Data Processing Addendum

This Data Processing Addendum, including its annexes (the "Addendum"), forms part of the General Terms between the Client and Flownally spółka z ograniczoną odpowiedzialnością, ul. Kard. Stefana Wyszyńskiego 138/6, 50-307 Wrocław, Poland, KRS 0001222080, NIP 8982329940 ("Flownally"). It sets out the terms on which Flownally processes personal data on the Client's behalf, as required by Article 28(3) GDPR.

1. The Addendum is incorporated into the General Terms by reference and takes effect at the same time as the Contract. By registering an Account or using the Services, the Client accepts it.
2. The person accepting confirms they are authorised to bind the Client. Anyone who is not authorised, or does not accept this Addendum, should not submit personal data to the Services.
3. For the processing described here, the Client acts as controller (the "Controller") and Flownally as processor. Where the Client itself acts as a processor for another controller, Flownally acts as its sub-processor and the Client confirms it has that controller's authorisation.
4. Sections marked "In short" are plain-language summaries for convenience. They do not form part of the Addendum and do not change its meaning.

In short: When you sign up for Flownally, this Addendum applies automatically. You decide what happens with your customers' data; we process it for you, only to run the Services.

1. Terms such as "personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meanings given in Article 4 of the GDPR, or the equivalent terms in other Data Protection Laws.
2. GDPR means Regulation (EU) 2016/679.
3. UK GDPR means the GDPR as it forms part of the law of the United Kingdom under the European Union (Withdrawal) Act 2018, read with the Data Protection Act 2018, as amended.
4. Swiss FADP means the Swiss Federal Act on Data Protection of 25 September 2020 and its ordinances, as amended.
5. Data Protection Laws means the GDPR, the UK GDPR, the Swiss FADP, and laws implementing or supplementing them, to the extent each applies to the processing under this Addendum.
6. Client Personal Data means personal data of End Customers, and any other personal data the Client enters into or transmits through the Services, that Flownally processes on the Client's behalf.
7. End Customer means an individual who communicates with the Client through the Services.
8. Sub-processor means any third party engaged by Flownally to process Client Personal Data.
9. SCCs means the standard contractual clauses adopted by the European Commission in Implementing Decision (EU) 2021/914.
10. UK Addendum means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, as updated from time to time.
11. References to articles of the GDPR include the corresponding provisions of the UK GDPR and the Swiss FADP where those laws apply. References to a supervisory authority include the UK Information Commissioner's Office (ICO) and the Swiss Federal Data Protection and Information Commissioner (FDPIC).
12. Capitalised terms not defined here have the meanings given in the General Terms.

In short: "Client Personal Data" means your customers' data that flows through Flownally, mainly WhatsApp and other messages. Everything here applies equally under EU, UK and Swiss data protection law.

1. Flownally processes Client Personal Data only to provide the Services under the Contract: receiving, storing, displaying and sending messages between the Controller and End Customers, integrating with messaging channels, and, where the Controller enables them, AI features such as conversation summaries and chatbot intent detection.
2. The categories of data subjects, categories of personal data, and processing operations are described in Annex I.
3. Processing lasts for the term of the Contract and until Client Personal Data is returned or deleted under Section 10.
4. The Controller is responsible for the lawfulness of the processing, including having a valid legal basis and giving End Customers the information required by Articles 13 and 14 GDPR. The Controller shall not submit special categories of personal data (Article 9 GDPR) or data of children unless agreed in writing.

In short: We process your customers' data only to run the messaging service for you. You make sure you're allowed to put it into Flownally, and you don't send us sensitive data like health information.

1. Flownally processes Client Personal Data only on the Controller's documented instructions, including regarding transfers to third countries, unless required to do so by EU or Member State law. In that case Flownally will inform the Controller before processing, unless that law prohibits it.
2. The Contract, this Addendum, and the Controller's configuration and use of the Services (for example enabling an integration or an AI feature, or deleting a conversation) are the Controller's complete documented instructions. Additional instructions must be given in writing and be consistent with the Services.
3. Flownally will promptly inform the Controller if, in its opinion, an instruction infringes the GDPR or other data protection law.
4. Flownally does not use Client Personal Data for its own purposes, including marketing, profiling, or training AI models, and does not sell it.
5. Flownally ensures that every person authorised to process Client Personal Data is bound by confidentiality obligations and has a written authorisation to process personal data.

