Data processing

1. Definitions

The following definitions apply throughout this DPA:

"Applicable Data Protection Law" means all laws and regulations applicable to the processing of Personal Data under this DPA, including without limitation the GDPR, UK GDPR, CCPA, and any national or state implementing legislation, as amended or replaced from time to time.

"Controller" means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data. In the context of this DPA, the Customer is the Controller.

"Customer Data" means all Personal Data submitted to, stored in, transmitted through, or otherwise processed by the Services on behalf of the Customer, including data contained in workflow configurations, run logs, integration payloads and any other data that passes through the Customer's Agents.

"Data Subject" means the identified or identifiable natural person to whom Personal Data relates.

"Personal Data" has the meaning given to it in Applicable Data Protection Law — broadly, any information relating to an identified or identifiable natural person.

"Processing" means any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, alignment, restriction, erasure or destruction.

"Processor" means a natural or legal person, public authority, agency or other body that processes Personal Data on behalf of the Controller. In the context of this DPA, Flowpath is the Processor.

"Security Incident" means any accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise processed by Flowpath.

"Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of Personal Data to third countries approved by the European Commission under Decision 2021/914/EU, as may be amended or replaced from time to time.

"Sub-processor" means any third party engaged by Flowpath to process Personal Data on behalf of the Customer in connection with the provision of the Services.

2. Scope and nature of processing

2.1 Subject matter

Flowpath processes Personal Data on behalf of the Customer solely for the purpose of providing the Services described in the Terms of Service, including operating and maintaining the automation platform, executing Customer Agents, providing technical support, and ensuring the security and performance of the Services.

2.2 Duration

Flowpath will process Personal Data for the duration of the Customer's subscription to the Services and for any additional period necessary to fulfil the purposes described in this DPA or as required by Applicable Data Protection Law.

2.3 Nature of processing

The processing activities carried out by Flowpath on behalf of the Customer include: receiving and storing Customer Data submitted through the Services; executing automated workflows and Agents that process Customer Data; transmitting Customer Data to third-party integrations as directed by the Customer's workflow configurations; generating and storing run logs that record processing activities; and providing the Customer with access to Customer Data through the Services interface.

2.4 Types of Personal Data

The types of Personal Data processed through the Services depend entirely on the Customer's workflow configurations and use cases. Typical categories include: contact information (names, email addresses, phone numbers); professional information (job titles, company names, LinkedIn profiles); transaction data (invoice details, payment references); support data (helpdesk tickets, customer communications); and behavioural data (website events, form submissions).

2.5 Categories of Data Subjects

The categories of Data Subjects whose Personal Data may be processed through the Services depend on the Customer's use case and typically include: the Customer's end customers and prospects; the Customer's employees and contractors; and any other individuals whose data the Customer chooses to process through the platform.

3. Customer obligations

3.1 Lawful basis

The Customer is solely responsible for ensuring that it has a lawful basis under Applicable Data Protection Law for processing Personal Data through the Services. This includes ensuring that appropriate consents, legitimate interests assessments, contractual necessity determinations, or other lawful bases are in place before submitting Personal Data to the Services.

3.2 Data subject rights

The Customer is responsible for receiving, managing and responding to Data Subject rights requests (including rights of access, rectification, erasure, restriction, portability and objection) in accordance with Applicable Data Protection Law. Flowpath will provide reasonable assistance to the Customer in fulfilling such requests as described in Section 6 of this DPA.

3.3 Privacy notices

The Customer is responsible for providing appropriate privacy notices to Data Subjects that accurately describe how their Personal Data will be processed, including any processing carried out through Flowpath's Services.

3.4 Accuracy of instructions

The Customer warrants that its instructions to Flowpath regarding the processing of Personal Data are lawful and do not require Flowpath to act in a manner that would violate Applicable Data Protection Law. If the Customer provides instructions that, in Flowpath's reasonable opinion, would require Flowpath to violate Applicable Data Protection Law, Flowpath will notify the Customer and may decline to follow those instructions.

4. Flowpath's obligations as Processor

4.1 Processing on instructions only

Flowpath will process Personal Data only on the documented instructions of the Customer, as set out in this DPA and the Terms of Service, unless required to do so by Applicable Data Protection Law, in which case Flowpath will inform the Customer of that legal requirement before processing, unless the law prohibits such notification.

4.2 Confidentiality

Flowpath will ensure that all personnel authorised to process Personal Data are subject to appropriate confidentiality obligations, whether by contract or statutory duty, with respect to that Personal Data.

4.3 Security measures

Flowpath will implement and maintain appropriate technical and organisational security measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, as described in Section 7 of this DPA.

