Data Processing Agreement

Last updated: April 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Sikker IT ("Data Processor") and the customer ("Data Controller") for the use of the Flow80 platform.

1. Definitions

"Personal Data" means any information relating to an identified or identifiable natural person. "Processing" means any operation performed on Personal Data. "GDPR" means Regulation (EU) 2016/679.

2. Subject Matter and Duration

Subject matter: The Processor processes Personal Data solely for providing the Flow80 workflow automation platform as instructed by the Controller.

Duration: This DPA remains in force for the duration of the active service subscription. Upon termination, the Processor retains data for a maximum of 30 days before deletion, unless otherwise required by law.

3. Nature and Purpose of Processing

Processing is carried out exclusively for operating the Flow80 platform as a SaaS product, including: account management, workflow execution, data storage, technical support, and service improvement.

4. Types of Personal Data

Data processed: Account holder names, email addresses, IP addresses, usage metadata, and any data entered into workflows by the Controller.

Data subjects: Users of the Controller's Flow80 account, including employees, contractors, and end-users.

5. Obligations of the Data Processor

  • Process Personal Data only on documented instructions from the Controller
  • Ensure persons authorized to process data are bound by confidentiality
  • Implement appropriate technical and organizational security measures
  • Not engage sub-processors without prior written authorization
  • Assist the Controller in fulfilling data subject rights requests
  • Delete or return all Personal Data at the end of the service term
  • Notify the Controller of Personal Data breaches within 72 hours

6. Security Measures

The Processor implements industry-standard security measures including: encryption in transit (TLS), access controls, regular security updates, network segmentation, and incident response procedures.

7. Sub-Processors

The Processor uses the following sub-processors: an EU / European hosted cloud hosting provider (cloud hosting), Mailgun (transactional email), Stripe (payment processing), and MongoDB (data storage). The Processor maintains an updated list of sub-processors. Customers may request the full, named list of current sub-processors, including hosting and infrastructure providers, at [email protected].

8. Data Subject Rights

The Processor assists the Controller in responding to data subject requests for access, rectification, erasure, restriction, portability, and objection. Contact Sikker IT at [email protected].

9. Audits

The Controller may request an audit upon reasonable notice (minimum 30 days). The Processor will provide evidence of compliance through security certifications and audit reports where available.