In short: We follow your instructions, which are mostly the settings you choose in the app. We never use your customers' data for our own marketing or to train AI models, and our team is bound by confidentiality.

1. Flownally implements and maintains the technical and organisational measures in Annex II to ensure a level of security appropriate to the risk, as required by Article 32 GDPR.
2. Flownally may update these measures as technology and risks change, provided the overall level of protection is not reduced.
3. The Controller is responsible for the security of its own Accounts, including User credentials, User access rights, and the content its Users choose to send.

In short: We protect your data with the measures listed in Annex II, such as encryption and two-factor authentication. You keep your own logins safe and manage who on your team has access.

1. The Controller gives Flownally general written authorisation to engage Sub-processors. The Sub-processors in use on the date of this Addendum are listed in Annex III, which Flownally keeps current at https://www.flownally.com/legal/subprocessors.
2. Flownally will notify the Controller of any intended addition or replacement of a Sub-processor at least 30 days in advance, by email or in the platform.
3. The Controller may object on reasonable data protection grounds within 14 days of the notice. The parties will discuss the objection in good faith. If no solution is found, the Controller may terminate the affected Services and receive a pro-rata refund of prepaid Fees for the remaining period.
4. Flownally imposes on each Sub-processor, by written contract, data protection obligations no less protective than those in this Addendum, and remains fully liable to the Controller for each Sub-processor's performance.
5. Messaging and customer-service platforms the Controller connects under its own account and agreement (such as WhatsApp, Messenger and Instagram operated by Meta, Twilio, LiveChat and Genesys) process data under the Controller's own agreement with each provider. They are the Controller's providers, not Sub-processors of Flownally. The Controller is responsible for accepting and complying with those platforms' terms.

In short: We use a small number of trusted providers, listed on our sub-processor page. We tell you 30 days before adding a new one, and you can object. WhatsApp and other channels you connect work under their own terms.

1. Taking into account the nature of the processing, Flownally assists the Controller with appropriate technical and organisational measures in responding to data subject requests under Chapter III GDPR. The platform lets the Controller view, export and delete conversations and contact records itself.
2. If Flownally receives a request directly from an End Customer, it will forward it to the Controller without undue delay and will not respond itself, except to direct the End Customer to the Controller.
3. Flownally provides reasonable assistance, using information available to it, with the Controller's obligations under Articles 32 to 36 GDPR, including data protection impact assessments and prior consultation with a supervisory authority.
4. Assistance beyond what the platform's standard features provide may be charged at Flownally's reasonable rates, agreed in advance.

In short: You can view, export and delete your customers' data yourself in the app. If one of your customers contacts us directly, we pass the request to you.

1. Flownally will notify the Controller without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Client Personal Data.
2. The notice will include, as far as then known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point for more information. Information not yet available will be provided in phases.
3. Flownally will take reasonable steps to contain and remedy the breach and will cooperate with the Controller so it can meet its own obligations under Articles 33 and 34 GDPR.
4. Notifying a breach is not an acknowledgement of fault or liability.

In short: If a security incident affects your data, we tell you within 72 hours and help you meet your own reporting duties.

