Data Processing Addendum

For personal data the Customer collects and manages through the service (leads, conversations, contacts, appointments, and CRM records of the Customer's own end customers, "Customer Personal Data"), the Customer is the controller, or a processor for another controller, and ParFlow is the Customer's processor and service provider. This DPA does not apply to data for which ParFlow is itself the controller (such as the Customer's own account and billing data), which is governed by our Privacy Policy (/privacy-policy).

• Process Customer Personal Data only on the Customer's documented instructions, given through the service's settings and features, the Terms of Service, and this DPA, unless the law requires otherwise (in which case we will inform the Customer unless prohibited).
• Ensure persons authorised to process the data are bound by confidentiality obligations.
• Implement appropriate technical and organisational security measures, including encryption in transit and at rest, access controls, and separation between customer accounts.
• Assist the Customer, insofar as reasonably possible, in responding to data subject requests (access, correction, deletion, objection) concerning Customer Personal Data.
• Notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, with the information reasonably available to us.
• Assist the Customer, with information reasonably available to us, in meeting its own security, breach notification, and impact assessment obligations.

The Customer gives general authorisation to use third-party providers in the categories described on our Third-Party Processing page (/subprocessors), such as cloud hosting and database infrastructure, AI processing, communications, email delivery, payment processing, and calendar integration. We update that page before introducing a new category of processing that involves Customer Personal Data. If the Customer has a reasonable data protection objection to such a change, it should contact us within 14 days of the update; if we cannot offer a reasonable alternative, the Customer may cancel the affected subscription. We remain responsible for our providers' performance and bind them to data protection obligations no less protective than this DPA. For verified business customers, additional provider information may be made available under a commercial or data processing agreement where appropriate.

ParFlow is operated from Israel, which benefits from a European Commission adequacy decision, and Customer Personal Data may be processed in other countries, including the United States and the European Union. Where data is transferred to a country without an adequacy decision, we rely on appropriate safeguards recognised under applicable data protection law.

To generate agent responses, summaries, and search, relevant conversation content and configured business context are processed by AI service providers. If voice features are enabled, audio or transcripts may be processed to provide the feature. Our AI providers are contractually restricted from using this data to train generally available models. Enabling an agent constitutes the Customer's instruction for this processing.

During the subscription, the Customer manages Customer Personal Data through the service, including deleting records. Upon termination, we delete or anonymise Customer Personal Data in accordance with the retention approach described in our Privacy Policy, unless the law requires longer retention. The Customer may request a copy of its Customer Personal Data, or earlier deletion, by written request to us before or within 30 days after termination.

On reasonable written request, we will make available information reasonably necessary to demonstrate compliance with this DPA, such as a description of our security measures and our third-party processing categories. As an early-stage service we do not operate an on-site audit programme or hold third-party certifications; where an audit is legally required, it will be satisfied through written documentation to the extent the law allows.

In case of conflict between this DPA and the Terms of Service regarding the processing of Customer Personal Data, this DPA prevails. Governing law and jurisdiction follow the Terms of Service. We may update this DPA to reflect legal or service changes; material changes will be notified in advance, and the date above always reflects the current version.

Questions about this DPA? Email us at Lior@parflow.cc.