Data Processing Agreement

1. Parties

Controller: the customer who created the Flowgration account and accepts the Terms of Service. Processor:

2. Subject matter, nature and purpose

The processor will process the personal data the customer stores in Flowgration (contacts, opportunities, orders, activities, messages, invoices, time records and related content) only to provide the contracted service: hosting, organising, sending communications, automating, analysing and invoicing on the customer's instructions.

3. Duration

Processing lasts for as long as the customer's account is active. After cancellation, the deletion and return section applies.

4. Types of data and categories of data subjects

• Types of data: identification and contact details (name, email, phone, company), commercial and transactional data (orders, quotes, invoices), communications (emails, SMS, WhatsApp), usage and browsing data (if the customer enables web analytics) and any other data the customer chooses to enter.
• Categories of data subjects: the customer's clients, prospects, suppliers, employees and other contacts, and the users of its team.
• The customer must not enter special categories of data (Art. 9 GDPR) unless necessary and backed by a legal basis; in that case the customer alone is responsible for it.

5. Processor obligations

• Process data only on the customer's documented instructions, including those arising from the Terms, the service configuration and use of the API; if it believes an instruction infringes the law, it will tell the customer.
• Ensure that people authorised to process the data are bound by confidentiality.
• Apply appropriate technical and organisational measures under Article 32 GDPR: encryption in transit (TLS), integration credentials encrypted at rest, role-based access control and data isolation between organisations. They are described on the security page.
• Assist the customer, as far as possible, with data subject requests (access, rectification, erasure, restriction, portability and objection), impact assessments and consultations with the supervisory authority.
• Notify the customer without undue delay of any personal data breach it becomes aware of, with the information available so the customer can meet its own notification duties.
• Make available the information needed to demonstrate compliance with this DPA and allow reasonable audits on request and with notice, without affecting the security of other customers.

6. Sub-processors

The customer gives general authorisation to use the sub-processors in the public sub-processor list. The processor will announce any addition or replacement with reasonable notice so the customer can object on reasonable grounds; if no agreement is reached, the customer may cancel the service. The processor imposes obligations equivalent to this DPA on each sub-processor and remains liable to the customer for their performance.

View the sub-processor list

7. International transfers

Where a sub-processor processes data outside the European Economic Area, the transfer relies on the European Commission's Standard Contractual Clauses (Decision 2021/914), an adequacy decision or another valid safeguard under Chapter V GDPR.

8. Deletion and return

When the service ends, the customer can export its data. No later than 90 days after cancellation, the processor deletes the personal data, unless applicable law requires keeping it (for example accounting and tax records), in which case it is kept blocked for the legal period.

9. Liability and governing law

The parties' liability is governed by the Terms of Service. This DPA is governed by Spanish law and the GDPR.

10. Contact

To request a signed copy of this DPA, exercise rights or ask questions, write to info@flowgration.com.