Data processing agreement

Parties and roles

The client business is the controller; RT FLOW is the processor.

Template prepared for RT FLOW. Have it reviewed by a qualified legal adviser before you rely on it, and confirm any tax treatment with an accountant.

Subject matter and duration

Processing takes place for the duration of the service agreement, for the purpose of answering client messages, managing appointments and sending approved service and marketing messages.

Data and data subjects

Data subjects: the controller's clients and prospective clients. Data: name, WhatsApp number, message content, appointment details and consent status. No special category data is to be collected; health information volunteered by a client is passed to the controller and not retained beyond the conversation log.

Processor obligations

Process only on documented instructions; ensure confidentiality; apply appropriate technical and organisational measures; engage sub-processors only with 14 days' notice and a right to object; assist with data subject requests within 5 working days; notify personal data breaches within 48 hours; delete or return data within 30 days of termination; make available the information needed to demonstrate compliance.

Controller obligations

Ensure a lawful basis for the processing and obtain marketing consent before any promotional message is sent.

Annex: sub-processors and retention

A current sub-processor list and retention periods are provided in the privacy notice and on request.