Data processing terms
DRAFT; needs Tas's legal review. This is not final legal wording. Text marked "Decision needed" is awaiting a decision.
Slot Flow Ltd ยท business-only service for adults aged 18 or over.
Who we are and who the service is for
- Slot Flow Ltd ("Slot Flow", "we") provides the Slot Flow reputation management platform.
- Registered office, company number and ICO registration number: [to be confirmed].Decision needed
- Slot Flow is a business-only service. You must be 18 or older and acting on behalf of a business to create an account.
- Slot Flow is not designed for, marketed to or intended for use by children.
Roles
- For customer feedback, the agency (or its business customer) is the controller and Slot Flow Ltd is the processor.
- We process feedback only on documented instructions, for the purpose of running the service.
Security and sub-processors
- Controls include mandatory two-step verification for agency staff, per-agency isolation in the database, encrypted payment keys, short-lived file links and an append-only audit log.
- Sub-processors: Supabase (database and sign-in), Cloudflare (hosting, files, email), Amazon Web Services SES (email), OpenRouter (AI summaries without names or contact details), Stripe (payments), Google (reviews).
- We will give 30 days' notice of a new sub-processor.Decision needed
- We will notify the agency of a personal data breach without undue delay and within 48 hours of becoming aware.Decision needed
International transfers and deletion
- Where data leaves the UK, we rely on the UK International Data Transfer Addendum or an adequacy decision.Decision needed
- Working draft, pending Tas: at the end of the contract we delete customer feedback within 90 days, unless law requires us to keep it.Decision needed