Last updated: 16 October 2026
This Data Processing Agreement ("DPA") forms part of the agreement between Luke Young, trading as Flowly ("Processor", "we", "us"), and the garage or business using Flowly Pro ("Controller", "you"), and sets out the terms on which we process personal data on your behalf.
In relation to personal data about your own customers that you store or process using Flowly Pro (names, contact details, vehicle information, service history, and SMS consent records), you are the data controller and we act as your data processor. You determine the purposes and means of processing that data (deciding who your customers are, what services to record, whether to send them text reminders); we process it only to provide the Flowly Pro service to you, on your instructions.
We will only process your customers' personal data:
We will tell you if we believe an instruction you've given breaches data protection law.
We use the following sub-processors to provide Flowly Pro, each processing data only as needed for their specific role:
We will notify you of any change to this list, and you may object to a new sub-processor on reasonable data protection grounds.
Copies of text messages and emails that have already been sent are held by PureSMS and Resend for their own limited retention periods. Deleting or erasing a customer in Flowly Pro does not reach those copies.
We take reasonable technical and organisational measures to protect the personal data you store, including access controls, encryption in transit and at rest where applicable, and restricting access to what's needed to operate the service.
We ensure that anyone we authorise to process your customers' personal data is subject to a duty of confidentiality.
We will provide reasonable assistance to help you meet your own obligations as a data controller, including:
Flowly Pro includes tools for this. You can archive a customer, delete a customer who has no records, and erase a customer's personal details when they ask you to. Erasing a customer removes their phone number, email address, notes and other personal details, and shows them as "Deleted customer". Their name and address stay only on their invoices from the last 6 years, because a VAT invoice must show them and you must keep a copy of it for HMRC; each invoice's copy of them is cleared automatically 6 years after the invoice's date. Their jobs, invoice numbers, amounts, dates and VAT are kept as your tax records.
On termination of your Flowly Pro subscription, we will delete or make inaccessible the personal data associated with your account within a reasonable period, except to the extent we are required to retain it by law.
Data that is deleted or erased leaves the live service straight away. It may remain in our hosting provider's encrypted backups until they expire, normally within 30 days. We only restore from a backup to recover from an incident, and if we ever do, we will tell you, so that any deletions or erasures made since that backup can be applied again.
Where you use Flowly Pro's text messaging features, you remain responsible for obtaining and recording valid consent from your own customers, as set out in our Terms and Conditions and Privacy Policy. This DPA covers our processing of the consent records you create; it does not transfer responsibility for obtaining valid consent to us.
Where our sub-processors process data outside the UK, we rely on their compliance with UK data protection standards (such as the UK's international data transfer safeguards) as part of our decision to work with them.
Each party is responsible for its own compliance with data protection law in the roles set out in this agreement. Nothing in this DPA overrides the limitation of liability set out in our Terms and Conditions.
Questions about this agreement can be sent to luke22ty@gmail.com or via WhatsApp on 07514 202898.