BulkGate SMS by VoxFlow

Data Processing Addendum
Effective date: 10 October 2026 | Last updated: 10 October 2026

1. Parties and Scope

This Data Processing Addendum ("DPA") forms part of the Terms of Service between the business that installs BulkGate SMS by VoxFlow (the "Controller") and Mindful Momentum Ltd (the "Processor"). It applies to personal data the Processor processes on the Controller's behalf through the Service, and meets the requirements of Article 28 of the EU GDPR and of the UK GDPR. It is accepted by installing the Service and needs no signature.

2. Details of Processing

Subject matter and natureTransmitting SMS between the Controller's HighLevel account and its BulkGate account; reporting delivery status; keeping and applying an opt-out list.
PurposeEnabling the Controller to send and receive SMS and to honour opt-outs.
DurationWhile the Service is installed, plus backup expiry (30 days).
Data subjectsPeople the Controller sends SMS to or receives SMS from.
Personal dataPhone numbers (in transit; on the opt-out list only as a keyed hash); message content (in transit only, not stored); delivery status; opt-out status and its history.
Special categoriesNone intended. The Controller should not send special-category data by SMS.

Storage periods for each data type are listed in section 4 of the Privacy Policy.

3. Processor Obligations

The Processor will:

  1. process personal data only on the Controller's documented instructions, which are these Terms and the Controller's use and configuration of the Service, and inform the Controller if it believes an instruction breaches data protection law;
  2. ensure that anyone authorised to process the data is bound by confidentiality;
  3. implement the security measures described in section 8 of the Privacy Policy, and keep them appropriate to the risk (GDPR Art. 32);
  4. assist the Controller, taking into account the nature of the processing, in responding to data subject requests and in meeting its obligations on security, breach notification and impact assessments;
  5. notify the Controller without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting its data, with the information then available;
  6. on uninstall, delete the Controller's data immediately, with backup copies expiring within 30 days, unless law requires retention;
  7. make available the information needed to demonstrate compliance with this DPA, and allow audits on reasonable written notice, no more than once a year and at the Controller's cost, primarily through written answers and documentation.

4. Sub-processors

The Controller gives general authorisation for the sub-processors below. The Processor binds each of them by contract to data protection obligations equivalent to this DPA and remains responsible for them.

Sub-processorPurposeData location
Railway Corp.Application hosting and databaseEU (Netherlands data centre); US company
Cloudflare, Inc. (R2)Daily database backupEU (EU-jurisdiction storage); US company

The following platforms are chosen and contracted by the Subscriber, not by us. The Service only connects them, using the Subscriber's own accounts:

PlatformRoleLocation
HighLevel Inc.The Subscriber's CRM and conversations inbox, where messages are written and readUSA
TOPefekt s.r.o. (BulkGate)SMS delivery through the Subscriber's own BulkGate accountEU (Czech Republic)

HighLevel and BulkGate are the Controller's own providers, contracted directly by the Controller, and are not sub-processors of the Processor.

The Processor will announce any new or replacement sub-processor on this page at least 15 days in advance. If the Controller objects on reasonable data protection grounds and no solution is found, its remedy is to uninstall the Service.

5. International Transfers

The Processor is established in the United Kingdom, which benefits from an EU adequacy decision. Its database and backups are stored in the EU. Where a sub-processor may access data from a country without adequacy, the transfer is covered by the EU Standard Contractual Clauses (with the UK Addendum) or the EU–US Data Privacy Framework, as applicable.

6. Controller Obligations

The Controller is responsible for having a legal basis for each message it sends, for the lawfulness of its instructions, and for responding to data subjects.

7. Liability and Precedence

Liability under this DPA is subject to the limits in the Terms of Service, except where the law does not allow such limits. If this DPA conflicts with the Terms of Service on data protection, this DPA prevails. This DPA is governed by the same law as the Terms of Service.