Data processing agreement
Last updated October 21, 2026
This data processing agreement (“DPA”) is part of the Terms of service between FollowSystems LLC, 30 N Gould St, Sheridan WY 82801 (“FollowSystems”, “we”, “us”) and the business that uses our service (“you”). It applies whenever we handle personal information on your behalf, and it takes effect when you accept the Terms.
If this DPA and the Terms disagree about personal information, this DPA wins on that point. In all other respects the Terms apply, including the limits on liability.
1. Who does what
When you use our service, you decide why and how your customers’ personal information is used. That makes you the controller (under US state laws, the business). We handle that information only to run the service for you. That makes us your processor (under US state laws, your service provider).
This DPA does not cover information we collect for ourselves, such as the emails of people who download our checklist or book a call with us. Our Privacy policy covers that.
2. Words we use
- Customer Data means personal information about your customers, leads and website visitors that you or the service collect, send or store through the service.
- Applicable Privacy Laws means the privacy and data protection laws that apply to Customer Data, such as the California Consumer Privacy Act as amended (CCPA), other US state privacy laws, the EU and UK GDPR, the Swiss Federal Act on Data Protection, Canada’s PIPEDA and the Australian Privacy Act.
- Personal Information, Processing, Controller, Processor have the meanings the law gives them.
- Security Incident means a breach of security that leads to the accidental or unlawful loss, alteration, disclosure of, or access to Customer Data.
3. What we process
| Item | Details |
|---|---|
| Purpose | Running the service you signed up for: your website and forms, online booking, missed-call text back and instant replies, review requests, and your monthly report. |
| How long | For as long as you use the service, plus the return and deletion period in section 12. |
| Types of information | Names, phone numbers and email addresses; the content of messages and form entries; call details such as the time of a missed call; booking details; review request status; and call recordings if you ask us to turn recording on. |
| Whose information | Your customers, leads and website visitors, and the staff and contacts you add to the service. |
| Sensitive information | The service isn’t built for it. Please don’t ask your customers to send health, payment card, government ID or similar details through the service. |
| How often | Continuously, while the service runs. |
4. What we promise
We will:
- Process Customer Data only on your documented instructions. The Terms, this DPA and your use of the service’s settings are your instructions.
- Process Customer Data only to provide the service, to follow the law, or as you agree in writing.
- Not sell Customer Data, and not share it for cross-context behavioural advertising, other than where you ask us to install your own advertising or analytics tools on your website.
- Not keep, use or disclose Customer Data outside our direct business relationship with you, except as the law allows.
- Not combine Customer Data with information from other sources, except as the law allows for running and securing the service.
- Tell you if we decide we can no longer meet our obligations under Applicable Privacy Laws, or if we think one of your instructions breaks the law.
- Give you reasonable help to confirm we’re using Customer Data as this DPA says, and, if we’re not, to stop and fix it.
We confirm that we understand these restrictions and will follow them.
5. What you promise
You will:
- Have the notices, consents and legal basis you need for us to process Customer Data for you. This includes permission to text and call the people you ask us to contact, and any notice or consent you need for recording calls.
- Give us instructions that comply with the law, and not ask us to process Customer Data in a way that would break it.
- Use the service in line with the acceptable use and messaging rules in the Terms.
- Make sure the Customer Data you give us is accurate and that you’re allowed to give it to us.
- Tell us promptly if a customer asks you to delete or stop using their information in a way we need to act on.
You are solely responsible for deciding whether the service meets your legal obligations.
6. Confidentiality
Everyone at FollowSystems who can see Customer Data is bound by a duty of confidentiality and gets access only if they need it to run the service or give you support.
7. Security
We use measures that suit the risk to protect Customer Data against loss, misuse and unauthorised access. These include:
- Encrypting information in transit (HTTPS/TLS).
- Limiting access to people who need it, with their own sign-ins and two-factor authentication.
- Keeping logs of who accesses Customer Data.
- Keeping encrypted backups.
- Keeping secrets such as API keys out of our code and in protected storage.
- Checking providers before we use them.
- A process for handling and learning from Security Incidents.
No system is perfectly secure, so we can’t promise that nothing will ever go wrong.
8. Sub-processors
You agree that we may use other companies (“sub-processors”) to help provide the service. We have a written contract with each that requires it to protect Customer Data to a standard no less protective than this DPA, and we remain responsible for what they do with it.