1. Location. Flownally is established in Poland and stores Client Personal Data primarily in the European Economic Area (EEA).
2. Transfers from the Client to Flownally. No transfer safeguard is needed for Clients in the EEA. For Clients in the United Kingdom, transfers to Flownally rely on the UK's recognition of the EEA as providing adequate protection under the UK GDPR. For Clients in Switzerland, they rely on Switzerland's recognition of the EEA as providing adequate protection under the Swiss FADP.
3. Fallback. If any recognition in point 2 ceases to apply, the SCCs (Module 2, controller to processor) are incorporated into this Addendum by reference and apply between the Client as data exporter and Flownally as data importer, as amended by the UK Addendum or the Swiss amendments in point 6 where relevant. In that case: Clause 7 (docking) does not apply; under Clause 9, Option 2 applies with the notice period in Section 5; the optional wording in Clause 11 does not apply; Clauses 17 and 18 select the law and courts of Poland; and Annexes I and II of the SCCs are completed by Annexes I and II of this Addendum.
4. Onward transfers of EEA data. Flownally transfers Client Personal Data subject to the GDPR outside the EEA only on the basis of an adequacy decision of the European Commission, including the EU-US Data Privacy Framework for certified recipients, or, where none applies, the SCCs (Module 3, processor to processor) concluded with the Sub-processor.
5. Onward transfers of UK data. For Client Personal Data subject to the UK GDPR, Flownally relies on UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework where the recipient has opted into it, or, where none applies, the SCCs as amended by the UK Addendum.
6. Onward transfers of Swiss data. For Client Personal Data subject to the Swiss FADP, Flownally relies on the Swiss Federal Council's adequacy list, including the Swiss-US Data Privacy Framework where the recipient is certified to it, or, where none applies, the SCCs with these amendments: references to the GDPR are read as references to the Swiss FADP; the FDPIC is the competent supervisory authority for transfers governed by the Swiss FADP; and data subjects habitually resident in Switzerland may bring claims before the Swiss courts.
7. Supplementary measures and changes. Flownally applies supplementary measures where needed after a transfer risk assessment. If a transfer mechanism is invalidated, Flownally will move to an alternative lawful mechanism without undue delay and inform the Client.
8. Transparency. The sub-processor page states where each Sub-processor processes data and which mechanism applies to EU, UK and Swiss data. On request, Flownally will provide a copy of the relevant safeguards, from which commercial terms may be removed.

In short: Your data stays mainly in the EU, which the UK and Switzerland both treat as safe, so UK and Swiss customers can use Flownally without extra contracts. When a provider outside the EU is involved, we use the right safeguard for each country: the Data Privacy Framework (with its UK and Swiss versions) or standard contractual clauses.

1. Flownally will make available to the Controller all information necessary to demonstrate compliance with Article 28 GDPR, primarily through its published documentation, this Addendum with its annexes, and written answers to reasonable security questionnaires.
2. If that information is not sufficient, or a supervisory authority requires it, the Controller may carry out an audit, itself or through an independent auditor bound by confidentiality, no more than once in any 12 months.
3. The Controller must give at least 30 days' written notice and agree the scope with Flownally in advance. Audits take place during business hours, without disrupting Flownally's operations or giving access to other clients' data.
4. The Controller bears its own audit costs and reimburses Flownally's reasonable costs, unless the audit reveals a material breach of this Addendum by Flownally.

In short: We'll answer your reasonable security questions and share our documentation. If that isn't enough, you can audit us once a year with notice, at your own cost.

1. During the Contract, the Controller can export and delete Client Personal Data at any time using the platform.
2. After the Contract ends, Client Personal Data remains available for export until the Controller asks Flownally to delete it. Flownally will delete it from active systems within 30 days of the request, unless EU or Member State law requires it to be kept. If the Controller makes no request, Flownally deletes Client Personal Data 24 months after the Contract ends.
3. Copies in backups are deleted as backups expire, within 14 days, and remain protected under this Addendum until then.
4. On request, Flownally will confirm deletion in writing.

In short: You can export or delete your data anytime. After you leave, your data stays available until you ask us to delete it, or for up to 24 months. We then delete it within 30 days, and backup copies expire within 14 days.

1. Each party's liability under this Addendum is subject to the limitations in the General Terms, except where those limitations are not permitted by law. Nothing in this Addendum limits either party's liability towards data subjects under Article 82 GDPR.
2. If this Addendum conflicts with the General Terms on the processing of Client Personal Data, this Addendum prevails. If the SCCs apply and conflict with this Addendum, the SCCs prevail.
3. This Addendum remains in force for as long as Flownally processes Client Personal Data, even after the Contract ends.

In short: Liability follows the limits in our Terms of Service. On data protection topics, this Addendum takes priority over the Terms.

1. The current version of this Addendum is published at https://www.flownally.com/legal/data-processing-addendum, with its last-updated date. It replaces any earlier data processing terms between the parties relating to the Services.
2. Flownally may update this Addendum to reflect changes in law or in the Services. Material changes will be announced by email or in the platform at least 30 days before they take effect. No update may reduce the level of protection of Client Personal Data. If the Client objects to a material change, it may terminate the Contract before the change takes effect.
3. The Client's electronic acceptance of this Addendum constitutes a written contract in electronic form under Article 28(9) GDPR. No separate signature is required, and Flownally does not countersign individual copies.
4. This Addendum is governed by the laws of the Republic of Poland. Disputes are resolved by the court stated in the General Terms.
5. If any provision is invalid, the remaining provisions stay in effect.

