This is a translation provided for convenience. For Offices in Israel, the Hebrew version is binding.
Data Processing Agreement (DPA) — CPAADV Flow
Version 1.0 · Last updated: 12 October 2026
This Agreement forms an integral part of the CPAADV Flow Terms of Service and is made between the subscribing Office (the "Office", the controller) and HI ACCOUNT LTD (היי אקאונט בע״מ), Israeli company no. 516598737 (the "Processor"), which operates the Service. It applies from the moment the Account Owner accepts the Terms. Terms not defined here have the meaning given in the Terms of Service.
1. Roles and scope
1.1. For "Office Data" — personal data about the Office's End Clients and other individuals contained in Content that the Office and its End Clients upload to or enter into the Service — the Office is the controller and the Processor processes it on the Office's behalf.
1.2. This Agreement does not apply to data for which the Operator is itself responsible (such as data about Office users, accounts, billing and security), which is covered by the Privacy Policy.
2. Description of processing
- Data subjects: the Office's End Clients, and other individuals whose data appears in documents or messages.
- Categories of data: name, phone number, uploaded documents and files and their content, messages and lists of requested documents. Documents may contain financial data, health data, identity numbers or other sensitive data, depending on what the Office requests.
- Processing operations: receipt, storage, organisation, display to authorised Office users, download, moving to the recycle bin and deletion, as well as backup and security.
- Purpose: providing the Service to the Office only.
- Duration: the term of the contract and thereafter until deletion under section 9.
3. Processing on the Office's instructions
3.1. The Processor will process Office Data only on the Office's documented instructions — including instructions given through use of the Service and its settings, the Terms and this Agreement — or as required by law. If the law requires other processing, the Processor will inform the Office before processing unless the law prohibits it.
3.2. If the Processor considers that an instruction of the Office infringes the law, it will inform the Office.
3.3. The Office is responsible for having a lawful basis to collect Office Data and provide it to the Processor, and for giving End Clients any required notices.
4. Confidentiality
The Processor will give access to Office Data only to employees and providers who need it to provide the Service, support, security and fault fixing, and who are bound by confidentiality undertakings or a statutory duty of confidentiality.
5. Security
5.1. The Processor will take technical and organisational measures appropriate to the risk, including: enforced separation between offices at the database level; role-based permissions; private document storage with no public links, every download passing a server-side permission check; random Portal links stored as hashes and revocable; encrypted transport; and filtering of sensitive data from operational logs.
5.2. The Processor will review and update these measures from time to time. This Agreement contains no commitment to any particular standard or certification.
6. Subprocessors
6.1. The Office gives general authorisation for the Processor to engage the subprocessors listed in the Subprocessor List.
6.2. The Processor will notify the Account Owner by email or in the Service at least 30 days before a planned addition or replacement of a subprocessor that processes Office Data, where practical. Where an urgent change is required for security, service continuity or legal compliance, the Processor may make it with shorter or no prior notice and will notify the Account Owner as soon as reasonably practicable. The Office may object on reasonable data protection grounds; if the parties cannot agree, the Office may cancel the subscription before the change takes effect or, for an urgent change, within 30 days of the notice.
6.3. The Processor will impose on each subprocessor data protection obligations appropriate to the service it provides, and remains responsible to the Office for performing its obligations under this Agreement.
7. International transfers
Office Data is hosted mainly in the European Union. Office Data will be transferred outside Israel and the European Union only to approved subprocessors and subject to the requirements of applicable law on data transfers.
8. Assistance and security incidents
8.1. Taking into account the nature of the processing and the information available to it, the Processor will reasonably assist the Office in responding to requests from data subjects and in meeting the Office's obligations on security and impact assessment. A request from an End Client that reaches the Processor will be forwarded to the Office.
8.2. If the Processor becomes aware of a security incident that has caused unauthorised access to, alteration, loss or disclosure of Office Data, it will notify the Account Owner without undue delay and provide, insofar as known: the nature of the incident, the categories of data and data subjects affected, the measures taken and a contact point. The Processor will cooperate with the Office in investigating the incident and mitigating its effects.
9. Termination, return and deletion
9.1. During the contract, and in the read-only mode that follows it, the Office can download the documents in its workspace through the Service.
9.2. After the contract ends the Processor will delete Office Data in accordance with the retention policy described in the Privacy Policy. While automatic deletion is not active, the Account Owner may request in writing, at [email protected], the deletion of the Office workspace or of specific Office Data. The Processor will verify the request and the requester's authority and carry it out through a documented, controlled procedure within a reasonable time, except for data the law requires to be kept. Deletion is not immediate and is subject to section 9.4.
9.3. Data that must be kept by law will be held separately, with restricted access, and only for the required period.
9.4. Data deleted from the Service may remain for a limited period in backups that the database provider keeps as part of its service, until they expire in the ordinary course. Such copies are used only to recover the Service after a failure.
10. Audit information
On request and at a reasonable frequency, the Processor will provide the Office with information needed to demonstrate compliance with this Agreement, including a description of its security measures and the subprocessor list, while protecting confidentiality, the security of other offices and proportionality. Any further audit will be arranged in advance, where required by law.
11. Precedence and language
For the processing of Office Data, this Agreement prevails over the Terms of Service. This Agreement is published in Hebrew and English; for Offices in Israel the Hebrew version is binding to the extent permitted by law.