Data Processing Agreement

1. What this agreement is

This Data Processing Agreement (“DPA”) forms part of the Terms of service between RepublicFlow and the customer (“you”). It applies whenever we process personal data on your behalf, and is written to meet Article 28 of the UK GDPR and the EU GDPR.

If you process the personal data of people in the UK or EU through RepublicFlow, this DPA applies to you automatically — nothing needs to be signed.

2. Roles

• You are the controller. The contacts, conversations, media and order details belonging to your customers are yours. You decide why and how they are processed.
• We are the processor. We process that data only to provide the service and only on your documented instructions.
• Your use of the platform as configured — the numbers you connect, the backups you schedule, the agents you add, the exports you run — constitutes your documented instructions.
• We act as a controller only for our own customer records, which are covered by the Privacy policy.

3. Subject matter, duration, nature and purpose

Subject matter	Backup, storage, retrieval, routing and export of WhatsApp contacts, conversations and related order data; Cloud API message handling.
Duration	For as long as your account is active, plus the retention period in section 9.
Nature	Collection, storage, structuring, retrieval, display, transmission, export, erasure.
Purpose	Delivering business continuity, shared inbox, automation and Cloud API services to you.

4. Types of personal data and data subjects

Types of personal data: names and profile names, phone numbers, WhatsApp IDs, message content and attachments, order and payment references contained in conversations, timestamps, agent identifiers and assignment history.

Categories of data subjects: your customers and prospects, your employees and agents, and anyone else who messages a number you have connected.

RepublicFlow is not designed for special category data. If your conversations are likely to contain health, biometric or similar data, tell us before connecting the number so additional measures can be agreed.

5. Our obligations

• Process personal data only on your documented instructions, unless required otherwise by law — in which case we will tell you first, where we lawfully can.
• Keep the data confidential, and bind everyone with access to confidentiality obligations.
• Implement the technical and organisational measures in section 6.
• Not use your data to train models, build profiles or market to your customers.
• Tell you if, in our opinion, an instruction would breach data protection law.

6. Security measures

• TLS encryption in transit and encryption at rest for Vault backups
• Session credentials stored per number in isolated storage on a dedicated VPS
• Role-based access control in the panel, with agent-level scoping of conversations
• Least-privilege access to production systems, limited to named staff
• Scheduled backups, session monitoring and audit logging of administrative actions
• Written ban-risk and data-handling guidelines issued at onboarding

7. Sub-processors

You give general authorisation for us to engage sub-processors. Each is bound by terms no less protective than this DPA. The current list is:

Sub-processor	Purpose	Location
Meta Platforms, Inc.	WhatsApp Cloud API message delivery	US / global
Hostinger International Ltd	Web hosting and panel database	EU
VPS infrastructure provider	WhatsApp session runtime and Vault storage	EU
Wise, Payoneer and local payment providers	Payment collection	UK / EU / global

We will give at least 30 days’ notice before adding or replacing a sub-processor. If you reasonably object on data protection grounds, you may terminate the affected service and receive a pro-rata refund of fees paid in advance.

8. Assistance to you

• Data subject requests. The panel lets you search, export and delete contacts and conversations yourself. Where that is not enough, we will assist you within a reasonable time. If a request reaches us directly, we will forward it to you and will not respond on your behalf unless you ask us to.
• Breach notification. We will notify you without undue delay, and in any case within 72 hours of becoming aware of a personal data breach affecting your data, with the information you need for your own reporting.
• Impact assessments. We will provide the information reasonably needed for your DPIA or prior consultation.

9. Return and deletion

On termination you may export contacts and chat history from the panel. We retain Vault data for 30 days after closure so that export or restoration is still possible, then delete it, unless you ask for immediate deletion or we are required by law to keep it. Backups containing your data are overwritten on their normal cycle.

A paused account is frozen, not deleted. Pausing is not termination and does not start the deletion period.

10. International transfers

Where personal data is transferred outside the UK or EEA — including to our team in Pakistan — we rely on the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, together with encryption in transit and at rest and access controls. Transfers to Meta in connection with the Cloud API are governed by Meta’s own terms with you as the account holder.

11. Audit

On reasonable written request, and no more than once a year unless required by a supervisory authority, we will provide the information needed to demonstrate compliance with this DPA and will cooperate with an audit carried out by you or an independent auditor bound by confidentiality, at your cost and without disrupting service for other customers.

12. Liability and precedence

Each party’s liability under this DPA is subject to the limits in the Terms of service. If this DPA conflicts with the Terms of service on the processing of personal data, this DPA prevails.

Contact us

Questions about this page can go to info@republicflow.com, or on WhatsApp at +92 328 8044440. Postal address: 7266, 182–184 High Street North, East Ham, London, E6 2JA, United Kingdom.