Terms of ServicePrivacy PolicyAcceptable UseData Processing AgreementSub-processors

Data Processing Agreement

Last updated 16 October 2026 · version 2026-10-16

When your business keeps information about people in Phlare, you decide why and how it is used; we process it only to run the service for you. This agreement sets out that relationship as the data protection laws of South Africa, Botswana, Zambia, Zimbabwe, the United Kingdom and the European Union require: we act only on your instructions, keep the information secure and confidential, use only the sub-processors we list, tell you promptly of a breach, help you answer the people concerned, and return or delete everything when the service ends.

It forms part of the Terms of Service and applies whenever we process personal information for you. An admin can also accept it for a workspace under Settings → Legal, which records who accepted it, when, and for which business.

1.The parties and their roles

  1. This agreement is between the business that uses Phlare (the “Customer”) and Phlare (“Phlare”, “we”).

    Phlare

  2. For Customer Personal Data, the Customer is the controller (under POPIA, the “responsible party”) and Phlare is the processor (under POPIA, the “operator”). Where the Customer is itself a processor acting for someone else, Phlare is its sub-processor, and the Customer will pass on to that controller anything this agreement requires.
  3. For personal information about the Customer’s own account holders that Phlare needs to run its business — sign-in, billing and security records — Phlare is a controller, and its Privacy Policy applies instead of this agreement.

2.Words used in this agreement

  • Data Protection Law: every law on the protection of personal information that applies to the processing — including the Protection of Personal Information Act, 2013 of South Africa (POPIA); the data protection law of Botswana; the Data Protection Act, 2021 of Zambia; the Cyber and Data Protection Act of Zimbabwe [Chapter 12:07]; the UK GDPR and the Data Protection Act 2018 of the United Kingdom; and Regulation (EU) 2016/679 (the GDPR).
  • Customer Personal Data: personal information in the Customer Data (as the Terms define it) that Phlare processes on the Customer’s behalf.
  • Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data — including any “security compromise” under section 22 of POPIA.
  • Sub-processor: a third party Phlare engages to process Customer Personal Data. A Connected Service the Customer chooses and contracts with itself is not a Sub-processor.
  • SCCs: the standard contractual clauses approved by the European Commission in Decision (EU) 2021/914. UK Addendum: the International Data Transfer Addendum to them issued by the UK Information Commissioner.

Other words have the meaning given to them in Data Protection Law.

3.Processing only on the Customer’s instructions

  1. Phlare processes Customer Personal Data only on the Customer’s documented instructions, unless a law it is subject to requires otherwise — in which case it will tell the Customer before processing, unless that law forbids it.
  2. The Customer’s instructions are this agreement, the Terms, the way the Customer and its Users set up and use the service (including through the API), and any further written instruction agreed between the parties. The details of the processing are in Annex 1.
  3. Phlare will tell the Customer promptly if, in its opinion, an instruction infringes Data Protection Law, and may decline to carry it out until it is confirmed or changed.
  4. Phlare will not sell Customer Personal Data or use it for its own purposes. It uses it only to provide, secure and support the service for the Customer.

4.The Customer’s responsibilities

The Customer is responsible for the lawfulness of the Customer Personal Data and its instructions: for having a lawful basis (and, for direct marketing, the consent or other ground the law requires) for each person it keeps or contacts; for giving them the information Data Protection Law requires; for the accuracy of what it uploads; and for following the Acceptable Use Policy.

5.Confidentiality and security

  1. Phlare ensures that everyone it authorises to process Customer Personal Data is bound by a duty of confidentiality and processes it only as this agreement allows.
  2. Phlare implements and maintains the technical and organisational measures in Annex 2, which are designed to give a level of security appropriate to the risk, as section 19 of POPIA and Article 32 of the GDPR require. It reviews them regularly and may change them, provided the overall level of protection is not reduced.

