Data Processing Addendum

1. Who this is for

Business customers who upload or connect data containing personal data (for example a customer list, sales by account manager or payroll totals) and so act as its controller under the GDPR, the UK GDPR, India’s Digital Personal Data Protection Act 2023 (as data fiduciary) or a similar law. For your own account data, we are the controller and the Privacy Policy applies instead.

2. Definitions

• Customer data: personal data in the files, connected sources, canvases and comments you put into FlowProofs.
• Data protection law: the GDPR, the UK GDPR, the Swiss FADP, India’s DPDP Act and Rules, and US state privacy laws, as far as each applies.
• Controller, processor, data subject, personal data breach, processing: as defined in the GDPR (and the matching terms in other laws, for example data fiduciary and data principal in the DPDP Act).
• Sub-processor: a third party we engage that processes customer data.
• SCCs: the Standard Contractual Clauses adopted by the European Commission in Decision (EU) 2021/914, and the UK International Data Transfer Addendum.

3. Roles

You are the controller of customer data and we are your processor (or, where you are yourself a processor for someone else, our sub-processor). You are responsible for having a lawful basis for the data and for telling data subjects what the law requires. We process customer data only to provide FlowProofs to you.

4. Details of the processing

5. Our duties as processor

As GDPR Article 28(3) requires, we will:

• process customer data only on your documented instructions, which are these Terms, this DPA and what you do in FlowProofs, unless the law requires otherwise (we will tell you first, unless the law forbids it)
• tell you if we believe an instruction breaks data protection law
• make sure everyone authorised to process customer data is bound by confidentiality
• take the security measures in section 6
• use sub-processors only as section 7 describes
• help you answer data subject requests and meet your duties on security, breach notification and impact assessments (section 10)
• delete or return customer data at the end (section 12)
• give you the information needed to show compliance with Article 28, and allow audits (section 11)

6. Security

We maintain technical and organisational measures appropriate to the risk, including:

• encryption in transit (TLS, HSTS) and at rest (AES-256), and AES-256-GCM for stored connection credentials
• row-level security on every database table, so one account cannot read another’s data, and access checks on every API request
• uploaded files in private storage, readable only by our server for the owning account
• access to production systems limited to the people who run FlowProofs, with only the permissions each task needs
• records of sign-ins kept for at least one year
• backups by our database provider, and a written incident response plan

The security page describes them in plain language. We may improve these measures, but will not lower the overall level of protection.

7. Sub-processors

You give general authorisation for the sub-processors listed at /sub-processors. We bind each one by written contract to data protection duties at least as protective as this DPA, and remain responsible for them. We will give at least 30 days’ notice by email before adding or replacing a sub-processor. You may object on reasonable data protection grounds within that time; if we cannot resolve the objection, you may end the affected service and receive a refund of any prepaid fees for it.

8. International transfers

Where customer data is transferred out of the EU, EEA, UK or Switzerland to a country without an adequacy decision, the SCCs apply and are incorporated into this DPA by reference: Module 2 (controller to processor) or Module 3 (processor to processor), with option 2 of Clause 9 (general authorisation), the optional clause 7 omitted, Clause 17 governed by Irish law, Clause 18 courts of Ireland, and Annexes I and II completed by sections 3 and 5 of this DPA. For UK transfers, the UK Addendum applies; for Swiss transfers, the SCCs as adapted for the FADP. Our sub-processors provide matching transfer safeguards. Where Indian law applies, we transfer data only to countries it does not restrict.

9. Personal data breaches

We will notify you without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting customer data, with what we know: its nature, the data and people likely affected, likely consequences, and what we are doing about it. We will update you as we learn more and help you meet your own notification duties (for example 72 hours under the GDPR, and the DPDP Rules’ duties to the Data Protection Board and to data principals).

10. Helping you

• Data subject requests: if a data subject asks us about customer data, we will pass the request to you rather than answer it, unless the law requires us to. FlowProofs lets you find, export, correct and delete customer data yourself.
• Impact assessments and consultations: we will give reasonable information about FlowProofs for your data protection impact assessments and any prior consultation with a regulator.

11. Audits

On reasonable request, and no more than once a year (or after a breach, or when a regulator asks), we will answer a written security questionnaire and provide the information needed to show compliance with this DPA, including our sub-processors’ certifications and audit reports. If that is not enough to show compliance, you or an independent auditor bound by confidentiality may audit us with at least 30 days’ notice, during business hours, at your cost, in a way that does not disrupt the service or expose other customers’ data.

12. Deletion or return at the end

You can export all customer data from Settings at any time, as a ZIP. When you delete your account, or within 30 days of your agreement ending, we delete customer data from the live service; backups expire within 90 days. We keep data longer only where the law requires it, and then keep it confidential and process it only for that purpose.

13. Liability and precedence

Each party’s liability under this DPA is subject to the limitation of liability in the Terms, except where data protection law does not allow it. If this DPA conflicts with the Terms, this DPA wins for customer data; if the SCCs conflict with this DPA, the SCCs win.

14. Contact