Subprocessor Register

Version: 2026-08-18
Effective date: 18 August 2026

This register identifies material providers that may process personal information for SMSFlow when the relevant Service is enabled. A provider may act as a subprocessor, operator, independent responsible party, or a combination depending on the processing activity and applicable terms.

Current material providers and categories

  • Flownamix group companies — authorised shared operational, legal, security, finance and administrative support — South Africa — intra-group controls and POPIA-aligned agreements.
  • Microsoft Azure — application hosting, databases, storage, messaging infrastructure, monitoring, backup and related cloud services — primarily South Africa for configured SMSFlow workloads, with provider support and ancillary processing potentially occurring in other Microsoft locations — contractual data-protection and transfer safeguards.
  • Microsoft Entra ID and Azure AD B2C — identity, authentication and account-security services — Microsoft’s applicable global service locations — contractual data-protection and transfer safeguards.
  • Meta and WhatsApp — WhatsApp Business Platform messaging, templates, business-account administration, webhooks, delivery events and connected services — locations used by Meta under its applicable terms — Meta contractual and platform safeguards and an applicable POPIA section 72 condition.
  • Peach Payments and participating financial institutions — card and payment processing, transaction status, settlement and fraud controls where that payment method is used — South Africa and other contracted processing locations disclosed by the provider — payment-provider contractual and security safeguards. SMSFlow does not intend to store full payment-card credentials.
  • Mobile networks and messaging aggregators — SMS routing, delivery, replies and sender administration — provider-dependent locations — applicable telecommunications agreements, security controls and POPIA transfer conditions where required.
  • Customer-selected applications, integrations and webhook destinations — processing selected and directed by the Customer — location chosen by the Customer or relevant provider — Customer instructions and the provider’s applicable terms.

Provider changes and objections

SMSFlow may update this register as providers, architecture and enabled Services change. Where the Data Processing Addendum requires advance notice, Customer may object on reasonable data-protection grounds within five Business Days or during any longer notice period stated in the notice or agreement.

If no reasonable solution is available, Customer may terminate the materially affected Service and receive the remedy stated in the Data Processing Addendum, excluding non-refundable third-party or provider costs properly incurred for Customer.

Questions or objections may be sent to [email protected].