6.Sub-processors

  1. The Customer gives Phlare general authorisation to engage Sub-processors. The current ones are listed, with what each does and where, on the sub-processors page.
  2. Phlare will tell the Customer of any intended addition or replacement at least 14 days before the new Sub-processor starts processing Customer Personal Data, by updating that page (which shows the date it last changed) and by email to the owners of the Customer’s workspaces.
  3. The Customer may object on reasonable grounds relating to data protection within that period. The parties will then discuss it in good faith. If they cannot resolve it, the Customer may end the Terms for the affected service without penalty, and Phlare will refund any fees paid in advance for the period after the end date.
  4. Phlare imposes on each Sub-processor, by written contract, data protection obligations that give at least the protection this agreement requires, and remains responsible to the Customer for its Sub-processors’ performance of them.

7.Where the data is processed, and transfers

  1. Customer Personal Data is hosted in Germany, in the European Union. It is processed elsewhere only by the Sub-processors listed, in the places listed, with the safeguards listed.
  2. Hosting Customer Personal Data in Germany places it under the GDPR, a law that gives protection at least equivalent to that of POPIA (as section 72(1)(a) of POPIA requires) and of the data protection laws of Botswana, Zambia and Zimbabwe; the United Kingdom recognises the European Economic Area as adequate for transfers under the UK GDPR.
  3. Where Data Protection Law requires a transfer mechanism for Customer Personal Data leaving the European Economic Area, the United Kingdom or Switzerland for a country without an adequacy decision (a “restricted transfer”), the SCCs are incorporated into this agreement for that transfer, with the elections in Annex 3; for a restricted transfer from the United Kingdom, the UK Addendum is incorporated as well. If the SCCs and this agreement conflict, the SCCs prevail.
  4. For a transfer from any other country, Phlare will provide the safeguards that country’s law requires, and the Customer authorises the transfers this clause describes.

8.Helping the Customer with people’s requests

  1. The service lets the Customer find, export, correct and erase an individual’s data, and keeps a do-not-contact list of people who have opted out. The Customer will use these to answer requests from the people whose data it holds.
  2. If Phlare receives such a request directly, it will pass it to the Customer without undue delay and will not answer it itself except on the Customer’s instruction.
  3. Where the tools are not enough, Phlare will give the Customer reasonable further help, taking into account the nature of the processing.
  4. Phlare will also give the Customer reasonable help with data protection impact assessments and consultations with a regulator that relate to the service.

9.Personal Data Breaches

  1. Phlare will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a Personal Data Breach — by email to the owners of the affected workspaces and by a notice in the service.
  2. The notice will describe, as far as is then known, the nature of the breach, the categories and approximate number of people and records concerned, its likely consequences, what Phlare has done and proposes to do, and a contact for more information. What is not yet known will follow as soon as it is.
  3. Phlare will take reasonable steps to contain and remedy the breach, and help the Customer meet its own obligations to notify a regulator or the people concerned — including under section 22 of POPIA and Articles 33 and 34 of the GDPR.
  4. Notifying a breach is not an admission of fault.

10.Returning and deleting the data

While the service is in use, the Customer can export Customer Personal Data at any time. When the Terms end, Phlare will, at the Customer’s choice, help it export the Customer Personal Data within 30 days, and then delete it from the live service within a further 30 days and from any backups as they expire, and in any case within 90 days — unless a law requires Phlare to keep it, in which case Phlare will protect it and process it only for that purpose. Phlare will confirm deletion in writing on request.

11.Showing compliance, and audits

  1. Phlare will make available to the Customer the information reasonably needed to show that it meets this agreement, including answers to reasonable security questionnaires.
  2. Where that is not enough, the Customer (or an independent auditor it appoints who is bound by confidentiality and is not a competitor of Phlare) may audit Phlare’s compliance, on at least 30 days’ written notice, no more than once in any 12 months unless a regulator requires it or after a Personal Data Breach, during business hours, without access to other customers’ data, and at the Customer’s cost.
  3. Phlare will co-operate with a regulator that has authority over the Customer.

12.Liability, duration and precedence

  1. Each party’s liability under this agreement is subject to the limits in the Terms, except where Data Protection Law or the SCCs do not allow liability to be limited.
  2. This agreement lasts for as long as Phlare processes Customer Personal Data, and its obligations continue until the data has been returned or deleted.
  3. If this agreement and the Terms conflict on the protection of personal information, this agreement prevails; the SCCs, where they apply, prevail over both.
  4. Apart from the SCCs, this agreement is governed by the same law as the Terms.