4.4 Sub-processors

Flowpath will not engage Sub-processors to process Personal Data without the prior written authorisation of the Customer, except as provided in Section 5 of this DPA.

4.5 Assistance with obligations

Flowpath will provide reasonable assistance to the Customer in complying with its obligations under Applicable Data Protection Law, including in relation to data subject rights, data protection impact assessments, and prior consultation with supervisory authorities, as described in Section 6 of this DPA.

4.6 Deletion and return of data

Upon termination or expiry of the Terms of Service, or upon the Customer's written request, Flowpath will delete or return all Customer Data in accordance with Section 10 of this DPA, unless Applicable Data Protection Law requires continued storage.

4.7 Audit rights

Flowpath will make available to the Customer all information reasonably necessary to demonstrate compliance with the obligations set out in this DPA, and will allow for and contribute to audits and inspections conducted by the Customer or a mandated auditor, subject to the conditions described in Section 9 of this DPA.

5. Sub-processors

5.1 General authorisation

The Customer provides general written authorisation for Flowpath to engage Sub-processors to process Personal Data in connection with the provision of the Services, subject to the conditions set out in this section.

5.2 Current sub-processors

Flowpath maintains an up-to-date list of its current Sub-processors, including their names, locations and the nature of their processing activities, available at flowpath.ai/legal/sub-processors. The Customer acknowledges and agrees to the engagement of the Sub-processors listed on that page as of the effective date of this DPA.

Our current Sub-processors include, among others, the following categories of providers: cloud infrastructure providers (for hosting and data storage); authentication and identity providers; payment processors; analytics and monitoring providers; customer support platforms; email delivery services; and security and fraud prevention providers.

5.3 New sub-processors

Flowpath will provide the Customer with at least 30 days' prior written notice before engaging any new Sub-processor or making material changes to existing Sub-processor arrangements that affect the processing of Customer Data. Notice will be provided by email to the address associated with the Customer's account, or by updating the Sub-processor list at flowpath.ai/legal/sub-processors and notifying the Customer via the Services.

5.4 Objections

If the Customer has reasonable grounds to object to the engagement of a new Sub-processor, the Customer must notify Flowpath in writing within 14 days of receiving notice. Flowpath will use reasonable efforts to address the Customer's concerns. If the parties cannot reach a resolution within 30 days of the Customer's objection, the Customer may terminate the affected Services by providing written notice, and Flowpath will refund any prepaid fees for the period following termination on a prorated basis.

5.5 Sub-processor obligations

Flowpath will impose data protection obligations on all Sub-processors that are at least as protective as those set out in this DPA, by way of written contract. Flowpath remains liable to the Customer for the performance of Sub-processors' obligations to the extent that Flowpath is liable under this DPA.

6. Assistance with data subject rights and regulatory obligations

6.1 Data subject rights requests

Flowpath will promptly notify the Customer if it receives a request from a Data Subject exercising their rights under Applicable Data Protection Law in relation to Customer Data. Flowpath will not respond to such requests directly unless instructed to do so by the Customer or required by law.

Flowpath will assist the Customer in responding to Data Subject rights requests by providing access to tools within the Services that allow the Customer to locate, export, correct or delete Customer Data, and by providing additional technical assistance upon the Customer's written request where such tools are insufficient.

6.2 Data protection impact assessments

Where required by Applicable Data Protection Law, Flowpath will provide reasonable assistance to the Customer in carrying out data protection impact assessments (DPIAs) relating to the processing of Personal Data through the Services. This may include providing information about the technical and organisational measures implemented by Flowpath, the nature of the processing carried out, and any risks identified by Flowpath in connection with the Services.

6.3 Prior consultation

Flowpath will assist the Customer in carrying out prior consultations with supervisory authorities where required by Applicable Data Protection Law, including by providing relevant information about Flowpath's processing activities upon the Customer's written request.

6.4 Security incidents

Flowpath will notify the Customer without undue delay, and in any event within 72 hours of becoming aware, of any Security Incident affecting Customer Data. The notification will include, to the extent known at the time: the nature of the Security Incident; the categories and approximate number of Data Subjects affected; the categories and approximate volume of Personal Data records affected; the likely consequences of the Security Incident; and the measures taken or proposed to address the Security Incident.

Where complete information is not available within 72 hours, Flowpath will provide an initial notification and supplement it with further details as they become available. The Customer is solely responsible for determining whether to notify Data Subjects or supervisory authorities of the Security Incident, and for making any such notifications in accordance with Applicable Data Protection Law.

