Data Processing Addendum
How we process personal data on your behalf when we host the platform for you.
Last updated
DraftThis is a plain-language draft that has not yet been reviewed by legal counsel. It describes how the service works today and may change.
Scope
This addendum applies where we host the platform and process personal data on your behalf. You are the controller of that data; we are the processor. It does not apply to self-hosted deployments, where the data does not reach us.
Our commitments as processor
- Process personal data only on your documented instructions, which include using the service as designed.
- Keep it confidential and limit access to people who need it.
- Apply the technical and organizational measures described on the Security page.
- Use sub-processors only with notice, and list them in the Trust Center.
- Help you respond to data-subject requests and to meet your own obligations.
- Tell you without undue delay if we become aware of a personal-data breach affecting your data.
- Delete or return personal data when the service ends, as you choose.
International transfers
Where data is transferred across borders, we will rely on a lawful transfer mechanism and tell you which one applies. Deployment and data-residency options are available for enterprise customers where offered.
Audits
We will make available the information reasonably needed to demonstrate compliance with this addendum.
Requesting a signed copy
A signed addendum is available on request: hello@flowdoo.tools.