In short: This page is always the current version. We'll warn you 30 days before any important change. Accepting it at sign-up is all that's needed, with no separate signature.

• Data subjects

  Description

  End Customers: individuals who communicate with the Controller through the Services, and individuals the Controller adds as contacts (including by import or for outbound messages), such as customers, prospects and guests. The Controller's Users, in relation to their use of the Services.

• Categories of personal data

  Description

  Identification and contact data (name, profile name, phone number, email address, messaging-channel identifiers); content of communications (text, images, audio, video, files, shared locations, reactions and replies); communication metadata (timestamps, channel, status, delivery and read information, assignment); data the Controller chooses to store about contacts (custom fields, tags, notes, event and booking data); records of automated communications (campaigns, journeys, chatbot interactions); User data (name, email address, role, team, activity in the Services). AI-generated summaries and intent matches, where enabled.

• Special categories

  Description

  None intended. The Controller must not submit them unless agreed in writing

• Processing operations

  Description

  Collection, storage, display, transmission to and from messaging channels, organisation, AI summarisation and intent detection where enabled, export, deletion

• Purpose

  Description

  Providing the Services to the Controller under the Contract

• Frequency

  Description

  Continuous, for the term of the Contract

• Retention

  Description

  Until the Controller deletes the data or the Contract ends, then as in Section 10. Certain data is erased automatically after fixed periods, for example media files three years after upload.

• Encryption

  Measure

  Personal data is encrypted in transit over public networks using TLS 1.2 or higher, and encrypted at rest using industry-standard algorithms. Credentials for connected channels are additionally encrypted at application level; authentication secrets are stored only in hashed form.

• Confidentiality and integrity of systems

  Measure

  Production systems are not publicly accessible and can be reached only by authorised personnel through an access-controlled gateway. Requests between internal services are authenticated. Changes reach production only through an automated, tested release process.

• Availability and recovery

  Measure

  Automated daily backups and point-in-time recovery for databases, stored within the EEA and retained for 14 days. Deletion protection on production databases. Documented restore procedure, tested at least yearly.

• Regular testing and evaluation

  Measure

  Automated tests run on every change, including tests that one Client cannot access another Client's data. Software dependencies are scanned for known vulnerabilities on a regular basis. Periodic review of the measures in this Annex.

• Identification and authorisation of personnel

  Measure

  Unique, personal accounts for all personnel. Access to personal data granted on a need-to-know basis, with multi-factor authentication, and removed promptly when no longer needed.

• Access control within the Services

  Measure

  Role-based permissions and per-record access managed by the Controller. Secure session management with automatic expiry and protection against cross-site request forgery.

• Separation

  Measure

  Each Client's data is logically separated, and the separation is enforced in every data access and verified by automated tests.

• Protection of interfaces

  Measure

  Web application firewall and rate limiting on key public interfaces. Data sent to Controller-configured endpoints is transmitted over TLS.

• Physical security

  Measure

  Provided by the hosting provider listed in Annex III, whose data centres are certified to ISO/IEC 27001 and audited under SOC 2.

• Logging and monitoring

  Measure

  Logging of security-relevant events, including access decisions, sign-ins and administrative changes, kept for 12 months. Monitoring and alerting for service failures.

• AI features

  Measure

  AI features (conversation summaries and chatbot intent detection) run only where the Controller enables them, through the AI provider listed in Annex III. Only the data needed for each feature is sent. The provider is contractually bound not to use Client Personal Data to train its models.

Last reviewed: 22 October 2026. Flownally keeps this list current on its sub-processor page, as described in Section 5.

