Policy Center
Data Processing Agreement
Last updated July 22, 2026
Roles of the parties
This Data Processing Agreement (“DPA”) forms part of the Terms of Service. For the personal data contained in the lead and contact records you compile and process using the Service, you are the data controller and Pullyflow is the data processor. For your own account data, Pullyflow is the controller as described in the Privacy Policy.
Scope and instructions
Pullyflow processes personal data only to provide the Service and only on your documented instructions, which include your configured use of the product. We will inform you if, in our opinion, an instruction infringes applicable data-protection law.
Confidentiality
Pullyflow ensures that personnel authorized to process personal data are bound by confidentiality obligations and access data only as needed to operate the Service.
Security measures
Pullyflow maintains appropriate technical and organizational measures, including encryption in transit (TLS 1.2+) and at rest (AES-256), role-based access controls, and audit logging, designed to protect personal data against unauthorized access, loss, or disclosure.
Sub-processors
You authorize Pullyflow to engage vetted sub-processors — including cloud infrastructure and storage providers, a PCI-DSS Level 1 payment processor, transactional email delivery, and licensed business-data partners — each bound by a data-processing agreement. We will give notice of material changes to our sub-processor list with a reasonable opportunity to object.
Data-subject requests
Pullyflow will, to the extent legally permitted, promptly notify you of a request received from a data subject and, taking into account the nature of the processing, assist you with appropriate technical and organizational measures to respond. Individuals may also use our self-serve portal or email privacy@pullyflow.com.
International transfers
Where personal data is transferred across borders, Pullyflow relies on an appropriate transfer mechanism, such as the Standard Contractual Clauses, where required by applicable law.
Breach notification and deletion
Pullyflow will notify you without undue delay after becoming aware of a personal-data breach affecting your data. On termination, and at your choice, Pullyflow will delete or return the personal data processed on your behalf, subject to retention required by law.
Questions about this document? Email privacy@pullyflow.com.