These are our current sub-processors:
| Sub-processor | What it does | Where |
|---|---|---|
| Amazon Web Services, Inc. | Hosts our platform and stores Customer Data | United States [confirm regions] |
| Cloudflare, Inc. | Hosts websites and forms, and protects them from abuse | United States and globally |
| Twilio Inc. | Sends and receives texts and calls | United States |
| Amazon SES and Resend, Inc. | Send email notifications and review requests | United States |
| Stripe, Inc. | Takes payment for the subscription | United States |
| Google LLC (Analytics, Ads) | Website analytics and ad measurement, where you ask us to install them | United States |
| Meta Platforms, Inc. | Ad measurement, where you ask us to install it | United States |
We’ll give you at least 30 days’ notice before adding or replacing a sub-processor, by email or in your account. If you object on reasonable data protection grounds, we’ll work with you in good faith to find a solution. If we can’t, you may cancel the service under the Terms.
9. Requests from your customers
Your customers may ask to see, correct, delete or limit the use of their information. We’ll give you the help you reasonably need to respond, such as exporting or deleting a person’s records. If someone contacts us directly about Customer Data, we’ll tell them to contact you, unless the law requires us to respond. We may charge a reasonable fee for help that goes beyond what the service already lets you do yourself.
10. Security Incidents
If we become aware of a Security Incident affecting Customer Data, we’ll tell you without undue delay and in any case within 72 hours. We’ll tell you what we know about what happened, what information is affected, and what we’re doing about it, and we’ll keep you updated. We’ll also help you meet any duty you have to notify your customers or regulators. We don’t notify them for you unless the law requires it. Our notice isn’t an admission of fault.
11. Audits and help with compliance
On reasonable written request, and no more than once a year unless there has been a Security Incident, we’ll give you the information you need to check that we’re following this DPA, such as a summary of our security practices or a completed security questionnaire. If a law requires an on-site audit, it will take place during business hours, with reasonable notice, at your cost, and under confidentiality and security rules we agree.
We’ll also give you reasonable help with data protection impact assessments and with questions from regulators about Customer Data.
12. Return and deletion
When your service ends, you have 30 days to export your Customer Data from the service, or to ask us to send it to you. After that, we’ll delete it within 60 days, and it will drop out of our backups on their normal cycle. We may keep information we are required by law to keep, and we’ll keep protecting it under this DPA.
13. International transfers
We and our sub-processors process Customer Data mainly in the United States.
EEA and Switzerland. If Customer Data from the European Economic Area or Switzerland is transferred to us in a country the European Commission hasn’t found to be adequate, the standard contractual clauses in Commission Decision 2021/914 (“SCCs”), Module Two (controller to processor), apply and are part of this DPA. You are the exporter and we are the importer. For the SCCs:
- Clause 7 (docking clause) applies.
- Clause 9(a): Option 2 (general written authorisation), with the notice period in section 8.
- Clause 11(a): the optional independent dispute resolution wording doesn’t apply.
- Clause 13 and Annex I.C: the competent supervisory authority is the one for the country where you’re established, or where your representative is.
- Clause 17: Option 1, and the law of Ireland. Clause 18(b): the courts of Ireland.
- Annex I.A: the parties are you and us, with the contact details in your account and in section 15. Annex I.B: the details in section 3. Annex II: the measures in section 7. Annex III: the sub-processors in section 8.
- For Switzerland, references to the GDPR are read as references to the Swiss Federal Act on Data Protection, “Member State” includes Switzerland so data subjects there may sue for their rights in Switzerland, and the Federal Data Protection and Information Commissioner is the competent authority for Swiss data.
United Kingdom. For Customer Data from the UK, the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner (version B1.0) applies and is part of this DPA. Table 1 parties and details are as above. Table 2 selects the SCCs as set out above. Table 3 information is in sections 3, 7 and 8. In Table 4, neither party may end the Addendum when the Commissioner issues a revised version.
Other places. Where another law, such as that of Canada or Australia, requires safeguards for sending information abroad, we’ll apply the safeguards the law requires.
If the SCCs or the UK Addendum conflict with the rest of this DPA or the Terms, the SCCs or the UK Addendum win.
14. Liability
Each side’s liability under this DPA is subject to the limits in the Terms, unless the law doesn’t allow that.
15. Changes and contact
If we change this DPA in a way that matters, we’ll give you 30 days’ notice, as the Terms describe. Questions about this DPA go to support@followsystems.com. FollowSystems LLC, 30 N Gould St, Sheridan WY 82801.