Data processing addendum

This addendum is between TradeFlo ("we", the processor or service provider) and you, the client (the controller or business). It applies when you accept our terms of service. No separate signature is needed.

If you need a signed copy for your records, ask us and we will send one. Clients in the UK and the US need nothing extra.

You decide why and how the personal data of your leads and customers is used. We process it on your instructions to deliver the service. For your own account and billing details, we are the controller: see the privacy notice.

In the US, we act as your service provider under state privacy laws. We process the data only for the purposes in this addendum, we do not sell it or share it for advertising, and we do not combine it with data from other clients.

• Contact details of your leads and customers, and what they write in an enquiry.
• Which pages they looked at and when they enquired.
• Records and files you add to the platform.

We use it to run your site, pass enquiries to you, produce your reports, support you, and keep the service secure. We do not use it to train AI models, to sell to anyone, or to run advertising. We do not process special-category data unless you tell us to in writing.

The list is on the sub-processors page. We email you at least 30 days before we add a company. You can object in that time. If we cannot settle your objection, you can end the affected service and we will refund the unused part of what you paid.

Where data from the EU or the UK goes to a company outside those areas, we rely on the EU-US Data Privacy Framework and its UK extension where the company has certified, or on standard contractual clauses with the UK addendum.

• Data travels over HTTPS.
• Our database separates one client's records from another's with row-level security.
• Server keys stay on the server and are never sent to a browser.
• Our tools limit how often one address can call them.

If one of your customers asks you to show, correct, delete, export or limit their data, we will help. We aim to export within 14 days and to flag a restriction within 2 working days. Where the law makes us keep a payment record, we remove the personal fields and keep the money line.

If we learn of a breach that affects your customers' data, we email you within 48 hours with what happened, what data and how many records, what we have done and what we suggest you tell your customers. That leaves time for the 72-hour regulator deadline in EU and UK law. Contact: michael@tradeflo.ie.

You can ask once a year for a written description of how we protect your data, at no cost. For anything more, such as a visit or a security test, we will agree it with you and you pay the reasonable costs.

Within 30 days of your subscription ending, or sooner if you ask in writing, we send you an export of your data and delete the live copy. Backups drop off on our database provider's normal schedule. Payment records are kept for 6 years with personal fields removed.

Backups are gone within 90 days at the latest.

If we change something that matters, we email active clients and update the date. If this addendum and the terms of service disagree on anything about personal data, this addendum wins. On everything else, the terms of service win.