A1.Annex 1 — Details of the processing

  • Subject matter and duration: providing the service under the Terms, for as long as they last and until the data is returned or deleted.
  • Nature of the processing: storing, organising, structuring, searching, segmenting, analysing, sending and receiving messages, recording events, and deleting — continuously, as the Customer uses the service.
  • Purpose: to let the Customer keep a record of its customers and other contacts, run its sales and investor pipelines, send them email, text and WhatsApp messages and campaigns, receive and answer their replies, take bookings, and measure the results.
  • People concerned: the Customer’s customers, prospects, leads, subscribers, investors, suppliers and other contacts; visitors to the Customer’s website where it installs Phlare’s tracking; people who book with the Customer; and the Customer’s own staff who use the service.
  • Kinds of personal information: names, email addresses, phone numbers, postal addresses, company and job details; consent and opt-out records; orders, products and amounts; website and shop activity (pages viewed, products looked at, checkouts started); messages sent and received, including their content and delivery and engagement events (delivered, opened, clicked, bounced); booking details; call records and, where the Customer turns recording on, call recordings; and any other fields the Customer chooses to add.
  • Special personal information: none is needed for the service. The Customer must not store it unless the law allows and Annex 2 is sufficient for it.
  • Retention: as the Customer decides while it uses the service (it can delete records and erase people at any time, and set how long call recordings are kept), and as clause 10 provides afterwards.

A2.Annex 2 — Technical and organisational measures

  • Encryption in transit: the service is reached only over HTTPS, with HTTP Strict Transport Security.
  • Passwords: stored only as bcrypt hashes; new passwords must be at least 10 characters and are checked against known breaches without the password leaving the server.
  • Sign-in protection: limits on sign-in, sign-up and password-reset attempts by address and by network, shared by every server process; an address is locked for a period after repeated wrong passwords.
  • Sessions: short-lived access tokens; every session is ended when a password is changed or reset.
  • Secrets at rest: passwords and keys for Connected Services (mail servers, mailboxes, Phlare’s own email provider) are stored encrypted. Invitation, reset and confirmation links and API keys are stored only as one-way hashes.
  • Separation of customers: every record belongs to one workspace, and every request is checked against the workspaces the person or API key belongs to.
  • Access within a workspace: owner, admin, member and viewer roles; API keys limited to one workspace and to the role they were given.
  • Accountability: actions taken by the people who run Phlare itself are recorded in an audit trail; only personnel who need access to production systems for their role have it, under a duty of confidentiality.
  • Hosting: in data centres in Germany operated by Contabo GmbH.
  • Privacy by design: unsubscribe links on every marketing email, including one-click unsubscribe; an automatic do-not-contact list; consent wording stored with each sign-up; tools to export or erase an individual’s data; configurable retention for call recordings, after which the file itself is deleted.
  • Outgoing data: webhooks the Customer configures are signed so the receiving system can verify they came from Phlare.

A3.Annex 3 — Elections for the SCCs

  • Modules: Module Two (controller to processor) where the Customer is a controller; Module Three (processor to processor) where it is a processor.
  • Parties: the Customer is the data exporter and Phlare the data importer, with the details given in clause 1 and Annex 1 of this agreement.
  • Clause 7 (docking): included.
  • Clause 9 (sub-processors): Option 2, general written authorisation, with notice as clause 6 of this agreement provides.
  • Clause 11 (redress): the optional wording is not used.
  • Clause 13 (supervision): the supervisory authority determined under Clause 13(a).
  • Clauses 17 and 18 (law and courts): the law of Germany, and the courts of Germany.
  • Annex I and II of the SCCs: Annex 1 and Annex 2 of this agreement. Annex III: the sub-processors page.
  • UK Addendum: Table 1 is completed with the parties’ details above; Table 2 refers to the SCCs as elected here; Table 3 to Annexes 1 and 2 and the sub-processors page; in Table 4, either party may end the UK Addendum as its Section 19 allows.