---
title: Data processing agreement | Flowolf
description: "Flowolf's data processing agreement under article 28 GDPR: what we process for customers, sub-processors, security, breaches, retention and audits."
---

[Skip to content](https://flowolf.io/data-processing-agreement#main)

<https://flowolf.io/>

Menu

- Features 
    - [All features](https://flowolf.io/features)
    - [LinkedIn to HubSpot sync](https://flowolf.io/features/linkedin-to-hubspot-sync)
    - [Log LinkedIn messages](https://flowolf.io/features/log-linkedin-messages-in-hubspot)
    - [Company research](https://flowolf.io/features/company-research-for-linkedin)
    - [Message drafts](https://flowolf.io/features/linkedin-message-drafts)
    - [Deals, tasks and sequences](https://flowolf.io/features/hubspot-deals-tasks-sequences-from-linkedin)
    - [Shared templates](https://flowolf.io/features/shared-linkedin-message-templates)
    - [Team setup](https://flowolf.io/features/linkedin-hubspot-team-setup)
- [Pricing](https://flowolf.io/pricing)
- [About](https://flowolf.io/about-1)
- [Contact](https://flowolf.io/contact-1)

[Start free trial](https://app.flowolf.io)

1. [Home](https://flowolf.io/)
2. Terms

Legal

# Data processing agreement

How Flowolf processes personal data on behalf of its customers, as required by article 28 of the GDPR. Part of our terms of service. Last updated: 9 November 2026.

## 1. Parties and scope

This data processing agreement (“DPA”) is between the customer that uses Flowolf (the “controller”) and Flowolf.io, Langendijk 40, 4819 EW Breda, the Netherlands, KvK 42215225 (“Flowolf”, the “processor”). It is part of our [terms of service](https://flowolf.io/terms) and applies automatically when the customer uses Flowolf. If this DPA and the terms differ on how personal data is processed, this DPA wins.

Words such as personal data, processing, controller, processor, data subject and personal data breach have the meaning given to them in the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

## 2. What Flowolf processes, and why

**Purpose.** Flowolf processes personal data only to provide Flowolf to the customer: to show the customer's CRM data on LinkedIn, to add contacts and companies to the CRM, to log LinkedIn messages and invitations, to research companies and to prepare message drafts.

**Data subjects.**

- People whose LinkedIn profiles or company pages the customer's users open with Flowolf, and people they message or invite on LinkedIn.
- Contacts and company contacts in the customer's CRM that Flowolf reads or updates.
- The customer's own users, as far as their names appear in activities and records Flowolf creates.

**Personal data.** Name, job title, company, location, LinkedIn profile URL, profile photo, and where shown on the profile: phone number, birthday and summary. The content and date of LinkedIn messages and invitations between the customer's users and these people. CRM record IDs and properties, notes and tasks. Research results, fit scores and message drafts about these people and their companies.

**Special categories.** Flowolf is not meant for special categories of personal data, such as health or political views. The customer will not use Flowolf to process them on purpose.

**Duration.** For as long as the customer uses Flowolf, and until the data is deleted as described in section 9.

## 3. Instructions

Flowolf processes personal data only on the customer's documented instructions. The terms, this DPA and the settings the customer makes in Flowolf are those instructions. If Flowolf believes an instruction breaks the GDPR or other data protection law, it will tell the customer. If the law requires Flowolf to process data in another way, Flowolf will tell the customer first, unless the law forbids that.

## 4. The customer's responsibilities

The customer is responsible for having a lawful basis to process the personal data of the people its users look up and contact, and for informing those people where the law requires it. The customer decides which data its users save to its CRM.

## 5. Confidentiality

Everyone at Flowolf who can access personal data is bound to confidentiality, and only has access where it is needed to provide, support or secure Flowolf.

## 6. Security

Flowolf takes appropriate technical and organisational measures to protect personal data. The measures in force today are listed in the annex. Flowolf may change them, as long as the overall level of protection stays appropriate.

## 7. Sub-processors

The customer gives Flowolf general written permission to use sub-processors. Flowolf uses these sub-processors today:

- **Cloudflare, Inc.**: hosting of Flowolf's servers, database and short-lived caches. The database is stored in the EU.
- **Anthropic, PBC**: the AI service that produces company research and message drafts. It receives the profile and company information needed for each request.

The customer's CRM, such as HubSpot, is the customer's own service. Flowolf sends data to it on the customer's instruction; it is not Flowolf's sub-processor.

Flowolf will inform the customer before it adds or replaces a sub-processor, for example by email or a notice in the portal, so the customer can object. If the customer objects and we can't resolve the objection, the customer's only remedy is to stop using Flowolf by cancelling its subscription. Flowolf puts data protection obligations on each sub-processor as required by the GDPR, and remains responsible for them.

## 8. Transfers outside the EEA

Some sub-processors are based in the United States. Flowolf only transfers personal data outside the European Economic Area with appropriate safeguards, such as the EU Standard Contractual Clauses or certification under the EU-US Data Privacy Framework.

## 9. Retention and deletion

- Data saved in the customer's CRM is stored there, under the customer's control. Flowolf keeps no long-term copy of it.
- Research and drafts about a person are kept on Flowolf's servers for at most 3 days, so they don't have to be made twice. Other caches are short-lived.
- The CRM access tokens are kept until the customer disconnects the CRM or the account is closed.
- When the services end, Flowolf deletes the personal data it processes for the customer, unless the law requires Flowolf to keep it. Copies in backups are deleted in the normal backup cycle. Because this data is in the customer's own CRM, there is nothing for Flowolf to return.