7. Security measures

7.1 Technical and organisational measures

Flowpath implements and maintains the following technical and organisational measures to protect Customer Data:

Encryption: All Customer Data is encrypted in transit using TLS 1.3 and at rest using AES-256 encryption.

Access controls: Access to Customer Data is restricted to authorised Flowpath personnel who require access to perform their job functions. Access is granted on a least-privilege basis and is subject to regular review. All access is authenticated using multi-factor authentication.

Credential management: OAuth credentials and API keys provided by the Customer for third-party integrations are stored in an isolated secrets vault and are never stored in plaintext or included in run logs, error messages or other output.

Network security: Flowpath's infrastructure is hosted on ISO 27001-certified cloud providers and is protected by enterprise-grade firewalls, intrusion detection systems, and network segmentation.

Vulnerability management: Flowpath conducts regular penetration testing and vulnerability assessments. Critical vulnerabilities are remediated within 24 hours of discovery, and high-severity vulnerabilities within 7 days.

Incident response: Flowpath maintains a documented incident response plan that is tested at least annually. The plan includes procedures for identification, containment, eradication, recovery and post-incident review.

Business continuity: Flowpath maintains automated backups of Customer Data with a recovery point objective (RPO) of 1 hour and a recovery time objective (RTO) of 4 hours.

Personnel training: All Flowpath personnel with access to Customer Data receive data protection and security training upon onboarding and at least annually thereafter.

7.2 Updates to security measures

Flowpath may update its security measures from time to time, provided that such updates do not materially reduce the overall level of protection afforded to Customer Data. Flowpath will notify the Customer of any material reductions in security measures with at least 30 days' prior notice.

7.3 Customer security responsibilities

The Customer is responsible for implementing appropriate security measures on its own systems and for ensuring that authorised users of the Services use strong, unique passwords, enable multi-factor authentication, and follow good security practices. Flowpath is not responsible for Security Incidents caused by the Customer's failure to maintain adequate security on its own systems.

8. International data transfers

8.1 Transfers within permitted jurisdictions

Flowpath stores and processes Customer Data in the data centre region selected by the Customer at signup (US East, US West, or EU West). Flowpath will not transfer Customer Data outside the selected region except as necessary to provide the Services, including for the purpose of engaging Sub-processors.

8.2 Transfers to third countries

Where Customer Data is transferred to a country outside the European Economic Area (EEA) or United Kingdom that does not benefit from an adequacy decision, Flowpath will ensure that appropriate safeguards are in place for that transfer in accordance with Applicable Data Protection Law.

For transfers from the EEA to countries without an adequacy decision, Flowpath relies on the Standard Contractual Clauses (Module 2: Controller to Processor) as approved by the European Commission under Decision 2021/914/EU, which are incorporated into this DPA by reference.

For transfers from the United Kingdom, Flowpath relies on the International Data Transfer Agreement (IDTA) issued by the UK Information Commissioner's Office, or the EU SCCs with the UK Addendum, as applicable.

8.3 Transfer impact assessments

Where required by Applicable Data Protection Law, Flowpath will cooperate with the Customer in conducting transfer impact assessments for international transfers of Personal Data, including by providing information about the legal framework of the recipient country and the safeguards in place.

9. Audit rights and compliance

9.1 Documentation

Flowpath will maintain accurate records of all processing activities carried out on behalf of the Customer and will make those records available to the Customer upon written request.

9.2 Compliance reports

Upon the Customer's written request, Flowpath will provide copies of its most recent third-party compliance certifications and audit reports, including its SOC 2 Type II report and any relevant ISO certifications, subject to appropriate confidentiality obligations. Flowpath will provide these documents under NDA.

9.3 Audit requests

The Customer may, upon providing at least 30 days' prior written notice, conduct or commission an audit of Flowpath's data processing activities relating to Customer Data. Audits must be conducted during normal business hours, must not unreasonably disrupt Flowpath's operations, and must be limited in scope to matters directly relevant to Flowpath's obligations under this DPA. The Customer is responsible for all costs associated with any such audit.

9.4 Limitations on audit rights

Flowpath may decline to provide access to information that would: (a) reveal trade secrets or confidential information of other customers; (b) violate Flowpath's obligations of confidentiality to third parties; or (c) compromise the security of Flowpath's systems. Where Flowpath restricts access on these grounds, it will provide the Customer with a written explanation of the restriction and, where possible, an alternative means of obtaining equivalent assurance.

10. Deletion and return of data

10.1 Deletion upon termination

Upon termination or expiry of the Terms of Service for any reason, Flowpath will, at the Customer's election, either delete or return all Customer Data within 90 days of the termination date.

