Data Processing Agreement

Last updated: September 10, 2024

1. PARTIES

This Data Processing Agreement and its Annexes (collectively, the “DPA”) reflects the parties’ agreement with respect to the Processing of Personal Data by Flowla, Ltd, a company incorporated in the United Kingdom (hereinafter referred to as “Flowla”, the "Processor” or “we”, and through similar words such as “us”, “our”, etc.) on behalf of the you and/or the entity you represent (“Member”, “Controller”, “you” or “your”) in connection with the Services provided by Flowla under the Terms of Use between you and Flowla (also referred to in this DPA as the “Agreement”).

Flowla and the Member may herein after being individually referred to as the “Party” and together as “Parties”.

Capitalized terms not otherwise defined herein have the meaning given to them in the Terms of Use.‍

2. SUBJECT MATTER OF THE AGREEMENT

2.1. The Parties seek to implement this DPA that complies with the requirements of the current legal framework in relation to data processing and with the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, General Data Protection Regulation (the “GDPR”); United Kingdom General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018 (the “Act”)
2.2. This DPA is an integral part of the Agreement executed between Flowla and the Member.

3. DEFINITIONS

3.1. Unless otherwise defined herein, capitalized terms and expressions used in this Agreement shall have the following meaning:
1. 1. “Data Protection Laws” means any and all data privacy, cybersecurity and data protection laws, rules and regulations to which the Parties are subject. Data Protection Laws shall include, but not limited to, GDPR the UK GDPR, the Act and California Consumer Privacy Act (“CCPA”), together with all legislation made thereunder and any other laws relating to the processing of Personal Data, in each case as amended, superseded or replaced from time to time;‍
  2. “Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data.
  3. “Controller”, “Processor”, “Personal Data”, “Data Subject”, “Processing”, “Personal Data Breach” and “Member State” shall all have the meanings given to them in the GDPR and UK GDPR. The terms “Personal Information”, “Business”, “Business Purpose”, “Consumer”, “California Consumer”, “Service Provider” and “Sell” shall have the meaning ascribed to them in the CCPA. “Data Subject” shall also mean and refer to “Consumer” as such term is defined in the CCPA. “Personal Data” shall also mean “Personal Information” for the purpose of this DPA.
  4. “Personal Data” means “any information relating to an identified or identifiable natural person (“Data Subject”); an identifiable person is one who can be identified, directly or indirectly, in particular by reference identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person", as defined under the GDPR and includes any equivalent definition in the Data Protection Laws,
  5. “Processor” means a natural or legal person, public authority, agency or other body which Processes Personal Data on behalf of the Controller.
  6. “Processing of Personal Data” (or “Processing/Process”) means “any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction” as defined under the GDPR and includes any equivalent definition in the Data Protection Laws;
  7. “Purpose” means the Services and the associated Description of the Processing Operations defined in Annex-1 to this DPA;
  8. “UK GDPR” means the Data Protection Act 2018 and the GDPR as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 and as amended by Schedule 1 to the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 (SI 2019/419).
  9. “UK Addendum to the SSCs” “means the International Data Transfer Addendum (the “IDTA”) to the EU Commission Standard Contractual Clauses (the “SCCs” defined below) issued by the Commissioner under S119A (1) Data Protection Act 2018;
  10. “New Standard Contractual Clauses” or “SSCs” means the Standard Contractual Clauses for the transfer of personal data to third countries pursuant to GDPR and adopted by the European Commission Decision 2021/914 on 4 June 2021;
  11. “Services” means the sales enablement solution offered by Flowla for the Members to monitor the interest of the prospects and receive accurate and actionable analytics on their business documents;
  12. “Sub-processor” means any third-party processor engaged by Flowla to process Personal Data exclusively intended for the Processing activities to be carried out on behalf of the Member after the transfer of Personal Data in connection with this DPA.‍

