Data only on the Customer’s documented instructions, which are these Terms and the settings the Customer chooses in the Service (for example which Pages to connect, which stages send to Meta, whether to sync a sheet). We will tell the Customer if we believe an instruction breaks the law. We never sell Customer Personal Data or use it for our own purposes.

Everyone at our company or acting for us who can access Customer Personal Data is bound by confidentiality obligations, and access is limited to what each person needs.

• Encryption in transit (TLS) for every connection and at rest by our database provider; Meta and WhatsApp access tokens additionally encrypted with AES-256-GCM.
• Separation of every workspace enforced in the database (row-level security), checked daily by an automated isolation report.
• Role-based access inside each account (agency admin, client admin, sales manager, sales rep) and an audit log of changes to settings, connections, team access and billing.
• Signature verification of every Meta and Razorpay webhook; one-time codes stored only as hashes.
• Monitoring of event delivery and failures, with alerts; backups by our database provider.

More detail is on our Security page. We may update these measures as long as the overall level of protection does not decrease.

We help the Customer, taking into account the nature of the processing, to respond to requests from individuals (export, correction, deletion, retention settings are built into the Service), to carry out data protection impact assessments, and to consult authorities where needed. Deletion requests we receive directly for a Customer’s leads are passed to that Customer and carried out in the Service.

The Customer authorises the subprocessors listed on our Subprocessors page. We impose data protection obligations on each that are no less protective than this DPA and remain responsible for them. We update that page before adding or replacing a subprocessor; a Customer may object on reasonable data protection grounds within 15 days by emailing the email address shown in your account, and if we cannot address the objection the Customer may end the affected service and receive a refund of prepaid fees for it.

Where Customer Personal Data is transferred outside India or the European Economic Area, we use lawful transfer mechanisms such as the European Commission’s Standard Contractual Clauses, and do not transfer data to countries restricted under applicable law.

We notify the Customer without undue delay, and in any case within 48 hours of becoming aware of a breach affecting Customer Personal Data, with the information the Customer needs to meet its own obligations (including reporting to the Data Protection Board of India or another authority), and we take reasonable steps to contain it.

The Customer can export Customer Personal Data at any time. When a workspace or account is deleted, or 30 days after the agreement ends, we delete the Customer Personal Data in it, except where the law requires us to keep it. Data in backups is overwritten on our provider’s backup cycle.

We make available the information reasonably needed to show compliance with this DPA, including answers to security questionnaires. Where that is not enough, the Customer may audit us once a year with 30 days’ notice, at its own cost, under confidentiality. Requests to the email address shown in your account.

If this DPA conflicts with the Terms, this DPA prevails for Customer Personal Data. Signed copies are available on request from the email address shown in your account.