Version: 2026-10-19 · Authoritative English version
1. Parties, Subject Matter and Duration
The organisation identified in the order is the controller ("Customer"), and Flowifier GmbH, Am Europlatz 2, 1120 Vienna, Austria, company register number FN 657274 f ("Flowifier"), is the processor. Where the Customer is itself a processor, it must ensure that it is authorised to give the relevant instructions. This DPA covers the processing of Customer personal data for the ordered service, including the trial, support, provider switching, and subsequent return and deletion. Annex 1 describes the nature, purpose and duration of processing, categories of data and data subjects. This DPA prevails over conflicting Terms and Conditions in matters of processing on the Customer's behalf; the order and Terms govern fees and service scope. Flowifier processes its own contract, billing, account-security and support-relationship data in the applicable data-protection role under its separate privacy notices.
2. Instructions and Customer Obligations
Flowifier processes personal data on the Customer's behalf only on documented instructions. The contract, settings and intended use constitute such instructions. Additional instructions may be given in text form through the published support or privacy contact. Flowifier informs the Customer in advance of processing required by law that differs from the instructions, unless legally prohibited from doing so. If Flowifier considers an instruction to infringe data-protection law, it informs the Customer without delay. The Customer determines the purposes of its workflows and ensures, in particular, appropriate legal bases, information for data subjects and any requirements for special categories of data. Flowifier remains responsible for its own duties as a processor.
3. Confidentiality and Security
Flowifier binds persons authorised to access the data to confidentiality and limits access to what is necessary. Flowifier implements and reviews appropriate measures under Article 32 GDPR; the agreed measures are described in Annex 2. Changes must not materially lower the agreed level of protection. Access to content for support or emergencies must be limited to necessary cases, authorised and documented.
4. Subprocessors
The Customer grants general authorisation for the subprocessors listed in Annex 3 to the extent the relevant service is used. Flowifier imposes on them the data-protection obligations required by Article 28 GDPR and remains responsible to the Customer for compliance with those obligations. Flowifier gives at least 30 calendar days' notice before engaging a new or replacement subprocessor. During that period, the Customer may object on legitimate data-protection grounds; the parties will consider a reasonable remedy. If no remedy is possible and Flowifier cannot provide the affected service without the subprocessor, the Customer may terminate that service before the subprocessor is engaged. Further statutory rights remain unaffected. A change to the subprocessor list alone does not require renewed acceptance of this DPA in its entirety.
An external service independently selected and connected by the Customer does not become Flowifier's subprocessor solely because it is connected. The actual roles, instructions and responsibilities for each data flow determine the position.
5. International Transfers
Flowifier arranges transfers of personal data processed on the Customer's behalf outside the European Economic Area ("EEA") only on documented instructions, including the agreed use of the services described in Annexes 3 and 4, and in compliance with Chapter V GDPR. Recipients, possible access locations, data categories and applicable transfer mechanisms are described in Annexes 3 and 4. Primary storage in the EEA is not a commitment that AI services, remote access or integrations selected by the Customer involve exclusively European processing. The optional designer Copilot sends personal data processed on the Customer's behalf to an AI provider only after tenant-wide activation by an authorised Tenant Owner and subject to the applicable contractual and data-protection conditions.
6. Assistance, Incidents and Audits
Taking into account the nature of processing and the information available to it, Flowifier assists the Customer with data-subject requests and its obligations under Articles 32 to 36 GDPR. Where legally permitted, Flowifier forwards requests concerning Customer data that it receives directly to the Customer. On becoming aware of a personal data breach affecting data processed on behalf of the Customer, Flowifier informs the affected Customer without undue delay via the designated security contact; if none is designated, Tenant Owners are notified. In critical incidents, Tenant Owners are also notified where a security contact is designated. Flowifier initially provides the information available and supplements it as more becomes available. As controller, the Customer is generally responsible for deciding whether to notify authorities and data subjects.
Flowifier provides the information required under Article 28 GDPR to demonstrate compliance and permits necessary audits, including inspections by the Customer or an auditor bound to confidentiality on its behalf. Scope and conduct are reasonably coordinated to protect other customers and secure operations; statutory audit rights remain unaffected.
