This Data Processing Addendum (“DPA“) forms part of the agreement between Fleek Fintech LLP (“Fleek“, “we“) and the organization that signs up for Fleek CRM (the “Customer“, “you“), made up of the Terms of Service and your order or plan (“the Agreement“). It explains how we handle the personal data of your contacts: the people you import, message and manage in Fleek CRM. If this DPA and the Terms disagree about personal data, this DPA applies.
In short: your contacts are yours. You decide why and how their data is used. We store it, send the messages you ask us to send, keep it safe, tell you who else touches it, give it back when you ask, and delete it when you leave.
Who is responsible for what
For the personal data of your contacts, you are the Data Fiduciary (the “controller”) under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act“) and Fleek is your Data Processor. We process that data only on your documented instructions, which are: using Fleek CRM as described in the Agreement, the settings you choose, and the messages you tell us to send. Where Fleek uses personal data for its own purposes, for example billing and securing your account, we are responsible for that use and explain it in our Privacy Policy.
What you are responsible for
- A lawful basis. You only import and message people you are permitted to contact, and you hold the evidence. When you import a list, Fleek CRM asks whether you hold evidence of permission and records your answer, with your name and the date, against every contact in that file.
- Permission and opt-outs. Contacts who say No, reply STOP, click Unsubscribe or otherwise withdraw are blocked by Fleek CRM, and you must not try to work around that. You remain responsible for any other opt-out request you receive.
- Notices. You give your contacts any notice the law requires, and your messages identify you. Fleek CRM adds your name, postal address, registration details and an unsubscribe link to every email.
- Your content and your rules. The content of your messages, and compliance with the rules that apply to your business (for example SEBI or AMFI requirements) and with WhatsApp’s and the email providers’ policies, are yours.
- Accuracy and minimum data. You upload only what you need (a name and a phone number or email address). Do not upload sensitive financial identifiers, government ID numbers, health data or data of children.
- Your users. You decide which of your staff have access and you keep their sign-ins secure.
The data we process for you
| Data | About whom | Why we process it | How it is protected |
|---|---|---|---|
| Name, phone number, email address, how the contact was added, who owns the contact | Your contacts | To hold your contact list, to send the messages you choose and to show you replies | Phone numbers and email addresses are encrypted in the database (field-level encryption) and searched through one-way indexes, so they are not stored as readable text. Names are protected by access controls and are not field-encrypted. |
| Message content and delivery status (WhatsApp and email), replies, read and click events | Your contacts | To deliver your messages, show your Inbox and report delivery | Message text is encrypted in the database. Delivery events come from WhatsApp and the email provider. |
| Permission records: consent asked, given, declined or withdrawn, opt-outs, bounces, with dates and source | Your contacts | To prove and respect each person’s choices | An append-only record that holds identifiers and dates only, no phone numbers, emails or message text. |
| Uploaded import files and review decisions | Your contacts | To check and import your list | Each uploaded row is stored encrypted. Only counts and codes appear in audit logs. |
| Meetings and booking details (time, call type, video link) | Your contacts and your staff | To let contacts book a call with you | Access controls. If you connect Google Calendar, the event is created in your own Google account. |
| Contact quality checks (for example “shared mailbox”, “mistyped domain”) | Your contacts | To protect delivery and show you which addresses look risky | Stored as short codes and, for a mistyped domain, the suggested domain. The check never stores a second copy of the address. |
We do not use your contacts’ data to train AI models, to advertise, to build profiles, or to sell or share with anyone else, except as set out in this DPA. Fleek CRM does not send your contacts’ data to AI providers.
How we protect it
- Separation. Every request is limited to your organisation. Another customer’s users cannot see or reach your contacts, including their administrators.
- Encryption. Phone numbers, email addresses, message text and uploaded rows are encrypted before they are stored; encryption keys are kept separately from the data in a managed key store. Connections to Fleek CRM use HTTPS.
- Access. Sign-in uses individual accounts. Sessions expire. Customer data is not shown to Fleek staff in any screen (see “Fleek staff access” below).
- Records. Important actions, such as imports, exports, deletions, support access and plan changes, are written to an audit record without personal data.
- Logs and errors. Application logs and error reports are filtered to remove personal data.
- Backups. The database is backed up every night. Backups are encrypted and stored with Cloudflare R2 (Asia-Pacific region) and on our hosting provider’s servers, and are kept for 4 days.
- Monitoring. We watch for unusual access and have an incident process with the notification duties below.
Fleek staff access
By default nobody at Fleek can read your contacts or your messages through any Fleek screen. We make one exception, only to look into a problem you have raised with us, and you agree to it here:
- A Fleek administrator must open a time-limited, read-only grant for one contact, with a written reason. It lasts from one hour to 72 hours and expires automatically.
- Phone numbers and email addresses stay partly hidden; message text is shown because that is what is needed to help.
- Nothing can be exported or changed through a grant.
- Your organisation admin is emailed when a grant opens, sees every grant, the reason and how often it was used under CRM settings > Your data, and can end it at any time.
- Every use is recorded in an audit log.
