Data Processing Agreement

Controller determines the purposes and means of processing personal data submitted to Flotr. Processor processes that data only on documented instructions from Controller, including as set out in these Terms, this DPA, and Controller's use of the service.

Processing relates to personal data contained in Customer Content and account data necessary to provide the service. Processing continues for the term of the subscription and as needed thereafter for deletion, backup expiry, or legal obligations.

Processor processes personal data to:

• Provide hosting, storage, and operation of the Flotr platform.
• Enable collaboration, workflow, approvals, and audit features requested by Controller.
• Authenticate users and enforce workspace access controls.
• Provide support, security monitoring, and service reliability.
• Comply with applicable legal obligations.

Data subjects may include Controller's employees, contractors, customers, and other individuals whose personal data Controller chooses to process in Flotr. Data may include identifiers, professional contact details, operational records, files, comments, and metadata associated with workspace activity.

Processor will:

• Process personal data only on documented instructions from Controller, unless required by law.
• Ensure persons authorized to process data are bound by confidentiality obligations.
• Implement appropriate technical and organizational security measures.
• Assist Controller, considering the nature of processing, with data subject requests and GDPR Articles 32 to 36 obligations where applicable.
• Delete or return personal data upon termination of services, subject to backup retention limits and legal requirements.
• Make available information reasonably necessary to demonstrate compliance and allow audits upon reasonable notice, subject to confidentiality and security constraints.

Controller authorizes Processor to engage subprocessors to support the service. Processor remains responsible for subprocessors' performance of data protection obligations. Processor will maintain a list of subprocessors and provide notice of material changes where required by contract.

Current subprocessors typically include infrastructure, database, authentication, email, and payment providers necessary to operate Flotr. For the current list or to object to a new subprocessor on reasonable grounds, contact hello@flotr.app.

Where personal data is transferred outside the EEA, Processor will ensure appropriate safeguards such as Standard Contractual Clauses or another valid transfer mechanism under GDPR.

Processor maintains measures including access controls, encryption in transit, logical separation of customer workspaces, logging of meaningful operational changes, and restricted access to production systems on a need-to-know basis. Details of security practices are available on request and in our security documentation.

Processor will notify Controller without undue delay after becoming aware of a personal data breach affecting Controller's data and will provide information reasonably available to assist Controller in meeting its breach notification obligations.

Controller is responsible for the lawfulness of processing, providing required notices and obtaining necessary consents, configuring roles and permissions appropriately, and ensuring that instructions to Processor comply with applicable data protection law.

For most customers, this DPA is incorporated by reference into the Terms of Service when you use Flotr to process personal data. Enterprise customers requiring a signed copy may request one at hello@flotr.app.

If there is a conflict between this DPA and other commercial terms regarding the processing of personal data, this DPA prevails to the extent of the conflict.