DDM Flow
Legal · Effective 1 September 2026

Data Processing Agreement (DPA)

This Agreement is between you (the Controller) and DDM Technology (Pty) Ltd (the Processor), trading as DDM Flow.

How to request a signed DPA

For business customers required to maintain a signed DPA for POPIA, GDPR, or vendor-due-diligence reasons, email dpa@ddmtech.co.za with:

  • Your registered company name + VAT number
  • The signatory's name, role, and contact email
  • Any jurisdiction-specific clauses you require

We turn signed DPAs around within 5 business days.

What our DPA covers

  • Categories of personal data processed (invoice, client, payment, bank)
  • Purposes of processing (issuing + collecting invoices)
  • Sub-processors (Supabase, Vercel, Resend, Paystack, Yoco, Anthropic, Sentry, PostHog, Plain)
  • Security measures (encryption, RLS, 2FA, audit logging)
  • Data subject rights handling (export, deletion within 30 days of request)
  • Breach notification — immediately. Section 21(2) of POPIA requires an operator to notify the responsible party as soon as it has reasonable grounds to believe personal information has been accessed or acquired without authorisation. There is no grace period, and this replaces the "72 hours" this page previously stated.
  • International transfers — the database and every processor listed below operate outside South Africa. Transfers are made under the standard contractual safeguards those providers publish.

Sub-processors

We engage the following sub-processors. Each has its own equivalent DPA in place with us:

  • Supabase — database, auth, storage (hosted in the EU)
  • Vercel — hosting + serverless functions
  • Resend — transactional email delivery
  • Paystack + Yoco — payment processing
  • Anthropic — Claude AI models, reached through the Vercel AI Gateway. Used for the AI assistants, receipt and document reading, expense categorisation, invoice design matching, tone classification of your clients' replies, nightly cash-flow alerts and tax explanations. Anthropic does not train on API data. There is no zero-data-retention agreement in place — an earlier version of this page said there was, which was incorrect: routing through the Gateway does not by itself create one. See section 3 of the Privacy Policy.
  • Sentry — error monitoring
  • PostHog — product analytics
  • Plain — support chat. Receives your name and email address so a reply can reach you.

Need something specific?

Email dpa@ddmtech.co.za or read more on our Trust page.