Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the customer agreement between Sky Free ("Processor") and the customer organization ("Controller") that uses Sky Free.

The Controller determines the purposes and means of processing personal data. The Processor processes personal data only on documented instructions from the Controller, except where required by law.

Processing covers account administration, messaging/inbox services, CRM contacts, automations, billing, and related support for the term of the subscription and any lawful retention period after termination.

• Providing multi-channel messaging, CRM, and automation features.
• Authenticating users, securing the service, and preventing abuse.
• Processing payments and subscription lifecycle events.
• Providing customer support and service communications.

• Account data: name, email, phone, role, and authentication metadata.
• Contact/CRM data uploaded or synced by the Controller.
• Message content and conversation metadata.
• Billing and transaction records required for accounting.

The Processor may engage sub-processors to deliver the service. Current categories and providers are listed on the Sub-processors page. Material changes will be reflected there.

• Access controls, role-based permissions, and optional multi-factor authentication.
• Encryption in transit (HTTPS/TLS) and provider-managed encryption at rest.
• Logging, audit trails, and secrets handling controls.
• Account deletion and data export tools for Controllers and end users.

The Processor will reasonably assist the Controller in responding to data subject requests (access, portability, erasure, restriction, objection) via product tools and support at [email protected].

Where personal data is transferred internationally, the Processor relies on appropriate safeguards such as contractual commitments with sub-processors and access controls. Controllers should review hosting regions for their deployment.

On termination or Controller request, personal data will be deleted or returned in accordance with product deletion workflows and legal retention requirements (for example limited billing archives). Remaining archives are purged on a scheduled retention timeline.

Privacy and DPA questions: [email protected].