Data Processing Addendum

1. Roles and scope

The Controller determines the purposes and means of processing personal data contained in Customer Data. FlyCRM processes that personal data only on documented instructions from the Controller, which include these terms and the Controller's use of the Service's features.

2. Nature and purpose of processing

Hosting, storage, retrieval, indexing, transmission, and AI-assisted drafting of CRM records — including prospect and client contacts, visit notes and photos, quotes, and, where the Controller's users connect a Google account, Gmail message content logged against contact records — for the purpose of providing the Service.

3. Categories of data and data subjects

Data subjects: the Controller's personnel and the business contacts they record. Data categories: business contact details, employment and role information, communications content and metadata, location of recorded visits, and account/usage logs. Special category data should not be submitted to the Service.

4. Confidentiality and personnel

FlyCRM ensures that personnel authorized to process personal data are bound by confidentiality obligations and access data only on a need-to-know basis.

5. Security measures

• Encryption of personal data in transit (TLS) and at rest.
• Role-based access control, least privilege, and logged administrative access.
• Environment separation, dependency and vulnerability monitoring.
• Encrypted, access-controlled backups with defined rotation.
• Documented incident response procedures reviewed periodically.

6. Subprocessors

The Controller authorizes FlyCRM to engage subprocessors for cloud hosting and database services, transactional email delivery, error and performance monitoring, payment processing, and AI model inference for drafting features. Each subprocessor is bound by data protection terms no less protective than this DPA. We will give notice of new subprocessors and the Controller may object on reasonable data protection grounds. A current list is available on request at hello@wurknow.com.

7. Google API data

Where users connect a Google account, FlyCRM's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. That data is used only to provide the email-logging and follow-up drafting features to the user, is never sold, used for advertising, or used to train generalized AI models, and is deleted within 30 days of the user disconnecting the account in Settings → connected accounts.

8. Data subject requests

FlyCRM will assist the Controller in responding to data subject requests for access, correction, deletion, restriction, portability, and objection, including through self-service export and deletion tools in the Service.

9. Personal data breach

FlyCRM will notify the Controller without undue delay, and in any event within 72 hours of becoming aware of a personal data breach affecting Customer Data, and will provide information reasonably required for the Controller's own notification obligations.

10. International transfers

Where personal data is transferred out of the EEA, UK, or Switzerland, the parties rely on the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, which are incorporated by reference into this DPA.

11. Deletion and return

On termination, or on the Controller's written request, FlyCRM will delete or return Customer Data. Deletion from production systems and backups completes within 90 days, and within 30 days for synced Google message data, unless retention is required by law. See our Privacy Policy for details.

12. Audits

On reasonable written notice and no more than once per year, FlyCRM will provide information necessary to demonstrate compliance with this DPA, including available security documentation and responses to a reasonable security questionnaire.

13. Contact

Data protection contact: hello@wurknow.com.