Data processing addendum

Last updated: 2026-10-31

This is Flung's standard data processing addendum. It applies without a signature, from the day a workspace accepts the terms of service. If your organisation needs a copy signed by both sides, write to legal@buungroup.com (opens in a new tab) with the workspace's name and your organisation's legal name, and we send one back countersigned.

TL;DR

The parties and their roles

Where the customer is itself a processor for someone else, Buun Group is its subprocessor, and the customer passes on the instructions of its own controller.

For the personal data of the people who sign in to Flung, used to run their accounts, bill the workspace and keep the service secure, Buun Group is a controller in its own right, as the privacy policy says. This addendum does not cover that data.

Details of the processing

The customer's instructions

The customer's instructions are these terms, the terms of service, and what the customer does in Flung: the calls its keys and apps make, and what its members do in the portal. Buun Group processes the personal data only on those instructions, unless the law requires otherwise, in which case it tells the customer first unless the law forbids that. Buun Group tells the customer if it believes an instruction breaks data protection law.

What the processor commits to

Security measures

Buun Group protects the personal data with, among others, these measures. The security page describes each in full.

• Every connection to Flung is encrypted in transit with TLS.
• Platform tokens, webhook signing secrets and integration credentials are encrypted in the database with AES-256-GCM, under a key kept for each environment and held apart from the database.
• Sign-in codes, session cookies and API keys are stored only as hashes.
• People sign in with a single-use emailed code, or with Google or GitHub. Sign-in, app approval and deletion forms are checked by Cloudflare Turnstile.
• Each workspace's data is reachable only with that workspace's credentials, and only owners may change its plan or delete it.
• The workspace's activity log, and the staff log of every staff action, record who changed what.
• The service runs on Cloudflare's infrastructure, which keeps the database's restore history.

Subprocessors

The customer gives general authorisation for Buun Group to engage subprocessors. The current ones, what each does and where, are on the subprocessors page.

The social platforms the customer posts to are not subprocessors: they are destinations the customer chooses, as the subprocessors page explains.

Rights requests

Data subjects may ask to access, correct, delete, restrict or move their personal data, or object to its use. Most of these the customer can answer itself in Flung: it can read a workspace's data through the API, disconnect an account, delete a post, a file or a brand, and delete the workspace.

When Buun Group receives a request about the customer's data directly, it passes it on to the customer without undue delay and does not answer it itself, unless the customer asks it to or the law requires it. Where the customer cannot answer a request with Flung's own tools, Buun Group helps, taking into account the nature of the processing.

Breach notification

If Buun Group becomes aware of a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to the customer's personal data, it tells the customer without undue delay, at the email addresses of the workspace's owners. The notice says, as far as is known then, what happened, the kinds and rough number of people and records affected, the likely consequences, and what Buun Group has done and proposes to do. More follows as it becomes known. Telling the customer is not an admission of fault.

Deletion or return at the end

When a workspace is deleted, Flung decommissions it at once and deletes it, with its accounts, posts, files and keys, 14 days later, as the data deletion page describes. Before deleting it, the customer may read its data out through the API, or ask legal@buungroup.com (opens in a new tab) for a copy, which Buun Group provides as an export in a common machine-readable format within 30 days.

A deleted record can remain for a limited time in the database's restore history, which Cloudflare keeps and which expires on its own. Buun Group keeps personal data after the end only where the law requires it, and then only for that purpose.

Audits

Buun Group makes available to the customer the information needed to show that it meets these terms. The customer may send a written questionnaire up to once a year, which Buun Group answers in reasonable time, and may rely on the reports of Buun Group's subprocessors, such as Cloudflare's certifications. Where that is not enough, or a supervisory authority asks, the customer may carry out an audit, or have an independent auditor bound to confidentiality carry it out, on 30 days' notice, during business hours, at the customer's cost, and in a way that does not put other customers' data at risk.

International transfers

Buun Group is in Australia, and Flung runs on Cloudflare's global network, so personal data may be processed in Australia and in other countries where Cloudflare and the other subprocessors operate.

Each subprocessor's own safeguards for the transfers it makes are described in its terms, linked from the subprocessors page. Where the Standard Contractual Clauses conflict with this addendum, the Clauses win.

Australian privacy law

Buun Group handles personal information in line with the Privacy Act 1988 and the Australian Privacy Principles. Where an eligible data breach under that Act affects the customer's data, Buun Group also meets the notification duties the Notifiable Data Breaches scheme sets.

Liability

Each party's liability under this addendum, and under the Standard Contractual Clauses where the law allows it, is subject to the limits in the liability section of the terms of service. Nothing here limits a data subject's own rights under the Clauses or under data protection law.

Order of precedence

Where this addendum and the terms of service differ about personal data, this addendum wins. Where a signed contract between the customer and Buun Group differs from both, the signed contract wins.

See also