Turnflow Sign in

Data processing addendum

Processing your data on your behalf

Last updated 29 October 2026

This addendum forms part of the terms of service between you and CertioFlow. It applies when documents you upload contain personal data, for example names of employees in an audit report. If you need a countersigned copy, email hello@turnflow.dev.

1. Roles

You are the controller of personal data in the documents you upload. We process it as your processor, only to complete the requests you send.

2. Instructions

We process personal data only on your documented instructions: submitting a request is your instruction to complete that questionnaire from the evidence provided. We won't use it for anything else, including training models, and we'll tell you if we believe an instruction breaks data protection law.

3. Nature and duration

  • Data: whatever personal data appears in your questionnaire and evidence (typically names, job titles and work contact details), plus your account name and email.
  • Data subjects: your staff, contractors and other people named in your documents.
  • Duration: from upload until deletion, 14 days after delivery or sooner on request.

4. Confidentiality

Anyone at Turnflow who can access your documents is bound by confidentiality and only accesses them to complete or support your request.

5. Security measures

  • All traffic to the service is encrypted in transit (HTTPS).
  • Requests are visible only to the Google account that sent them. Download links are long random tokens stored only as hashes, and they expire after 7 days.
  • Reviewer access requires a password.
  • Each request is processed separately; documents from different clients are never combined.
  • Files are deleted automatically 14 days after delivery, and unpaid or cancelled requests are deleted promptly.

6. Subprocessors

You authorize the subprocessors listed on our subprocessors page. We impose data protection obligations on each that are no less protective than this addendum, and remain responsible for their performance. We update that page at least 14 days before adding a new one; if you object, you may stop using the service and have your files deleted.

7. Helping you

Taking into account the nature of the processing, we'll help you respond to requests from data subjects and meet your obligations on security, breach notification and impact assessments.

8. Personal data breaches

We'll notify you without undue delay, and within 72 hours, after becoming aware of a breach affecting your data, with the information we have about what happened and what we're doing about it.

9. Deletion

When processing ends we delete your documents and outputs, keeping only a record that the request existed (dates, status and file names), unless the law requires us to keep more. Deleted data can remain in our hosting provider's encrypted daily backups until they expire, at least 7 days later; backups are used only for disaster recovery.

10. Transfers

Our subprocessors are located in the United States. Where the law requires a transfer mechanism for data leaving your region, the European Commission's Standard Contractual Clauses (or the UK equivalent) apply to the transfer.

11. Audits

We'll make available the information reasonably needed to show we meet this addendum, starting with written answers to your security questions, and cooperate with reasonable audits on notice at your cost.