Data processing agreement

This agreement forms part of the terms of service between the customer (the controller) and Imhauser Technologies LLC (the processor). It applies to the personal data of the customer's stakeholders that FlowPilot processes on the customer's behalf.

1. Subject, duration, nature and purpose

The processor stores the stakeholders the customer enters, shows them their activities on read-only pages and calendar feeds, and sends them notification emails, for as long as the customer's account exists.

2. Data and data subjects

Data subjects: the people the customer adds as stakeholders. Data: first name, surname, email address, roles, unsubscribe status, last page view, and the log of notifications sent. No special categories of data are needed or expected.

3. The processor's obligations

• Process the data only on the customer's documented instructions, which are the use of the service as configured by the customer.
• Ensure that everyone with access is bound by confidentiality.
• Apply the security measures described in the privacy policy (section 8), and keep them up to date.
• Help the customer answer data subjects' requests and meet its obligations under GDPR articles 32 to 36.
• Notify the customer without undue delay after becoming aware of a personal data breach affecting its data.
• Make available the information needed to demonstrate compliance, and allow reasonable audits with reasonable prior notice.

4. Subprocessors

The customer authorizes the following subprocessors. The processor will announce any addition or replacement at least 30 days in advance, and the customer may object by deleting its account.

• Microsoft Corporation (Microsoft Azure): Hosting of the application, the database, the email queue and the application logs (United States).
• Microsoft Corporation (Microsoft 365 Exchange Online): Sending the notification and account emails (United States).

5. Location

The data is processed in the United States. Where the customer is in the European Economic Area, the United Kingdom or Switzerland, the parties agree that the European Commission's Standard Contractual Clauses (module 2, controller to processor), with the UK Addendum and the Swiss adaptations where relevant, apply to the transfer and are incorporated by reference. The processor will not move the data to another country without prior notice.

6. End of processing

When the customer deletes a stakeholder or its account, the personal data is anonymized immediately. Backups expire as stated in the privacy policy. The processor keeps no copy beyond that.