Data Processing Addendum

1. Definitions

• Controller means the customer who decides the purposes and means of processing
• Processor means FlowProofs (Axelon Tech), processing on the controller’s behalf
• Data subject means the individual whose personal data is processed
• Sub-processor means a third party we engage to process personal data

2. Scope

This DPA applies when you use FlowProofs to process the personal data of your own end users, clients or employees. For example: uploading a dataset that contains personal information, or building an explanation model that references named individuals.

3. Our obligations as processor

We will:

• Process personal data only on your documented instructions
• Ensure the people who handle it are bound by confidentiality
• Implement appropriate technical and organisational security measures
• Help you respond to data subject requests
• Tell you about a personal data breach without undue delay
• Delete or return personal data when the service ends
• Give you the information you need to demonstrate compliance

4. Sub-processors

The current list is at /subprocessors. We will give you at least 30 days’ notice before adding one.

5. International transfers

Cross-border transfers are governed by Standard Contractual Clauses, as described in Section 7 of our Privacy Policy.

6. Data subject requests

If a data subject contacts us about personal data you control, we will point them to you rather than answer, unless the law requires us to respond directly.

7. Contact

For anything DPA-related: privacy@flowproofs.com