4. DATA PROCESSING

4.1. The Parties acknowledge that Member is the Controller of the Personal Data and Flowla is acting as a Processor on behalf of Member in providing the Services. By the nature of the Services, the Data Subjects whose Personal Data is processed are both Member and Contact to the extent that they share their Personal Data with Flowla. This DPA regulates the rights and obligations of the Parties in terms of the Personal Data processed within the scope of the Agreement. For the avoidance of doubt, any rights and obligations in terms of the Personal Data processed within the scope of the usage of Flowla’s Services by the Contact, are determined within the Terms of Use published by the Flowla on its Website and other Flowla platforms.
4.2. The details of the Processing of Personal Data by Flowla as a Processor are set out in Annex-I (“Details of Processing”) to this DPA.
4.3. Flowla is not responsible for the privacy practices of the Members, and only Processes Personal Data in accordance with the Agreement it has with the Members. Members shall have sole responsibility for the legality and accuracy of Personal Data and the means by which they acquired the Personal Data.
4.4. The Parties agree that the Services are not intended for the Processing of Sensitive Data.
4.5. The Processor certifies that it understands the rules, requirements and definitions of the CCPA and agrees to refrain from selling (as such term is defined in the CCPA) any Personal Information processed hereunder without Member’s prior written consent and taking any action that would cause any transfer of Personal Information to or from Processor under the Agreement or this DPA to qualify as “selling” such Personal Information under the CCPA.

5. DATA TRANSFERS

5.1. Member acknowledges and agrees that Flowla may access and Process Personal Data on a global basis as necessary to provide its Services in accordance with the Agreement, and in particular that Personal Data may be transferred to other jurisdictions where Sub-Processors operate. Wherever Personal Data is transferred outside its country of origin, each Party will ensure such transfers are made in compliance with the requirements of Data Protection Laws.
5.2. If the Member is situated in a country within the EU and EEA, and a Personal Data is transferred to a Sub-processor outside of the UK and EEA, the SCCs shall apply in relation to such transfer and shall be incorporated in this DPA.
5.3. If the Member is situated in the United Kingdom, and a Personal Data is transferred to a Sub-processor established outside of the UK and EEA, the UK Addendum to the SCCs shall apply in relation to such transfer. In this case, the Sub-processor and the Member may use IDTA or UK Addendum to the SCCs when transferring Personal Data to the country not covered by an “adequate decision”.

6. RESPONSIBILITIES OF THE MEMBER

6.1. Member represents and warrants that the processing of Personal Data complies with Data Protection Laws, including by establishing a lawful basis if and as required, and that the instructions provided to Flowla shall comply with Data Protection Laws. In the event GDPR, UK GDPR or CCPA do not apply to the Member, then Member must abide by whatever other Data Protection Laws and at a minimum: (i) obtain and maintain any and all authorizations, permissions and informed consents, as may be necessary under applicable laws and regulations, in order to allow Flowla to lawfully process and use the Member Data within the scope of the Services; and (ii) have, properly publish and abide by an appropriate privacy policy that complies with all Data Protection Laws.
6.2. Member is responsible for independently determining whether the data security provided for in the Service adequately meets the Member’s obligations under applicable Data Protection Laws.

