Data Processing Agreement

This Data Processing Agreement applies to personal data submitted, stored, transmitted, generated, or otherwise processed through FlowPard on behalf of a customer. It governs processing connected with CRM records, contacts, proposals, contracts, invoices, appointments, messages, analytics, prompt tools, documents, API activity, communication services, and other enabled FlowPard features.

If this agreement conflicts with the general Terms of Service on matters concerning customer personal data, this Data Processing Agreement will control to the extent of that conflict.

Each party is responsible for complying with the data-protection obligations that apply to its role. The customer is responsible for ensuring that its collection and instructions are lawful and that required notices or permissions have been provided.

FlowPard will process customer personal data only on documented instructions from the customer, including instructions contained in the Terms of Service, this agreement, account settings, feature configurations, support requests, and actions performed through the platform.

• FlowPard will not use customer personal data for unrelated independent purposes.
• FlowPard may process data where required by applicable law and, where legally permitted, will inform the customer of that requirement.
• FlowPard may notify the customer when an instruction appears to violate applicable data-protection law.

FlowPard will restrict access to customer personal data to personnel and service providers who require access to perform authorised duties. Persons authorised to process customer personal data will be subject to confidentiality duties or another appropriate legal obligation of confidentiality.

FlowPard will maintain reasonable technical and organisational measures designed to protect customer personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.

Security measures may evolve as technology, risk, and the FlowPard platform change, provided the overall level of protection is not materially reduced.

The customer authorises FlowPard to engage subprocessors that assist with hosting, databases, cloud infrastructure, authentication, communications, analytics, payments, support, monitoring, storage, and related platform operations.

• FlowPard will require subprocessors to protect personal data through written obligations appropriate to the services they perform.
• FlowPard remains responsible for managing its subprocessors in accordance with this agreement.
• FlowPard may update its subprocessors as the platform evolves.
• Customers with a material data-protection concern may contact FlowPard for additional information.

FlowPard and its service providers may process customer personal data in countries other than the customer's location. Where required, FlowPard will use appropriate contractual, organisational, or legal safeguards for international transfers.

Customers are responsible for ensuring that their use of FlowPard and their instructions concerning international transfers comply with laws applicable to them and their data subjects.

FlowPard will provide reasonable assistance to help the customer respond to lawful requests from individuals seeking access, correction, deletion, restriction, portability, or objection concerning customer personal data.

• Where possible, customers should use FlowPard's account and platform tools to respond directly.
• If FlowPard receives a request concerning customer-controlled data, FlowPard may direct the requester to the customer.
• FlowPard will not independently respond on the customer's behalf unless authorised or legally required.

FlowPard will notify the affected customer without undue delay after becoming aware of a confirmed personal data breach involving customer personal data, where notification is required by applicable law.

The notice may include available information about the nature of the incident, affected data, likely consequences, mitigation steps, and contact information. FlowPard may provide information in stages as the investigation develops.

The customer remains responsible for determining whether notifications to individuals, regulators, or other parties are required.

During the service period, customers may access and export available customer data through FlowPard features. After termination or account closure, FlowPard will delete or return customer personal data within a reasonable period, subject to:

• Backup and disaster-recovery cycles.
• Security, fraud-prevention, audit, and dispute records.
• Financial, tax, legal, or regulatory retention obligations.
• Data that has been anonymised so it no longer identifies an individual.

On reasonable written request, FlowPard may provide information reasonably necessary to demonstrate compliance with this agreement, subject to confidentiality, security, legal, and operational restrictions.

Any audit request must be proportionate, relevant, scheduled in advance, avoid unnecessary disruption, and protect FlowPard's systems, other customers, confidential information, and security controls. The requesting customer may be responsible for reasonable costs associated with a specialised audit.

Contact FlowPard for data-processing questions, security enquiries, subprocessors, data-subject requests, or a signed enterprise data-processing agreement.