A customer-specific agreement is required
This page describes the processing terms to agree before Butterflystack accesses customer-controlled personal data. It is not a signed data-processing agreement, an automatic international-transfer mechanism or a claim that a customer schedule has been completed. Ask us to execute a DPA naming the actual contracting parties and their contact details, with the processing schedule and provider arrangements attached.
Roles and instructions
The customer determines its business purposes and lawful basis as controller, or confirms its authority to appoint us where it is itself a processor. Butterflystack processes customer data only on documented instructions to deliver the agreed setup, migration, support, workflows or project work, unless law requires otherwise. We must flag an instruction we reasonably believe breaches applicable data-protection law. We do not use customer CRM records for our unrelated marketing.
Required processing schedule
The signed schedule must identify: the project and duration; the nature and purpose of processing; categories of individuals and personal data; any sensitive data and restrictions; approved systems, access roles and processing locations; security measures; authorised subprocessors; transfer safeguards; retention, export and deletion arrangements; and incident and rights-request contacts. Typical operations include importing, organising, configuring, transmitting and deleting records within the authorised systems. Special-category, health, card or children’s data needs explicit assessment and approval before access.
Confidentiality and security
The agreement must require personnel confidentiality and access limited to the authorised work. Its security schedule should record the actual measures used, including account access, multi-factor authentication where available, device protections, secure transfer methods, least-privilege permissions, access removal and backup responsibilities. Measures must reflect risk and available systems; a vendor certification is not a Butterflystack certification.
Providers and transfers
GoHighLevel may process data for the reseller platform under its own applicable terms and DPA. Other tools vary by project. The customer agreement must list approved subprocessors and their functions and locations, provide an appropriate notice and objection process for changes, and require equivalent relevant protections. Provider appointment does not remove our own duties. Where EU, UK or other transfer rules apply, the required transfer instrument and assessment must be completed separately; linking to HighLevel’s DPA does not execute those instruments for Butterflystack.
Assistance, incidents and assurance
The executed agreement must require prompt incident notification without undue delay after awareness, with available facts, affected records, likely impact and mitigation, followed by updates. It should provide proportionate assistance with rights requests, investigations, impact assessments and legally required notifications. The controller remains responsible for decisions and regulatory notifications applicable to it. It must also provide reasonable compliance information and proportionate audit arrangements while protecting other customers’ confidentiality.
End of processing
The signed schedule must state whether customer data is returned or deleted at the end of the engagement, the export format, timing, assistance fees if any, and how provider backups and legally required retention are handled. Continued retention must have a lawful reason and restricted use. Do not rely on an unspecified retention period or assume cancelling an account instantly erases every backup. Contact us to complete the agreement before transferring live personal data.
Contact Butterflystack
Contact: Butterflystack — Precious John
Email: legal@butterflystack.com
Location: Calabar, Cross River State, Nigeria.