7. OBLIGATIONS OF FLOWLA

7.1. Compliance with Instructions. Flowla undertakes to Process Personal Data only for the Purpose described in the Annex-1 to this DPA or as otherwise agreed within the scope of the Member’s lawful instructions, except where and to the extent otherwise required by applicable law.
7.2. Conflict of Laws. If Flowla becomes aware that it cannot Process Personal Data in accordance with the Member’s instructions due to a legal requirement under any applicable law, it will (i) promptly notify the Member of that legal requirement to the extent permitted by the applicable law; and (ii) where necessary, cease all Processing (other than merely storing and maintaining the security of the affected Personal Data) until such time as the Member issue new instructions with which we are able to comply. If this provision is invoked, Flowla will not be liable to the Member under the Agreement for any failure to perform the applicable Services until such time as the Member issues new lawful instructions with regard to the Processing.
7.3. Security. Flowla implements and maintains appropriate technical and organizational measures to protect Personal Data from Personal Data Breaches, as described under Annex-3 to this DPA (“Technical and Organizational Security Measures”). Notwithstanding any provision to the contrary, the Processor may modify or update the Security Measures at the Processor’s discretion provided that such modification or update does not result in a material degradation in the protection offered by the Security Measures.
7.4. Confidentiality. The Processor ensures that any personnel whom they authorize to Process Personal Data on their behalf is subject to appropriate confidentiality obligations (whether a contractual or statutory duty) with respect to that Personal Data.
7.5. Personal Data Breaches. The Processor shall notify the Controller without undue delay after the Processor becomes aware of any Personal Data Breach and provide timely information relating to the Personal Data Breach as it becomes known or requested by the Controller within a reasonable time. At the Controller’s request, Flowla will provide the Member with such reasonable assistance as necessary to enable you to notify relevant Personal Data Breaches to competent authorities and/or affected Data Subjects, if you are required to do so under Data Protection Laws.
7.6. Return or Deletion of Data. Flowla shall return or securely destroy Personal Data, in accordance with the Member’s instructions, upon Member’s request or upon the termination of Member’s account(s) or the termination of the Agreement unless such Personal Data must be retained to comply with applicable law.
7.7. Flowla Assistance with Data Subject Requests. Taking into account the nature of the processing, the Service Controls are the technical and organizational measures by which Flowla will assist Member in fulfilling Member’s obligations to respond to Data Subjects’ requests under the GDPR. If a Data Subject makes a request to Flowla, Flowla will forward such request to Member once Flowla has identified that the request is from a Data Subject for whom Member is responsible. The Parties agree that Member’s use of the Services and Flowla forwarding Data Subjects’ requests to Member in accordance with this Article, represent the scope and extent of Member’s required assistance.

8. SUB-PROCESSING

8.1. Member acknowledges and agrees and hereby authorizes Flowla to engage Sub-processors that are: (a) an Affiliate of Flowla; and (b) third-party Sub-processors, process the Personal Data for and on behalf of Flowla and/or an Affiliate of Flowla, in each case in connection with the provision of the Services and to fulfill the obligations set forth under the Agreement.
8.2. Flowla will make available to Member the current list of Sub-processors used by Flowla to process Personal Data upon written request of Member within a reasonable time. The Member provides general authorisation to Flowla’s use of Sub-processors to Process Personal Data on behalf of the Member, including those set out in such list.
8.3. Flowla shall provide Member with notification of any intended new Sub-processor(s) by sending an e-mail to the e-mail address given by the Member. Member may reasonably object to Flowla’s use of a new Sub-processor, for reasons relating to the protection of Personal Data intended to be Processed by such Sub-processor, by notifying Flowla promptly in writing within 7 (seven) days after receiving the aforesaid notice. Member shall ensure that such written objection shall include the reasons for objecting to Flowla’s use of such new Sub-processor. Failure to object to such new Sub-processor in writing within 7 (seven) days following Flowla’s notice shall be deemed as acceptance of the new Sub-processor. In the event Member reasonably objects to a new Sub-processor, as permitted in the preceding sentences, Flowla will use reasonable efforts to make available to Member a change in the Services or recommend a commercially reasonable change to Member’s configuration or use of the Services to avoid Processing of Personal Data by the objected-to new Sub-processor without unreasonably burdening the Member. Until a decision is made regarding the new Sub-processor, Flowla may temporarily suspend the Processing of the affected Personal Data and/or suspend access to the Member’s account applicable to the affected Agreement. Member will have no further claims against Flowla (including requesting refunds for Services) as a result of or in connection with the termination of the Agreement, or any part of it, pursuant to this Article ‎8.3.

