WAFI GDPR Information

Roles

A WAFI customer generally determines why and how its lead, contact and property-workflow data is used and may act as controller. Propflow Technologies may act as processor for that customer and as controller for its own account, website, security and business-administration data.

Scope

This page applies when EU or UK GDPR covers the relevant processing. It does not mean every WAFI customer or record is subject to GDPR. Customers must determine which privacy laws apply to their organisation, markets and data.

Processing principles

• Lawfulness, fairness and transparency
• Purpose limitation and data minimisation
• Accuracy and appropriate retention
• Security and accountability

Lawful bases

Depending on the processing, the lawful basis may include contract, legitimate interests, consent, legal obligation or the establishment, exercise or defence of legal claims. Customers acting as controllers are responsible for identifying and communicating the lawful basis for their own CRM data.

Individual rights

• Access and correction
• Deletion where applicable
• Restriction or objection where applicable
• Data portability where applicable
• Complaint to an appropriate supervisory authority

Requests

Submit a privacy request through the WAFI contact page. Identity and authority may need to be verified before a request is fulfilled. Legal exceptions and customer instructions may apply.

Processor commitments

• Process customer personal data on documented instructions, subject to law.
• Apply appropriate confidentiality and security measures.
• Assist with valid rights requests and security obligations as reasonably required by the agreement.
• Use subprocessors under appropriate contractual protections.
• Delete or return customer data as required by the agreement and applicable law.

Subprocessors and security

WAFI may use providers for infrastructure, communications, analytics, security, billing or support. Access should be limited to the service purpose and protected through contractual, organisational and technical measures appropriate to the risk.

International processing

Where personal data is transferred internationally, WAFI and its providers will use applicable safeguards required for the relevant processing arrangement. Customers should assess their own regulatory requirements.

Security incidents

WAFI maintains processes to investigate suspected personal-data incidents. When WAFI acts as processor, affected customers will be informed as required by the applicable agreement and law so they can assess their notification duties.

Data processing terms

Customers requiring a data processing agreement, transfer terms or additional compliance documentation should contact WAFI before deployment. Any binding commitment must be included in an authorised written agreement.