Data Processing Agreement (DPA)

  • Effective Date: 6 Oct 2026
  • Last Updated: 6 Oct 2026

This Data Processing Agreement (“Agreement”) forms part of the Terms of Service between:

Subscriber (the “Controller” / “Responsible Party”)

The individual or legal entity that has entered into the Terms of Service with Mighty Workflow and that determines the purposes and means of processing Customer Data.

and

MIGHTY TOOLKIT (PTY) LTD, trading as Mighty Workflow (the “Processor” / “Operator”)

A company registered in South Africa under registration number 2025/685291/07, with its registered address at:

2 Willow Ridge, Royal Ascot, Cape Town, Western Cape, 7441, South Africa.

1. Definitions

For the purposes of this Agreement:

  • “Controller” / “Responsible Party”: The party that determines the purposes and means of processing Personal Data (that’s the Subscriber).
  • “Processor” / “Operator”: The party that processes Personal Data on behalf of the Controller (that’s MIGHTY TOOLKIT (PTY) LTD, trading as Mighty Workflow).
  • “Data Subject”: An identified or identifiable natural person whose Personal Data is processed.
  • “Personal Data”: Any information relating to a Data Subject, as defined under Applicable Data Protection Law.
  • “Processing”: Any operation performed on Personal Data, whether automated or not, including collection, storage, organisation, structuring, adaptation, retrieval, consultation, use, disclosure, transmission, restriction, erasure, or destruction.
  • “Sub-processor”: A third party engaged by the Processor to process Personal Data on behalf of the Controller.
  • “Customer Data”: Content that the Subscriber, its Invited Users, or its Contacts submit to, send through, or create in the Services — including emails and attachments synced from mailboxes the Subscriber connects, documents, contact details, and workflow data. It does not include usage data, which we handle as a Controller under our Privacy Policy.
  • “Subscriber”: The individual or legal entity that enters into the Terms of Service by creating a Workspace in the Services. The Subscriber is legally responsible for the Workspace, including payment of fees, management of access and permissions, and all actions of Invited Users. In Mighty Workflow, the Subscriber is assigned the role of Owner.
  • “Invited User” (also “Team Member”): Any individual the Subscriber invites into a Workspace and to whom the Subscriber grants access, roles, and permissions within the Services (e.g., employees or contractors who collaborate in creating and managing workflows). The Subscriber controls Invited Users’ roles, permissions, and access, and may change or revoke them at any time.
  • “Contact”: An external party (e.g., a client, applicant, or supplier) whom the Subscriber or its Team Members communicate with by email through the Services to request, collect, or exchange documents or information. Contacts interact with the Services solely over email and do not access the Workspace. The Subscriber remains responsible for establishing a lawful basis to process Contacts’ Personal Data.
  • “Workspace”: The environment created by the Subscriber within the Services that contains Customer Data, Invited Users, and associated settings.
  • “Standard Contractual Clauses (SCCs)”: The standard contractual clauses for transfers of Personal Data to third countries approved by the European Commission in Implementing Decision (EU) 2021/914.
  • “Applicable Data Protection Law”: All laws and regulations governing the processing of Personal Data under this Agreement, including POPIA, the GDPR, the UK GDPR, and, where they apply, US state privacy laws.

2. Scope of the Agreement

This Agreement applies to all Customer Data that the Subscriber (Controller) collects, uploads, or manages using Mighty Workflow.

We, as Processor, will process Customer Data solely:

  • As necessary to provide, maintain, and support the Services,
  • On documented instructions from the Controller, and
  • In compliance with Applicable Data Protection Law and this Agreement.

The Terms of Service, this Agreement, and the Controller’s use and configuration of the Services are its complete documented instructions. We will tell the Controller if we believe an instruction infringes Applicable Data Protection Law.

Processing may include the use of sub-processors authorised under Section 5.