9. AUDITS

9.1. Controls for the Protection of Personal Data. Flowla shall maintain industry-standard technical and organizational measures for the protection of Personal Data processed hereunder including protection against unauthorized or unlawful Processing and against accidental or unlawful destruction, loss or alteration or damage, unauthorized disclosure of, or access to, Personal Data, confidentiality and integrity of Personal Data, including those measures set forth in the Annex-3 Technical and Organizational Measures, as may be amended from time to time. Upon the Member’s reasonable request, Flowla will reasonably assist Member, at Member’s cost in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR and/or UK GDPR taking into account the nature of the Processing and the information available to Flowla.
9.2. Audits and Inspections. Upon Member providing at least 14 days prior written request (no more than once every 12 months) at Member’s expense, Flowla shall:
1. 1. make available to Member, and/or Member’s independent, reputable, third-party auditor, information necessary to demonstrate Flowla’s compliance with Data Protection Laws.
  2. allow for and contribute to audits, including inspections, conducted by them, provided that:
    1. Flowla shall not provide information to Member pursuant to paragraph 9.2.1 where the Member is a competitor of Flowla (as determined by Flowla);
    2. prior to receiving any information pursuant to paragraph 9.2.1 or Flowla allowing for or contributing to audits or inspections pursuant to paragraph 9.2.2, each of the Member and any third-party auditor shall enter into confidentiality undertakings satisfactory to Flowla; and
    3. all such information, audits, inspections and the results therefrom, including the documents reflecting the outcome of the audit and/or the inspections, shall only be used by Member and/or third-party auditor to assess compliance with this DPA, and shall not be used for any other purpose or disclosed to any third party without Flowla’s prior written approval.
9.3. Upon Flowla’s request, Member shall return all records or documentation in Member’s possession or control provided by Flowla in the context of the audit and/or the inspection. Nothing in this paragraph ‎8.2 varies or modifies the Standard Contractual Clauses nor affects any Supervisory Authority’s or Data Subject’s rights under the Standard Contractual Clauses.
9.4. In the event of an audit or inspections as set forth in paragraph ‎8.2, Member shall ensure that it (and each of its mandated auditors) will not cause (or, if it cannot avoid, minimize) any damage, injury or disruption to Flowla’s premises, equipment, personnel and business while conducting such audit or inspection.

10. TERM

This DPA will enter into force as of the date of acceptance or signature (the “Commencement Date”) hereof and shall continue in full force and effect until the termination of the Purpose as defined in Annex-1.

11. GOVERNING LAW

This DPA is governed by the same laws as the same jurisdiction which governs the Agreement.

12. MISCELLANEOUS PROVISIONS

12.1. Severability. If any term or provision in this DPA shall be held to be illegal or unenforceable, in whole or in part, under any enactment or rule of law, such term or provision or part shall to that extent be deemed not to form part of this DPA but the enforceability of the remainder of this DPA shall not be affected.
12.2. Waiver. The failure by the Parties to exercise any right, power, or privilege under the terms of this DPA will not be construed as a waiver of any subsequent or future exercise of that right, power, or privilege or the sole or partial exercise of any other right, power, or privilege.
12.3. Amendments. Notwithstanding anything else to the contrary in the Agreement and without prejudice to the ‘Compliance with Instructions’ or ‘Security’ sections of this DPA, Flowla reserves the right to make any updates and changes to this DPA.
12.4. Notices. Any notice, letter or other communication contemplated by this Agreement shall be communicated in writing via registered mail to the registered addresses of the Parties or via electronic mail, delivery and read receipt requested.

ANNEX – I: DETAILS OF PROCESSING

‍

A. List of Parties

Data exporter:

Name: The Member, as defined in the Flowla Terms of Use

Role: Controller

Data importer:

Name: Flowla, Ltd.

Role : Processor

Activities relevant to the data transferred under these Clauses: Processing of Personal Data in connection with Member’s use of the Flowla Services under the Agreement

‍

B. Nature and Purpose of Processing

Personal Data will be Processed in accordance with the Agreement including this DPA and may be subject to the following Processing activities:

Undertaking registration and de-registration;
Performing the Agreement, this DPA and/or other contracts executed by the Parties;
Acting upon Member’s instructions, where such instructions are consistent with the Agreement;
Sharing Personal Data with Sub-processors (e.g., integrations between the Services and any services provided by third parties, as configured by or on behalf of Customer to facilitate the sharing of Personal Data between the Services and such third-party services);
Rendering Personal Data fully anonymous, non-identifiable and non-personal in accordance with applicable standards recognized by Data Protection Laws and guidance issued thereunder;
Complying with applicable laws and regulations;
All tasks related with any of the above.