## 10. Helping the customer

Taking into account the nature of the processing and the information available to Flowolf, Flowolf helps the customer, as far as reasonably possible, to:

- respond to requests from data subjects, such as access or deletion. If a data subject contacts Flowolf directly, Flowolf will pass the request on to the customer;
- carry out a data protection impact assessment or prior consultation with a supervisory authority, where needed;
- meet its own security obligations.

Flowolf may charge reasonable costs for help that goes beyond what Flowolf normally provides.

## 11. Personal data breaches

Flowolf will inform the customer without undue delay after becoming aware of a personal data breach that affects the customer's personal data. Flowolf will share the information it has and that the customer needs to meet its own reporting duties.

## 12. Information and audits

On request, Flowolf provides the information needed to show that it meets this DPA, such as written answers and documentation. An audit or inspection is only possible if that information is not enough to show compliance, or if a supervisory authority requires it. In that case:

- the audit is carried out by an independent auditor, bound to confidentiality and agreed with Flowolf;
- at most once a year, with reasonable advance notice, during office hours and without disrupting Flowolf's operations or other customers' data;
- the customer pays the costs of the audit, including Flowolf's reasonable costs.

Supervisory authorities may always audit as the law allows.

## 13. Liability and term

The liability rules of the terms of service apply to this DPA. This DPA runs as long as Flowolf processes personal data for the customer. Sections that by their nature must continue, such as confidentiality and deletion, continue after that.

## 14. Law and disputes

Dutch law applies to this DPA. Disputes go to the competent court in the district of Zeeland-West-Brabant, the Netherlands.

## Annex: security measures

- **Encryption:** all connections use HTTPS (TLS). CRM access tokens are stored encrypted, with keys kept separately from the database.
- **Separation of customers:** every request is checked for a signed-in user, their company, an active subscription and a seat. Data of one customer is never shown to another.
- **Sign-in:** no passwords. Users sign in with a one-time code sent to their work email address. In the extension, a sign-in lasts 1 hour and is renewed for at most 30 days per device, with at most 2 devices per seat. Admins can remove a user, who is then signed out at once.
- **No CRM tokens in the browser:** the extension never holds CRM access tokens or other secrets; all CRM access goes through Flowolf's servers.
- **Data minimisation:** customer data is stored in the customer's CRM. Flowolf's own database holds accounts, settings, encrypted tokens, subscription status and usage counters.
- **Location:** Flowolf's database is stored in the EU.
- **Staff access:** only people who need it to run and support Flowolf have access to production systems.
- **No training on customer data:** customer data is not used to train AI models.

Questions about this DPA: [legal@flowolf.io](mailto:legal@flowolf.io).

Less noise, more flow.

Product

- [Features](https://flowolf.io/features)
- [LinkedIn to HubSpot sync](https://flowolf.io/features/linkedin-to-hubspot-sync)
- [Pricing](https://flowolf.io/pricing)

Company

- [About](https://flowolf.io/about-1)
- [Contact](https://flowolf.io/contact-1)
- [Privacy policy](https://flowolf.io/privacy-policy)
- [Terms](https://flowolf.io/terms)

© 2026 Flowolf. LinkedIn is a registered trademark of LinkedIn Corporation. HubSpot is a registered trademark of HubSpot, Inc. Flowolf is not affiliated with or endorsed by either.

[Data processing agreement](https://flowolf.io/data-processing-agreement)

Cookie settings

```json
{
  "@context" : "https://schema.org",
  "@id" : "https://flowolf.io/#organization",
  "@type" : "Organization",
  "logo" : "https://145359199.fs1.hubspotusercontent-eu1.net/hubfs/145359199/Flowolf/Flowolf_v3_plain-1.svg",
  "name" : "Flowolf",
  "url" : "https://flowolf.io/"
}
```

```json
{
  "@context" : "https://schema.org",
  "@id" : "https://flowolf.io/#website",
  "@type" : "WebSite",
  "name" : "Flowolf",
  "publisher" : {
    "@id" : "https://flowolf.io/#organization"
  },
  "url" : "https://flowolf.io/"
}
```

```json
{
  "@context" : "https://schema.org",
  "@id" : "https://flowolf.io/data-processing-agreement",
  "@type" : "WebPage",
  "description" : "Flowolf's data processing agreement under article 28 GDPR: what we process for customers, sub-processors, security, breaches, retention and audits.",
  "inLanguage" : "en",
  "isPartOf" : {
    "@id" : "https://flowolf.io/#website"
  },
  "name" : "Data processing agreement | Flowolf",
  "url" : "https://flowolf.io/data-processing-agreement"
}
```

```json
{
  "@context" : "https://schema.org",
  "@type" : "BreadcrumbList",
  "itemListElement" : [ {
    "@type" : "ListItem",
    "item" : "https://flowolf.io/",
    "name" : "Home",
    "position" : 1
  }, {
    "@type" : "ListItem",
    "item" : "https://flowolf.io/terms",
    "name" : "Terms",
    "position" : 2
  } ]
}
```