Data Processing Agreement (DPA)

Parties

This Data Processing Agreement forms part of the Contract for Services ("Principal Agreement") between Workflooow (the "Data Controller") and [Data Processor's Name] (the "Data Processor").

Purpose

The purpose of this DPA is to ensure and demonstrate compliance with the GDPR as it relates to the processing of personal data under the Principal Agreement.

Obligations of the Data Processor

• Process personal data solely on documented instructions from Workflooow.
• Ensure that all personnel who access the data are obliged to maintain its confidentiality.
• Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.
• Not engage any subcontractors without prior written or specific authorization from Workflooow.
• Assist Workflooow in responding to requests from data subjects and in ensuring compliance with its data protection obligations.
• Promptly notify Workflooow about any personal data breaches.

Data Transfer

No transfer of personal data to countries outside of the European Economic Area (EEA) is allowed without the prior written consent from Workflooow.

Audit and Compliance

The Data Processor agrees to provide necessary information and allow for audits by Workflooow or its designated auditor to demonstrate compliance with this DPA.

Termination and Data Return

Upon termination of the data processing services, the Data Processor must delete or return all personal data to Workflooow, unless required to retain it by law.

Contact Information

For any inquiries regarding this DPA, contact info@workflooow.com.

Sub-processors

To provide the services, we engage third-party sub-processors who process personal data on our behalf under written terms consistent with this Agreement. These currently include Google (Google Analytics 4 and Google Tag Manager) and PostHog for website and product analytics, alongside our hosting and infrastructure providers. We will make available an up-to-date list of sub-processors on request and give notice of intended changes so that the customer may object on reasonable data-protection grounds.