‍

C. Duration of Processing

Subject to any paragraph of the DPA and/or Terms of Use dealing with the duration of the Processing and the consequences of the expiration or termination thereof, Flowla as Processor will Process Personal Data pursuant to the DPA and Terms of Use for the duration of Terms of Use, unless otherwise agreed upon in writing.

‍

D. Type of Personal Data

Personal details (e.g. name, business address), contact information (e.g. mobile phone number, e-mail, employer/organization, position/job title), profile photo, device’s IP address (stored in a de-identified format), geographic location, date and time when the Flow was accessed.

‍

E. Categories of Data Subjects

During the performance of the Services, the Personal Data relating to the following categories of Data Subjects may be Processed:

Contacts
Member’s employees, consultants, agents, advisors, and guests.

‍

ANNEX – II: LIST OF SUB-PROCESSORS

Please review the Third-Party Service Providers list in our Privacy Policy for the list of Sub-processors.

‍

ANNEX – III: TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES

This Technical and Organizational Security Measures sets out the measures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services, the measures for ensuring the ability to restore the availability and access to Personal Data.

All capitalized terms not otherwise defined herein will have the meanings as set forth in the General Terms.

The following policies are maintained by Flowla in order to ensure the measures set forth above, the policies are updated on an ongoing basis and reviewed annually for gaps:

1. Access Control
1. a. Preventing Unauthorized Access, Outsourced Processing: Flowla hosts its Services with outsourced cloud infrastructure providers. Additionally, Flowla maintains contractual relationships with vendors in order to provide the Services in accordance with the DPA. Flowla relies on contractual agreements, privacy policies, and vendor compliance programs in order to protect data processed or stored by these vendors.
2. b. Physical and Environmental Security: Flowla hosts its product infrastructure with outsourced infrastructure providers. Flowla does not own or maintain hardware located at the outsourced infrastructure providers’ data centers. Production servers and client-facing applications are logically and physically secured from our internal corporate information systems. The physical and environmental security controls are audited for SOC 2 Type II and ISO 27001 compliance, among other certifications.
3. c. Limited Employee and Contractor Access: Flowla provides access to the facilities to its employees and contractors who have a legitimate business need for such access privileges to provide the Services within the scope of the Agreement. When an employee or contractor no longer has a business need for the access privileges assigned to him/her, the access privileges are promptly revoked, even if the employment of the contractual relationship continues.
4. d. Pseudonymisation and Encryption of Personal Data: Where appropriate, Flowla encrypts Personal Data in transit and at rest using encryption through its Sub-processors.
5. AWS also has a dedicated Compliance Program which include certifications and accreditations like CSA, ISO, SOC and more, as listed on their website athttps://aws.amazon.com/compliance/programs.
6. e. Data Retention: Personal Data and raw data are all deleted as soon as possible or legally applicable. Usually, the data is provided by the Member for the purpose of providing the Services by Flowla and is deleted upon termination of the contractual obligations. However, certain data, such as financial data is required to be retained for a longer period of time.
7. f. Continued Evaluation: Flowla will conduct periodic reviews of the security of its platform and adequacy of its information security program as measured against industry security standards and its policies and procedures. Flowla will continually evaluate the security of its systems to determine whether additional or different security measures are required to respond to new security risks or findings generated by the periodic reviews.
8. g. Details on Amazon Web Services (AWS): As a Sub-processor of Flowla, AWS regularly achieves third-party validation for thousands of global compliance requirements that they continually monitor to help their customers meet security and compliance standards. AWS supports security standards and compliance certifications like PCI-DSS, HIPAA/HITECH, FedRAMP, GDPR, FIPS 140-2 and NIST 800-171. For a detailed overview of all security and privacy measures, see the AWS Cloud Security page at https://aws.amazon.com/security
9. AWS also has a dedicated Compliance Program which include certifications and accreditations like CSA, ISO, SOC and more, as listed on their website at
10. https://aws.amazon.com/compliance/programs.
‍
2. Transmission Control‍
1. a. In transit: HTTPS implementation of Flowla uses industry-standard algorithms and certificates.
2. b. At rest: Flowla stores User passwords following policies that follow industry standard practices for security. Flowla has implemented technologies to ensure that stored data is encrypted at rest.
3. ‍
3. Cyber Security
‍
Flowla has developed and implemented a security control environment designed to protect the confidentiality, integrity, and availability of all Flowla User’s systems. Flowla conducts a variety of regular internal and external audits that are inclusive of security operations.
Flowla performs an annual internal review of all security management policies and procedures. External auditors perform an annual review of these policies and procedures.
Flowla maintains administrative, physical, and technical safeguards for the protection of the security, confidentiality, and integrity of Member and its data and confidential and proprietary information, including Personal Data. Flowla regularly monitors its compliance with industry security standards and will not intentionally decrease them during the term of the Agreement.
‍

