Skip to content
profflow
Contact sales

Legal document

Data processing agreement

How Profflow Analytics OÜ processes the personal data in a company’s financial and payroll records on the company’s behalf, under Article 28 of the GDPR.

Last updated
2 November 2026
Issued by
Profflow Analytics OÜ
Registry code
17552133
VAT
EE103006985

1Parties and roles

This agreement is between the company that uses Profflow (the Customer) and Profflow Analytics OÜ (Profflow). For the financial and payroll data the Customer brings into Profflow, the Customer is the controller and Profflow is the processor. It is part of the terms of service and applies from the moment the Customer’s account is opened; a signed copy is available on request at hello@profflow.ee.

Company
Profflow Analytics OÜ
Registry code
17552133
VAT
EE103006985
Registered address
Paekaare tn 10, Tallinn, Estonia

An accountant, CFO or other person the Customer invites into its company in Profflow acts for the Customer and sees the data on the Customer’s decision. The Customer’s agreement with its accountant is its own.

2What is processed, and why

  • Purpose — providing Profflow: keeping the Customer’s data, working out cash, taxes, reports and forecasts from it, and showing them to the people the Customer lets in.
  • Nature — storage, structuring, calculation, display and deletion. Profflow never moves money, files returns or sends invoices in the Customer’s name.
  • Data subjects — the Customer’s users and contact persons, its employees, and its customers and suppliers who are natural persons.
  • Personal data — names and email addresses of users; names, account numbers and payment details in bank statements; names on invoices and bills; employees’ names, salaries and the taxes on them.
  • Duration — for as long as the Customer’s account is open, and the deletion period after it (section 8).

3Profflow’s obligations

  • Profflow processes the data only on the Customer’s documented instructions: the use of Profflow’s functions by the Customer’s authorised users is that instruction. If an instruction would break the law, Profflow says so.
  • Everyone at Profflow who can reach the data is bound to confidentiality.
  • Profflow does not use the data for anything of its own: no selling, no advertising, no training of models.

4Security

  • Encryption in transit (TLS) everywhere, and at rest in the database.
  • Each company’s data can be read only by its own accounts: row-level security in the database, roles inside the company (owner, CFO, accountant, manager).
  • API keys for accounting programs and payment providers are used for the one request they are given for, and are not stored.
  • Sign-in through Supabase; the founder’s own tools are behind a separate password.
  • Backups by the database provider; errors are logged without the financial content.

5Sub-processors

The Customer authorises Profflow to use these sub-processors, each bound by a data processing agreement of its own:

  • Supabase — database and sign-in, in the EU (Frankfurt).
  • Vercel — hosting the site and the dashboard (Frankfurt region).
  • Resend — sending email such as sign-in links.
  • Google (Gemini) — only when a user asks Ask AI: the question and the figures it needs.

Profflow tells the Customer by email 30 days before adding or replacing a sub-processor. If the Customer objects on reasonable grounds and no solution is found, it may end the service, and what it paid for the time after the change is returned.

6Transfers outside the EEA

Where a sub-processor processes data outside the European Economic Area, it does so under the European Commission’s standard contractual clauses or another safeguard the GDPR allows.

7Helping the Customer

  • With requests from data subjects: the Customer can see, correct, export and delete the data in Profflow itself; Profflow helps with what it cannot do there.
  • With security, impact assessments and the supervisory authority, as far as the information is Profflow’s.
  • With a personal data breach: Profflow tells the Customer without undue delay, and no later than 48 hours after becoming aware of it, with what is known and what is being done.

8At the end

Before the account is closed the Customer can export its data. Within 30 days after it is closed, Profflow deletes the Customer’s data, also from the sub-processors, except where the law requires it to be kept. Backups expire on the database provider’s schedule.

9Audits

Profflow gives the Customer the information needed to show that this agreement is kept. An audit by the Customer or an auditor it appoints is possible once a year, at the Customer’s cost, with 30 days’ notice and under confidentiality.

10Liability and law

Liability is as set out in the terms of service. This agreement is governed by the law of Estonia; disputes go to Harju County Court.