Sub-processors

• Google Cloud EMEA Limited (Ireland)

  Service

  Cloud Run, Cloud SQL, Cloud Storage, Memorystore, Pub/Sub, Compute Engine

  Purpose

  Hosting the Services: application servers, databases, file storage, cache, message queues

  Data processed

  All Client Personal Data

  Location

  Frankfurt, Germany; backups in Google's EU multi-region

  Transfer mechanism (EU / UK / Swiss data)

  Not applicable: stored and processed in the EEA

• Google Cloud EMEA Limited (Ireland)

  Service

  Vertex AI (Gemini models)

  Purpose

  Conversation summaries, and chatbot intent detection (matching End Customer messages to intents)

  Data processed

  Content of conversations being summarised; text and media of End Customer messages that reach a chatbot intent step

  Location

  EU multi-region

  Transfer mechanism (EU / UK / Swiss data)

  Not applicable: processed in the EEA

• Google Cloud EMEA Limited (Ireland)

  Service

  Cloud CDN

  Purpose

  Delivering media files in conversations

  Data processed

  Images, video and documents sent or received in conversations

  Location

  Origin in Frankfurt; temporary cached copies at Google edge locations worldwide

  Transfer mechanism (EU / UK / Swiss data)

  Google Cloud Data Processing Addendum with SCCs, UK Addendum and Swiss amendments; Google LLC certified under the EU-US DPF, the UK Extension and the Swiss-US DPF

• Google Cloud EMEA Limited (Ireland)

  Service

  Cloud Logging, Cloud Trace, Cloud Monitoring

  Purpose

  Operating and troubleshooting the Services

  Data processed

  Technical logs and traces; may include phone numbers, email addresses and IP addresses

  Location

  EU multi-region

  Transfer mechanism (EU / UK / Swiss data)

  As for Cloud CDN, for any data processed outside the EEA

• Google Cloud EMEA Limited (Ireland)

  Service

  Google Workspace (email)

  Purpose

  Handling support requests

  Data processed

  Client Personal Data that Clients include in support requests, such as screenshots or conversation details

  Location

  EU multi-region

  Transfer mechanism (EU / UK / Swiss data)

  As for Cloud CDN

Services connected by the Client

These services process data under the Client's own account and agreement with each provider. They are the Client's providers, not Sub-processors of Flownally (see Section 5).

• Meta (WhatsApp Ireland Limited / Meta Platforms Ireland Limited)

  Service

  WhatsApp Business Platform (Cloud API), Messenger, Instagram

  How it is connected

  The Client connects its own business account through Embedded Signup and accepts Meta's terms itself

• Twilio

  Service

  SMS messaging

  How it is connected

  The Client's own Twilio account

• Text S.A. (Poland)

  Service

  LiveChat

  How it is connected

  The Client's own LiveChat account

• Genesys

  Service

  Genesys Cloud

  How it is connected

  The Client's own Genesys Cloud organisation

• 360dialog GmbH (Germany)

  Service

  WhatsApp Business API

  How it is connected

  The Client's own 360dialog account.

Other providers (outside this Addendum)

These providers process data for which Flownally is the controller, as described in the Privacy Policy, and do not process Client Personal Data. They are listed for transparency.

• Google Cloud EMEA Limited (Ireland)

  Service

  Identity Platform: User sign-in

  Data processed

  Users' email address, name, password hash, linked Google or Facebook IDs, sign-in times

  Location

  Global Google infrastructure

  Transfer mechanism

  Google Cloud Data Processing Addendum with SCCs; EU-US DPF

• Brevo

  Service

  Account emails (verification, invitations, usage alerts)

  Data processed

  Users' email address, name and email content

  Location

  EU (France)

  Transfer mechanism

  Not applicable

• Stripe Payments Europe, Limited (Ireland)

  Service

  Payments and invoicing

  Data processed

  Billing contact and company details; payment method held by Stripe

  Location

  Ireland and the United States

  Transfer mechanism

  SCCs; Stripe, Inc. certified under the EU-US DPF

• Paddle.com Market Limited (United Kingdom)

  Service

  Merchant of record for subscriptions

  Data processed

  Billing contact, company and tax details; payment details held by Paddle

  Location

  United Kingdom

  Transfer mechanism

  UK adequacy decision

• Google Ireland Limited

  Service

  Google Analytics (only with consent)

  Data processed

  Pseudonymous identifiers, page views and events, device data

  Location

  Including the United States

  Transfer mechanism

  SCCs; Google LLC certified under the EU-US DPF