Data Processing Agreement

1. Introduction

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Flowly (“Processor”) and the customer (“Controller”). It outlines how personal data is processed in accordance with UK GDPR and applicable data protection laws.

2. Roles of the Parties

• Controller: You, the customer, determine the purpose and means of processing.
• Processor: Flowly processes personal data on your behalf.

3. Scope of Processing

Flowly processes personal data solely to:

• Provide and maintain the Flowly platform
• Authenticate users and manage accounts
• Store operational and organisational data
• Provide support and resolve issues
• Ensure platform security and performance

Flowly will not process personal data for any purpose other than those documented by the Controller.

4. Security Measures

Flowly implements appropriate technical and organisational measures, including:

• Encryption of data in transit and at rest
• Strict access controls and authentication
• Audit logging and monitoring
• Regular security reviews and vulnerability scanning
• Secure development and deployment practices

5. Sub‑Processors

Flowly may engage third‑party sub‑processors to support the platform. All sub‑processors:

• Are bound by written data protection agreements
• Must meet or exceed Flowly’s security standards
• May only process data for authorised purposes

6. Data Subject Rights

Flowly assists the Controller in responding to data subject requests, including:

• Access requests
• Rectification or deletion
• Restriction or objection to processing
• Data portability

7. Personal Data Breach Notification

In the event of a personal data breach, Flowly will notify the Controller without undue delay and provide all relevant information required to meet legal obligations.

8. International Data Transfers

If personal data is transferred outside the UK or EU, Flowly ensures appropriate safeguards such as Standard Contractual Clauses (SCCs) or equivalent protections.

9. Termination & Data Return

Upon termination of the service, Flowly will delete or return all personal data processed on behalf of the Controller, unless retention is required by law.

10. Contact Us

For questions about this Data Processing Agreement, contact us at: https://flowly.company/