Where Fleek engineers need access to systems that hold your data to keep the service running, for example to restore a backup, that access is limited to named people, recorded, and used only for that purpose.
Other companies that process your data (sub-processors)
You authorise us to use the following sub-processors. Each one is bound by terms that protect personal data to a standard no lower than this DPA.
| Sub-processor | What they do | Your contacts’ data they receive | Where |
|---|---|---|---|
| Meta Platforms (WhatsApp Business Platform) | Delivers your WhatsApp messages from your own WhatsApp Business account | Recipient number, message content, delivery and read status | Meta’s data centres, which include locations outside India. Meta charges WhatsApp usage to you directly. |
| Sendinblue SAS (Brevo) | Sends your emails, authenticates your sending domain, reports bounces, opens and clicks | Recipient email address, name, email content | European Union (Brevo is based in France) |
| Contabo GmbH (virtual private server hosting) | Servers and database that run Fleek CRM | All data in the table above, in encrypted form where stated | Europe |
| Cloudflare (R2 object storage) | Stores encrypted backups and the images and logo you upload for your emails | Backups of the database; images you upload | Asia-Pacific |
| Google (only if your staff connect Google Calendar) | Creates the call event and video link in your own Google account | Meeting title, time, and the contact’s email if invited | Google’s locations; used only for features you switch on |
Fleek’s own billing provider (Razorpay) receives your organisation’s and your staff’s billing details. It does not receive your contacts’ data.
We will tell you at least 30 days before we add or replace a sub-processor, by email to your organisation admin and on this page. If you object on reasonable data-protection grounds we will work with you; if we cannot resolve it, you may cancel without penalty before the change takes effect. We stay responsible for our sub-processors’ handling of your data.
Signals shared between customers
To protect everyone’s sending reputation, Fleek keeps one shared list of email addresses and phone numbers that have been confirmed not to exist (for example, a permanent bounce). The list holds only a one-way hash of the address or number. It holds no name, no message, no consent or opt-out information, and nothing that says which customer learned it. It is used so that a dead address one customer finds is not tried again by another. We do not share any other information between customers.
Transfers outside India
Some sub-processors, notably Meta and Brevo, process data outside India as described above. We transfer personal data only to the extent the DPDP Act and any rules or notifications under it permit, and we keep the safeguards in this DPA in place when we do.
Requests from your contacts
- Opting out. A contact can reply STOP on WhatsApp or click Unsubscribe in an email. Fleek CRM then stops sending to them automatically and keeps a record that they did.
- Other requests (access, correction, deletion, withdrawal of consent): your contacts will usually write to you. You can find, edit, export and delete their records in Fleek CRM yourself. If you need our help, ask us and we will respond within 7 days and complete a deletion within 30 days.
- If a contact writes to us directly, we will refer them to you and tell you, unless the law requires otherwise.
Personal data breaches
If we become aware of a personal data breach affecting your contacts’ data, we will tell your organisation admin without undue delay and in any case within 72 hours, with what we know: what happened, the data and approximate number of people affected, the likely consequences, what we have done and what we recommend you do. We will keep you updated, help you meet any duty to notify the Data Protection Board and affected people, and help you fix the cause. You alone decide whether and how to notify your contacts and the authorities, unless the law requires us to act.
Keeping, exporting and deleting your data
- Export any time. Your organisation admin can download all your contacts, with their permission status, from CRM settings > Your data.
- When you cancel or your plan ends, we keep your contacts and messages for one month so you can come back, and we email you a reminder before the deletion date. After that we delete them.
- What deletion removes: contact names, phone numbers, email addresses, message text, provider payloads and uploaded files. We perform deletion on request or at the end of the retention period and confirm it to you in writing.
- What we keep, and why: (a) anonymous contact records and permission and event records that hold no personal data, so counts and history stay accurate; (b) the one-way hashes of numbers and addresses that opted out or bounced, so that a person who said No is not messaged again if the same number is imported later; (c) invoices and payment records, which the law requires us to keep.
- Backups may keep deleted data until they are overwritten, within 4 days. It is not restored or used in that time.
- Copies at others. WhatsApp (Meta) and the email provider keep their own copies under their own policies, which we cannot delete for you.
Information and audits
On request, and no more than once a year unless there has been a breach, we will give you information that shows we are meeting this DPA, such as a summary of our security measures and our sub-processor terms. If that is not enough, you may audit us on 30 days’ written notice, during business hours, subject to confidentiality, and at your cost, in a way that does not disrupt the service or expose other customers’ data.
Liability, term and changes
The limits on liability in the Terms apply to this DPA. This DPA lasts as long as we hold your contacts’ data, including during the retention month. We may update it when the law changes or our service does; we will give you notice, and we will ask your organisation admin to accept a new version in Fleek CRM when the change affects you. This DPA is governed by the law of India and the courts of Pune have exclusive jurisdiction, as in the Terms.
Contact
For data protection questions or requests under this DPA, and for complaints to our grievance contact under the DPDP Act: contact@fleekfinance.in or +91 8956506362. Fleek Fintech LLP, Pinnacle, The Woods, Wakad, Pune 411057, India.