The Customer may elect to export their data through the Services interface during this 90-day window. After 90 days, Flowpath will securely delete all Customer Data in accordance with industry-standard data destruction practices, unless Applicable Data Protection Law requires continued storage.

10.2 Deletion during the term

The Customer may request deletion of specific Customer Data at any time during the term of the Terms of Service, including in response to Data Subject erasure requests. Flowpath will action such requests within 30 days of receipt, subject to any technical constraints or legal retention obligations that may apply.

10.3 Retention for legal purposes

Notwithstanding the above, Flowpath may retain Customer Data beyond the periods described in this section to the extent required by Applicable Data Protection Law or for the establishment, exercise or defence of legal claims. Where Flowpath retains data for these purposes, it will notify the Customer and will continue to protect that data in accordance with this DPA.

10.4 Deletion certification

Upon completion of the deletion process, Flowpath will provide the Customer with written certification confirming that Customer Data has been deleted, upon the Customer's written request.

11. CCPA provisions

11.1 Applicability

The provisions of this section apply to the extent that Flowpath processes Personal Information of California residents on behalf of the Customer, and where the Customer is subject to the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

11.2 Service provider status

For the purposes of the CCPA, Flowpath acts as a "Service Provider" (as defined in the CCPA) with respect to Customer Data. Flowpath processes Personal Information solely for the purpose of performing Services specified in the Terms of Service and this DPA, and not for any commercial purpose outside of that relationship.

11.3 Restrictions on use

Flowpath will not: (a) sell or share Personal Information of California residents as those terms are defined under the CCPA; (b) retain, use or disclose Personal Information for any purpose other than providing the Services; (c) retain, use or disclose Personal Information outside of the direct business relationship between Flowpath and the Customer; or (d) combine Personal Information received from the Customer with Personal Information received from other sources, except as permitted by the CCPA.

11.4 Consumer rights assistance

Flowpath will cooperate with the Customer in responding to verifiable consumer requests submitted by California residents exercising their rights under the CCPA, including rights to know, delete, correct and opt out of sale or sharing. Flowpath will action such requests within the timeframes required by the CCPA.

12. Liability

12.1 Allocation of liability

Each party's liability under this DPA is subject to the limitations and exclusions set out in the Terms of Service. Nothing in this DPA is intended to limit either party's liability for breaches of Applicable Data Protection Law that cannot be limited by contract.

12.2 Indemnification

Each party will indemnify and hold harmless the other party from and against any claims, damages, losses, fines, penalties and costs (including reasonable legal fees) arising from that party's breach of this DPA or Applicable Data Protection Law, to the extent caused by that party's acts or omissions.

12.3 Regulatory fines

Where a supervisory authority imposes a fine or penalty on either party arising from a failure to comply with Applicable Data Protection Law, and that failure was caused solely by the other party's breach of this DPA, the breaching party will indemnify the non-breaching party for the full amount of the fine or penalty, subject to the liability cap in the Terms of Service.

13. General provisions

13.1 Order of precedence

In the event of any conflict between this DPA and the Terms of Service with respect to the processing of Personal Data, the provisions of this DPA will prevail. In the event of any conflict between this DPA and the Standard Contractual Clauses with respect to international transfers of Personal Data, the Standard Contractual Clauses will prevail.

13.2 Governing law

This DPA is governed by the same governing law as the Terms of Service, except where Applicable Data Protection Law requires a different governing law for specific provisions, including the Standard Contractual Clauses.

13.3 Severability

If any provision of this DPA is found to be invalid or unenforceable, the remaining provisions will continue in full force and effect. The invalid or unenforceable provision will be modified to the minimum extent necessary to make it valid and enforceable.

13.4 Entire agreement

This DPA, together with the Terms of Service, Privacy Policy, and any applicable Order Forms, constitutes the entire agreement between the parties with respect to the processing of Personal Data and supersedes all prior agreements, representations and understandings relating to the same subject matter.

13.5 Amendments

Flowpath may amend this DPA from time to time to reflect changes in Applicable Data Protection Law, the Services, or our processing activities. We will provide at least 30 days' written notice of material amendments. Continued use of the Services after the effective date of any amendment constitutes acceptance of the updated DPA.

14. Contact us

If you have questions about this Data Processing Agreement, wish to exercise your rights under Applicable Data Protection Law, or wish to enter into a signed version of this DPA for enterprise compliance purposes, please contact us at:

Flowpath, Inc. Data Protection Officer: dpo@flowpath.ai Legal inquiries: legal@flowpath.ai Address: 548 Market Street, Suite 100, San Francisco, CA 94104, United States

For data protection enquiries from users in the European Union or United Kingdom, you may contact our appointed EU/UK data protection representative at: dpo@flowpath.ai