Data Processing Agreement

Last updated 10 October 2026

Roles and scope

This summary forms the Data Processing Agreement under Article 28 UK GDPR between the customer (controller) and Rora Labs Ltd (processor) for the Cabinet Flow service. A signed copy is available on request from [email protected].

Processing details

• Subject matter and duration: hosting and processing the customer's business data for as long as the customer's account is active.
• Nature and purpose: storage, retrieval, display and backup of CRM records to provide the service.
• Data subjects: the customer's staff, leads and clients.
• Data categories: names, contact details, addresses, quote and job details, payment status.

Processor obligations

• Process only on the customer's documented instructions.
• Ensure personnel are bound by confidentiality.
• Maintain appropriate technical and organisational measures (encryption in transit, access controls, row-level security between tenants, backups).
• Engage sub-processors only as listed below; give at least 30 days' notice of changes so the customer can object.
• Assist with data subject requests and security obligations.
• Notify the customer of a personal data breach without undue delay and within 48 hours of becoming aware.
• Delete or return data at the end of the service (within 30 days of request) and allow reasonable audits.

Erasure procedure

To erase a client, lead or user record, email [email protected] from the account owner's address. We delete the relevant records and confirm by email within 30 days.

Sub-processors

Any email delivery provider used for account emails will be added here before it is enabled.

International transfers

Transfers outside the UK are made only under an adequacy regulation or the UK International Data Transfer Addendum.