This Data Processing Agreement (DPA) forms part of the agreement between you (the controller) and CertFlow LTD (the processor) and applies where we process personal data on your behalf.
Roles
You are the controller of the personal data you upload to CertFlow (for example, records relating to your staff and clients). We act as processor and process that data only on your documented instructions.
Scope of processing
We process personal data to provide the platform, storing, organising and making available the assets, inspections, certificates and contacts you create, for the duration of your subscription.
Security
We implement appropriate technical and organisational measures, including encryption in transit and at rest, access controls, audit logging and regular backups, as described on our Security page.
Sub-processors
We engage sub-processors (such as UK hosting providers) under contracts that impose data-protection obligations equivalent to those in this DPA. A current list is available on request, and we will give notice of changes.
Data subject rights
We will assist you, taking into account the nature of processing, in responding to requests from individuals exercising their rights under data-protection law.
Breach notification
We will notify you without undue delay after becoming aware of a personal-data breach affecting your data.
Return & deletion
On termination, we will, at your choice, return or delete the personal data we process on your behalf, subject to any legal retention requirements.