7. Return, Deletion and Changes
After the contract ends, Flowifier, at the Customer's choice, enables the return of remaining personal data processed on its behalf or earlier deletion on documented instructions. Retrieval is generally available for 30 calendar days after a trial without a subscription and 60 calendar days after a paid contract. Where applicable switching rules require it, retrieval is extended to at least 30 calendar days after the transitional period ends; the later deadline applies. After the applicable retrieval period, Flowifier deletes remaining production data processed on the Customer's behalf within a further 30 calendar days, unless applicable Union or Member State law requires retention or mandatory switching rules require earlier deletion. The deletion obligation also covers backup copies; these are removed in the documented backup and deletion cycle, protected until then and not used for ordinary production purposes. Data already effectively deleted cannot be returned. Flowifier documents any legally required exceptions.
Material changes to this DPA require a valid agreement. Section 4 governs changes to subprocessors. Each version and its acceptance by a person authorised to act for the Customer are recorded. Pending acceptance alone does not automatically restrict the tenant. This English-language version is the authoritative text. Any German translation made available upon request is for information; in the event of a discrepancy, this English version prevails unless an Enterprise agreement expressly specifies another contract language.
Annex 1 – Description of Processing
Item
Description
Duration
Trial, active contract term, any switching period, contractual retrieval and deletion periods, and the technically necessary expiry of backup copies.
Nature and purpose
Receiving, storing, structuring, displaying, changing, automatically processing, transferring on instructions, backing up, exporting and deleting data to provide workflows, forms, tasks, decisions, files, integrations, the optional designer Copilot, support and security.
Data subjects
The Customer's internal and external users; employees, customers, suppliers and partners; persons submitting public forms; and others included by the Customer in its processes.
Categories of data
Account and contact details, roles, workflow and form content, submissions, responses, decisions, process and audit data, files, and usage and technical metadata; depending on the Customer's configuration, potentially special categories under Article 9 GDPR.
Further details
The Customer determines business purposes, fields, recipients and any permitted special categories in its configurations. Following tenant-wide activation, the optional Copilot receives inputs and the current draft context from the workflow or form designer; runtime submissions, instances, tasks and files are not part of its intended context.
Annex 2 – Technical and Organisational Measures
Flowifier maintains a level of security appropriate to the risks of the relevant processing. Measures include in particular:
Access and permissions: individual accounts, role-based permissions, restricted administrative rights and traceability of administrative access.
Tenant separation: logical separation of Customer data and server-side checks of tenant assignment and permissions.
Transfer and storage: protection of data in transit and at rest through appropriate encryption and access restrictions; separate protection of credentials and secrets.
Logging: recording of security-relevant events and limiting and protecting sensitive content in logs.
Availability: appropriate backups and recovery procedures in line with the operating scope actually agreed.
Incidents: procedures to detect, handle and document security incidents and to notify under Section 6.
Development and operations: appropriate review, testing, release and change processes for the platform.
Service providers: careful selection, contractual commitment and appropriate review of the subprocessors used.
Data lifecycle: restriction of data access, support for export and traceable deletion under Section 7.
Access to content for support occurs only for a specific purpose, to the necessary extent and with traceable authorisation. Emergency access for security reasons is limited to what is necessary and documented. Flowifier regularly reviews the suitability of the measures and adapts them as risks change without materially lowering the agreed level of protection.
Annex 3 – Subprocessors
The general authorisation below covers the named providers for the services actually used. Optional features involve the related processing only when used. Annex 4 describes possible international access in further detail.
Subprocessor
Service and data concerned
Processing locations and possible access
Microsoft Ireland Operations Limited
Azure infrastructure, hosting, storage and messaging; tenant content, files, technical metadata and backups.
Intended primary Azure region West Europe; possible access by group companies and service providers outside the EEA.
MongoDB Limited, Building Two, Number One Ballsbridge, Dublin 4, Ireland
MongoDB Atlas; tenant database content, accounts, process data and technical metadata.