US state privacy laws: Where a US state privacy law such as the California Consumer Privacy Act (CCPA) applies, we act as the Controller’s service provider or processor. We will not sell or share Customer Data; retain, use, or disclose it outside our direct business relationship with the Controller or for any purpose other than providing the Services; or combine it with other data except as those laws permit. We will comply with the obligations those laws place on us, tell the Controller if we can no longer meet them, and allow the Controller to take reasonable steps to stop and remediate unauthorised use.

3. Our Responsibilities as the Processor

We shall:

  • Process Personal Data only under the Controller’s documented instructions.
  • Maintain confidentiality and ensure that personnel are bound by appropriate obligations.
  • Implement and maintain the security measures in Section 8.
  • Ensure that any sub-processors are bound by obligations no less protective than those in this Agreement.
  • Assist the Controller, where reasonably possible, with:
    • Data Subject rights requests,
    • Security incidents, and
    • Data Protection Impact Assessments (DPIAs).
  • Notify the Controller of any Personal Data breach as set out in Section 9.
  • On request, provide the Controller with an export of Customer Data, and delete all Customer Data at the end of the Agreement, as set out in Section 10, unless otherwise required by law.
  • Make available the information reasonably needed to demonstrate compliance with this Agreement and, if that is insufficient or a regulator requires it, allow one audit per year, at the Controller’s cost, on 30 days’ notice, by the Controller or an independent auditor bound by confidentiality.

4. Your Responsibilities as the Controller

The Controller is responsible for:

  • Ensuring a lawful basis for the collection and processing of Customer Data.
  • Providing required notices and obtaining valid consent from Data Subjects, where applicable.
  • Responding to Data Subject rights requests (we will provide reasonable assistance).
  • Ensuring Customer Data shared with Mighty Workflow complies with Applicable Data Protection Law.
  • Ensuring the accuracy, quality, and legality of Customer Data.
  • Configuring the Services appropriately, including roles, permissions, and security measures (e.g., requiring two-factor authentication, removing departing Users).
  • Having a lawful basis, and any authorisation required, for any special personal information, identity numbers, or financial records it processes, within the limits set out under “Sensitive Data” in Section 5 of the Terms of Service.

Children’s Data

The Controller is solely responsible for having a lawful basis, and any consent or authorisation required (including under POPIA), to process children’s personal information. It may be processed only where incidental to the services the Controller provides its clients (for example, dependants’ details supporting a tax return), as set out under “Sensitive Data” in Section 5 of the Terms of Service.

5. Sub-Processors

We use sub-processors to support the Services. A current list, including what each one processes and where, is published on our Sub-processors page. The Controller gives general authorisation for us to use the sub-processors listed there.

  • We will ensure each sub-processor is bound by data-protection obligations no less protective than those in this Agreement.
  • We will email Workspace Owners at least 14 days before a new sub-processor starts processing Customer Data.
  • The Controller may object on reasonable data-protection grounds within that period. If we cannot resolve the objection, the Controller may terminate the affected Services.

6. International Data Transfers

  • Hosting: Our primary servers are located in the European Union (EU), where Customer Data is hosted. Transfers from South Africa to the EU are permitted under section 72 of POPIA, as the GDPR gives substantially similar protection.
  • Other transfers: Some sub-processors operate outside the EU or South Africa (their locations are listed on our Sub-processors page). Where this occurs, we implement appropriate safeguards, such as Standard Contractual Clauses (SCCs), adequacy decisions, or equivalent protections.
  • UK and EU transfers: Where the GDPR or UK GDPR applies to Customer Data transferred to us, including our access to it from South Africa, Module 2 (controller to processor) of the SCCs and, for UK data, the ICO’s International Data Transfer Addendum are incorporated into this Agreement. For the SCCs: Clause 7 and the optional wording in Clause 11 do not apply; Option 2 of Clause 9(a) applies, with the notice period in Section 5; Clauses 17 and 18 select the law and courts of Ireland; and Annex I is completed by the parties’ details above and Section 7, Annex II by Section 8, and Annex III by our Sub-processors page. The Addendum’s Tables 1–3 are completed with the same information, and neither party may end it under its Section 19.
  • Subscriber responsibility: As the Controller, you remain responsible for ensuring that your use of the Services and any onward transfers of Customer Data comply with applicable laws.

