← Back to home

Data Processing Agreement (DPA)

Last updated: 5 October 2026

1. Parties and roles

This DPA forms part of the agreement between Primarius Group Limited (company number 17120989), which owns Flowgate ("Flowgate" or "Processor"), and the client ("Controller"). It applies where Flowgate processes personal data on the Controller's behalf — namely the Controller's leads' conversation and contact data, booking data, (where enabled) call recordings and transcripts, the past sales call recordings, transcripts and message threads the Controller supplies at kickoff, and the evidence of deals and payments the Controller supplies for a guarantee check (section 9).

It reflects the mandatory terms required by Article 28 UK GDPR. Flowgate acts only on the Controller's documented instructions and does not determine the purposes of processing the Controller's lead or participant data.

2. Subject-matter, duration, nature and purpose

  • Subject-matter: provision of the Flowgate conversation tracking and offer improvement service, including (where enabled) AI replies, lead qualification, booking, outbound outreach and the meeting notetaker, the analysis of past sales calls and message threads the Controller supplies, and the guarantee check under the Controller's service agreement.
  • Duration: for the term of the Controller's agreement with Flowgate, plus the retention periods in the Privacy Policy and the time needed to complete any guarantee check and refund.
  • Nature and purpose: automated processing of DM conversations, capture of lead contact details, matching bookings to leads, (where enabled) recording, transcription and AI analysis of booked calls, AI analysis of calls and conversations for objections, success factors and drop-off points, the same analysis of past sales call recordings, transcripts and message threads the Controller supplies, and checking the evidence of deals and payments the Controller supplies to work out the amount made back under the guarantee.
  • Types of personal data: names/usernames, message content, email addresses, booking details, call recordings and transcripts, derived deal information, and, in evidence supplied for a guarantee check, the names and payment details of the Controller's customers as they appear on invoices, payment processor records or bank records.
  • Categories of data subject: the Controller's leads, the participants on the Controller's recorded calls, the people in the past calls and message threads the Controller supplies, and the Controller's customers named in guarantee evidence.

3. Processor obligations (Art. 28(3))

  • Process only on the Controller's documented instructions, including for transfers, unless required by law.
  • Ensure persons authorised to process the data are under confidentiality obligations.
  • Implement appropriate technical and organisational security measures (see section 5).
  • Respect the conditions for engaging sub-processors (section 4).
  • Assist the Controller, by appropriate measures, in responding to data-subject-rights requests.
  • Assist the Controller with security, breach notification, DPIAs, and prior consultation with the ICO.
  • At the Controller's choice, delete or return the personal data at the end of the service, and delete existing copies unless retention is legally required.
  • Make available information necessary to demonstrate compliance and allow for and contribute to audits.

4. Sub-processors

The Controller provides general authorisation for Flowgate to engage the sub-processors listed on the sub-processor page. Flowgate will give notice of intended changes so the Controller may object, and will impose data-protection terms on each sub-processor equivalent to those in this DPA. Flowgate remains liable to the Controller for its sub-processors' performance.

5. Security measures

Measures include: AES-256 encryption of sensitive credentials at rest, Row Level Security and per-tenant isolation, HTTPS-only transport, access controls, and regular security audits.

6. International transfers

Where Flowgate or its sub-processors transfer personal data outside the UK, an appropriate transfer mechanism is used — the UK Extension to the EU-US Data Privacy Framework where the importer is certified to it, or otherwise the UK IDTA or the UK Addendum to the EU SCCs, with a transfer risk assessment. Current mechanisms per sub-processor are on the sub-processor page.

7. Controller obligations and responsibilities

  • Establish and document a lawful basis for the processing it instructs.
  • Provide privacy information to its leads and call participants.
  • For recorded calls: inform every participant, and obtain any consent required in the participant's jurisdiction (including jurisdictions requiring all-party consent to recording).
  • For past sales call recordings, transcripts and message threads it supplies: confirm that it is entitled to share them and that sharing them with Flowgate is lawful.
  • Assess whether a DPIA is required for its use of the notetaker, outbound outreach, or automated qualification, and carry one out where needed.
  • Handle direct-marketing compliance (PECR) for outbound messages it enables.

8. Call-recording specific terms (notetaker)

  • Flowgate dispatches a recording bot only where recording consent is explicitly granted on the booking form (fail-closed).
  • Flowgate does not create voiceprints, perform biometric speaker identification, or process voice for the purpose of uniquely identifying individuals.
  • Flowgate does not reuse recordings or transcripts for its own purposes, including model training or any cross-client product.
  • Raw recordings are deleted from the recording sub-processor after transcription. Transcripts and derived deal and insight data are retained for the term of the Controller's agreement with Flowgate.

9. Past material and guarantee evidence

  • Past calls and message threads. Where the Controller supplies recordings or transcripts of sales calls it held before it joined Flowgate, or its past message threads, Flowgate processes them on the same terms as calls and conversations captured through the service: only to provide the service to the Controller, and not for model training or any cross-client product.
  • Guarantee evidence. Where the Controller's service agreement includes a guarantee, the Controller supplies a list of its deals and a record of each payment so the amount made back can be worked out. This can contain its customers' names and payment details. Flowgate uses this evidence only to work out the amount made back, and keeps it only as long as needed for that and for Flowgate's accounting records.

10. Contact

To request a signed copy of this DPA, email info@flowgatesystems.co.uk.