Your data, our responsibility.

1. Parties & Scope

This Data Processing Agreement ("DPA") forms part of the FlowManner Terms of Service and applies to all customers who use FlowManner to process personal data on behalf of data subjects.

2. Definitions

• Controller — the entity that determines the purposes and means of processing personal data (You)
• Processor — the entity that processes personal data on behalf of the Controller (FlowManner)
• Personal Data — any information relating to an identified or identifiable natural person
• Subprocessor — a third party engaged by the Processor to assist in processing data

3. Roles of the Parties

The Customer is the Controller. FlowManner is the Processor. We process personal data only on the Customer's documented instructions and in accordance with applicable data protection laws.

4. Processor Obligations

FlowManner agrees to:

• Process personal data only on the Customer's documented instructions
• Ensure personnel authorized to process data are under confidentiality obligations
• Implement appropriate technical and organizational security measures
• Assist the Customer in responding to data subject requests
• Notify the Customer without undue delay of any data breach
• Delete or return all personal data after the end of the services

5. Subprocessors

FlowManner uses the following categories of subprocessors:

• Cloud infrastructure: AWS / GCP (hosting, compute, storage)
• Payment processing: Stripe (billing)
• Email delivery: Transactional email services
• Error monitoring: Sentry (crash/error tracking)

6. International Data Transfers

For transfers outside the EU/EEA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission. Transfer impact assessments are conducted for all cross-border data flows.

7. Assistance with Data Subject Rights

FlowManner will assist the Customer in fulfilling data subject requests (access, rectification, erasure, portability) by providing tools within the platform and responding to support requests within 72 hours.

8. Data Breach Notification

In the event of a personal data breach, FlowManner will:

• Notify the Customer without undue delay (and within 24 hours of discovery)
• Provide a description of the breach, likely consequences, and measures taken
• Cooperate with the Customer in notifying the relevant supervisory authority

9. Audit Rights

The Customer has the right, at its own expense, to audit FlowManner's compliance with this DPA once per year, with 30 days' written notice. Audit results are confidential.

10. Term & Termination

This DPA remains in effect for the duration of the Service agreement. Upon termination, FlowManner will delete or return all personal data within 30 days, subject to legal retention requirements.