7. Details of Processing

  • Subject matter and duration: Providing the Services for the term of the Terms of Service, plus the deletion period in Section 10.
  • Nature and purpose: Hosting, storing, and syncing email and files; sending and receiving email; organising workflows; and AI-assisted suggestions — as the Controller directs through its use of the Services.
  • Data Subjects: The Controller’s Users and Contacts, and people named in emails or documents.
  • Personal Data: Names and contact details; email content and attachments; documents the Controller collects, which may include identity documents, tax and other government reference numbers, and financial records; and workflow notes, to-dos, and comments.
  • Special categories: Only as incidental under “Sensitive Data” in Section 5 of the Terms of Service.

8. Security Measures

We maintain the following technical and organisational measures. They also form Annex II for the purposes of Section 6.

  • In transit: TLS on all connections to the Services.
  • At rest: Files, attachments, and database backups are encrypted. Email content, drafts, AI summaries, and connected-mailbox and calendar credentials are also encrypted in our database (AES-256-GCM).
  • Accounts: Passwords are hashed with scrypt; optional two-factor authentication is available to every User; sign-in is rate-limited; and sessions expire.
  • Separation and access: Each Workspace’s data is logically separated, role-based permissions apply within a Workspace, and key actions are recorded in an audit log.
  • Our access: Access to production systems and Customer Data is limited to personnel who need it. They are bound by confidentiality and use multi-factor authentication on all infrastructure accounts.
  • Infrastructure: ISO 27001-certified hosting (see our Sub-processors page), with DDoS protection from Cloudflare.
  • Maintenance: Security updates to operating systems, containers, and dependencies are applied regularly.
  • Backups: Encrypted, off-site database backups, kept for up to 30 days.

Security is a shared responsibility. The Controller manages roles and permissions, requires its Users to turn on two-factor authentication, and removes departing Users promptly.

9. Data Breaches

We will notify the Controller without undue delay upon becoming aware of a Personal Data breach. The notification will include:

  • The nature and scope of the breach,
  • The categories and approximate number of records affected,
  • The likely consequences, and
  • The measures taken or proposed to address the breach.

We will provide reasonable assistance to the Controller in complying with their breach notification obligations under Applicable Data Protection Law.

10. Deletion & Retention

Termination means the Workspace is closed (see Section 14 of the Terms of Service). Moving to the Free plan is not termination and deletes nothing.

  • Exports: During the Agreement, and for 60 days after termination, we will provide an export of Customer Data on the Controller’s request within 30 days, as a ZIP file of structured data together with the original files.
  • Retention after termination: Customer Data will be retained for 60 days after termination to allow an export to be requested or the Workspace to be reactivated.
  • Deletion: Customer Data will be securely deleted within 30 days after that 60-day period ends (no later than 90 days after termination), or sooner at the Controller’s request, unless longer retention is required by law.
  • Backups: Deleted Customer Data may remain in encrypted backups for up to 30 days.

11. Duration

This Agreement remains in force for as long as we process Customer Data on behalf of the Controller. Its obligations survive termination until all Customer Data has been deleted or returned in accordance with Section 10.

12. Governing Law

This Agreement is governed by the laws of South Africa. Both parties submit to the exclusive jurisdiction of the High Court of South Africa (Western Cape Division, Cape Town), except where Section 6 provides otherwise for the Standard Contractual Clauses.

13. Contact Information

For data protection matters, contact:

📧 [email protected]

🏢 2 Willow Ridge, Royal Ascot, Cape Town, Western Cape, 7441, South Africa

👤 Information Officer (POPIA): Allister Smith