Intended primary region Azure West Europe; possible international administration and support access.
IPLocate Pty Ltd, 81–83 Campbell Street, Surry Hills NSW 2010, Australia
Optional approximate geolocation of public login IP addresses; public IP address and technical request data.
Global service with processing in Australia and potentially other third countries.
Twilio Ireland Limited, 70 Sir John Rogerson's Quay, Dublin 2, D02 R296, Ireland
SendGrid delivery of system and notification emails; names, addresses, subject lines, message content, action links and delivery metadata.
Global processing, including possible access from the United States.
OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland
Optional tenant-wide enabled designer Copilot; prompts, current draft context, conversations, responses and technical metadata.
Possible processing and access outside the EEA, in particular in the United States.
Zendesk, Inc.
Support portal and support communications; contact and company details and content, attachments and diagnostic data voluntarily provided by the Customer.
Global processing, including possible access from the United States.
Payment data processed by Stripe for Flowifier's own billing purposes does not belong to this processing on the Customer's behalf solely for that reason. The roles of integrations selected by the Customer are assessed according to the actual processing.
Annex 4 – International Transfers
Before transferring data outside the EEA, Flowifier ensures an applicable mechanism under Chapter V GDPR. This may be an adequacy decision, including the EU-US Data Privacy Framework where it covers the specific recipient, or the relevant Standard Contractual Clauses ("SCCs") with supplementary safeguards where required. A certification or contractual clause is relied on only for recipients and services it actually covers.
Service and possible recipients outside the EEA
Data and purpose
Transfer mechanism and safeguards
Retention
Azure: Microsoft Corporation, group companies or subprocessors, in particular in the United States, where remote access or service operation requires it.
Tenant data, files, metadata and backups for hosting, storage, messaging and support.
Adequacy for recipients actually covered; otherwise relevant SCCs in Microsoft's data-protection agreement; encryption, role-based access and restricted support access.
Under contractual instructions, Annex 1 and the applicable service deletion rules.
MongoDB Atlas: MongoDB group companies or subprocessors for international support and operations.
Tenant database content and technical metadata for database operations and support.
Adequacy for recipients actually covered; otherwise relevant SCCs in MongoDB's data-protection agreement; encryption and restricted access.
Under contractual instructions and applicable backup and deletion rules.
IPLocate: IPLocate Pty Ltd in Australia and potential subprocessors in other countries, including the United States.
Public login IP address and technical request data for optional approximate geolocation.
Relevant SCCs and, where required, supplementary safeguards for the actual chain of roles and transfers.
Under the applicable service contract and deletion rules.
Twilio SendGrid: Twilio Inc., group companies or subprocessors, in particular in the United States.
Email addresses, names, message content, links, and delivery and technical metadata for notifications.
Adequacy for recipients actually covered; otherwise relevant SCCs in Twilio's data-protection agreement; restricted access and purpose-limited delivery. Twilio's binding corporate rules are not relied on as the transfer mechanism for SendGrid.
Under contractual instructions and applicable delivery and deletion rules.
OpenAI: OpenAI group companies or subprocessors, in particular in the United States, when Copilot is enabled.
Prompts, current workflow and form context, conversation content, responses and technical metadata for AI suggestions.
Adequacy for recipients actually covered; otherwise relevant SCCs in OpenAI's data-protection agreement; tenant-wide activation, restricted access and deletion controls.
Copilot conversations generally for up to 30 calendar days after the last accepted request or until earlier deletion is initiated; other data under the applicable contractual rules.
Zendesk: Zendesk, Inc., group companies or subprocessors, in particular in the United States.
Support contacts, messages, voluntary attachments and diagnostic data for customer support.
Adequacy for recipients actually covered; applicable Zendesk binding corporate rules for covered intra-group transfers or SCCs for other transfers; restricted access.
Under the applicable support and deletion rules.
External services independently connected by the Customer and their own processing do not become Flowifier subprocessors solely by virtue of this Annex. Flowifier remains responsible for the lawfulness of its own transfers and connections.