Data Processing Agreement

This Data Processing Agreement (“DPA”) governs the processing of personal data that Flowstart Kft.(the “Processor”) carries out on behalf of the Customer (the “Controller”) when providing the digitalemployees.eu service. It is offered for signature and forms part of the agreement between the parties. Where it conflicts with the Terms of Service on data protection, this DPA prevails. It is drafted to satisfy Article 28 of the GDPR.

1. Subject matter, duration, nature and purpose

Subject matter:processing of personal data contained in the Controller’s organization content to provide the digital-employee service. Duration: for as long as the Controller uses the service, plus any short wind-down period. Nature and purpose:hosting, storage, retrieval, AI inference over the content, execution of approval-gated actions the Controller configures, and related operational processing — all on the Controller’s documented instructions.

2. Categories of data subjects and personal data

• Data subjects:the Controller’s staff and authorized users, and the individuals appearing in the content the Controller processes through the service (such as the Controller’s contacts, customers, and correspondents).
• Personal data: identity and contact details, the content of messages, documents and calendar entries, and any other personal data the Controller chooses to submit. The Controller should avoid submitting special-category data unless agreed separately.

3. Processor obligations

• Instructions only.The Processor processes personal data only on the Controller’s documented instructions, including the instructions embodied in the service and its configuration, unless required otherwise by EU or Member State law (in which case it will inform the Controller unless the law prohibits it).
• Confidentiality. Persons authorized to process the data are bound by an obligation of confidentiality.
• Security (Art. 32). The Processor implements appropriate technical and organizational measures, including tenant isolation, access controls, encryption in transit, audit logging of actions and approvals, and least-privilege access to connected systems.
• Sub-processors. The Controller provides general authorization for the sub-processors listed in the Privacy Policy. The Processor imposes equivalent data-protection obligations on each sub-processor, remains liable for their performance, and will give notice of intended additions or replacements so the Controller can object on reasonable grounds.
• Assistance with data-subject requests. Taking into account the nature of the processing, the Processor assists the Controller with appropriate measures to respond to requests to exercise data-subject rights.
• Assistance with compliance.The Processor assists the Controller with security, breach notification, data-protection impact assessments, and prior consultation under Articles 32–36, taking into account the information available to it.
• Personal-data breach. The Processor notifies the Controller without undue delayafter becoming aware of a personal-data breach affecting the Controller’s data, and provides the information the Controller reasonably needs to meet its own obligations.
• Deletion or return.On termination of the services, the Processor deletes or returns the personal data at the Controller’s choice, and deletes existing copies unless storage is required by law.
• Audit rights. The Processor makes available the information necessary to demonstrate compliance with Article 28 and allows for and contributes to audits, including inspections, conducted by the Controller or a mandated auditor on reasonable notice.

4. International transfers and Standard Contractual Clauses

Processing of the Controller’s content takes place within the EU/EEA. As long as processing stays within the EU/EEA, transfer mechanisms such as the Standard Contractual Clauses are not required. If a transfer outside the EU/EEA later becomes necessary, the parties will put appropriate safeguards in place, including the Standard Contractual Clauses where applicable, before any such transfer.

5. Controller responsibilities

The Controller is responsible for the lawfulness of the instructions it gives and the data it submits, for having a valid legal basis, and for the approval decisions and enabled capabilities described in the Terms of Service.

6. Signatures

This DPA is offered for signature by both parties. To execute it for your organization, contact info@flowstart.eu.