Data Processing Agreement

Last updated: June 2025

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Flowqen ("Processor", "we", "us") and you ("Controller", "Customer") and governs the processing of personal data by Flowqen on your behalf.

1. Definitions

• Personal Data means any information relating to an identified or identifiable natural person submitted through forms created on the Flowqen platform.
• Processing means any operation performed on Personal Data, including collection, storage, retrieval, transmission, and deletion.
• Sub-processormeans a third party engaged by Flowqen to process Personal Data on the Controller's behalf.

2. Scope of Processing

Flowqen processes Personal Data solely to provide the form submission service. This includes receiving form submissions, storing them in your dashboard, forwarding them to integrations you configure (e.g., Slack, email, webhooks), and delivering notifications.

3. Controller Obligations

• You are responsible for ensuring a lawful basis for collecting Personal Data through your forms.
• You must provide appropriate privacy notices to form respondents.
• You must not use Flowqen to collect sensitive data categories (health, biometric, genetic) without appropriate safeguards.

4. Processor Obligations

• We process Personal Data only on your documented instructions.
• We implement appropriate technical and organizational security measures (see our Security page).
• We ensure all personnel with access to Personal Data are bound by confidentiality obligations.
• We assist you in responding to data subject access requests.
• We delete all Personal Data upon termination of your account, unless retention is required by law.

5. Sub-processors

We use the following sub-processors:

We will notify you before engaging any new sub-processor. You may object to a new sub-processor within 30 days of notification.

6. Data Transfers

Where Personal Data is transferred outside the European Economic Area, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission.

7. Data Breach Notification

In the event of a Personal Data breach, we will notify you without undue delay and no later than 72 hours after becoming aware of the breach, providing details of the nature, scope, and recommended mitigation measures.

8. Data Subject Rights

We will assist you in fulfilling data subject requests (access, rectification, erasure, portability, restriction, objection). You can delete individual submissions or entire forms from your dashboard at any time.

9. Term and Termination

This DPA remains in effect for the duration of your use of Flowqen. Upon account deletion, we will delete all Personal Data within 30 days unless legally required to retain it.

10. Contact

For DPA-related inquiries, contact us at privacy@flowqen.com.