Data processing addendum

The processor under this addendum is Eclipse Private Limited, operating the WavesFlo platform.

For data about your recipients you are the controller and we are the processor. For data about your own team's use of the platform we are the controller.

We process recipient data only to provide the service and only on your documented instructions. Where an instruction would require us to message people without a lawful basis, we will refuse it and say why.

Workspace data is isolated and that isolation is covered by automated tests. Access is role-gated, credentials are held in platform secret stores, and identifiers are redacted from logs.

We maintain a current list of sub-processors and will give notice before adding one. Ask at privacy@wavesflo.com for the list that applies to your contract.

On termination we return or delete recipient data on request. Opt-out records are the exception: they are retained, because deleting a record of a withdrawal would allow the same person to be messaged again.

We assist with access, correction and erasure requests, and with breach notification, within the timelines your agreement sets.