4. Cross Border Transfers; SCCs, IDTA & Additional Safeguards
1. a. EEA Transfers‍
2. ‍
3. The Parties agree that the terms of the Standard Contractual Clauses are hereby incorporated by reference and shall apply to an EEA Transfer.
4. Module Two (Controller to Processor) of the Standard Contractual Clauses shall apply where the EEA Transfer is effectuated by Member as the Controller of the Personal Data and Flowla is the Processor of the Personal Data.
5. ‍
6. b. UK Transfers
7. ‍
8. The Parties agree that the IDTA shall apply to a UK Transfer. For this reason, the Parties agree to use IDTA embedded to this DPA as a transfer tool to comply with Article 46 of the UK GDPR when making restricted transfers.
9. ‍
10. c. Additional Safeguards
11. ‍
12. In the event of an EEA Transfer or a UK Transfer, the Parties agree to supplement these with the following safeguards and representations, where appropriate:
  1. 1. As the Processor, Flowla shall have in place and maintain in accordance with good industry practice measures to protect the Personal Data from interception (including in transit from the Controller to the Processor and between different systems and services). This includes having in place and maintaining network protection intended to deny attackers the ability to intercept data and encryption of Personal Data whilst in transit and at rest intended to deny attackers the ability to read data.
    2. Flowla will make commercially reasonable efforts to resist, subject to applicable laws, any request for bulk surveillance relating to the Personal Data protected under GDPR or the UK GDPR, including under section 702 of the United States Foreign Intelligence Surveillance Court (“FISA”);
    3. If Flowla becomes aware that any government authority (including law enforcement) wishes to obtain access to or a copy of some or all of the Personal Data, whether on a voluntary or a mandatory basis, then unless legally prohibited or under a mandatory legal compulsion that requires otherwise:
      1. (1) Flowla shall inform the relevant government authority that Flowla is a Processor of the Personal Data, and that the Controller has not authorized Flowla to disclose the Personal Data to the government authority, and inform the relevant government authority that any and all requests or demands for access to the Personal Data should therefore be notified to or served upon the Controller in writing;
        (2) Flowla will use commercially reasonable legal mechanisms to challenge any such demand for access to Personal Data which is under its control. Notwithstanding the above, (a) the Controller acknowledges that such challenge may not always be reasonable or possible in light of the nature, scope, context and purposes of the intended government authority access, and (b) if, taking into account the nature, scope, context and purposes of the intended government authority access to Personal Data, Flowla has a reasonable and good-faith belief that urgent access is necessary to prevent an imminent risk of serious harm to any individual or entity, this subsection (e)(II) shall not apply. In such event, Flowla shall notify the Controller, as soon as possible, following the access by the government authority, and provide the Controller with relevant details of the same, unless and to the extent legally prohibited to do so.

Once in every 12-month period, Flowla will inform the Member, at the Member’s written request, of the types of binding legal demands for Personal Data it has received and solely to the extent such demands have been received, including national security orders and directives, which shall encompass any process issued under section 702 of FISA.

‍

For more information about this DPA, you may contact us at privacy@flowla.com.