This Data Processing Agreement ("DPA") forms part of the agreement between FlowForma Limited, 1st Floor, Block E, Eastpoint Business Park, Dublin 3, Ireland ("FlowForma", "we", "us" or "our") and the customer named in the order form ("Customer" or "you") for any FlowForma product: FlowForma Process Automation, FlowForma Contract, FlowForma Agent Trust and FlowForma Assure (each a "Product"). It applies wherever FlowForma processes personal data on your behalf to provide a Product. If this DPA conflicts with the Terms and Conditions on a personal data processing matter, this DPA prevails. Free trials are covered by the Free Trial Terms.
1. Roles and scope
1.1 For personal data contained in Customer Data and processed by FlowForma to provide a Product ("Customer Personal Data"), you are the controller (or a processor acting on behalf of another controller) and FlowForma is the processor (or subprocessor, as applicable).
1.2 FlowForma will process Customer Personal Data only on your documented instructions, as set out in the agreement and through your lawful use of the Product, unless applicable law requires otherwise. Where legally permitted, FlowForma will tell you before carrying out processing required by law.
1.3 The subject matter, duration, nature and purpose of processing, the types of personal data and the categories of data subjects are described in Annex A.
1.4 Process Automation only Process and form data in FlowForma Process Automation is stored in your own Microsoft 365 tenant, under your agreement with Microsoft. FlowForma processes that data only to the extent needed to run the Product and provide support.
2. Confidentiality and security
2.1 FlowForma will ensure that everyone authorized to process Customer Personal Data is bound by confidentiality obligations.
2.2 FlowForma will maintain appropriate technical and organizational measures designed to protect Customer Personal Data, including the measures described on our Security page. FlowForma may update those measures, provided this does not materially reduce the overall security of the Product during your subscription term.
3. Subprocessors
3.1 You give FlowForma general written authorization to engage subprocessors to provide the Products. The current subprocessors for each Product are listed on our Subprocessors page.
3.2 FlowForma will impose data protection obligations on each subprocessor that are appropriate to the services it performs and materially consistent with FlowForma's obligations under this DPA.
3.3 FlowForma may add or replace subprocessors. FlowForma will keep the Subprocessors page current and provide a reasonable way for you to receive notice of material changes. You may object on reasonable data protection grounds. If the parties cannot resolve a valid objection after good-faith discussion, FlowForma may terminate the affected Product and refund any prepaid fees for the unused portion of that Product, as your remedy for the unresolved objection.
4. International transfers
4.1 FlowForma will use a lawful transfer mechanism where personal data is transferred from the European Economic Area, the United Kingdom or another jurisdiction requiring transfer safeguards to a country that has not been recognized as providing adequate protection.
4.2 Where required, the applicable European Commission Standard Contractual Clauses, the UK Addendum or another legally recognized mechanism is incorporated by reference to the extent needed for the relevant transfer.
4.3 Where stored data is held for each Product is set out in Annex A. For FlowForma Contract, FlowForma Agent Trust and FlowForma Assure, Microsoft Azure OpenAI Service uses Microsoft's Global deployment type, so individual AI requests may be processed in any Azure region where the applicable model is available. Stored data remains in the European Economic Area.
4.4 Process Automation only Built-in AI features use Microsoft Azure OpenAI Service. If you connect your own AI provider, that provider's terms and data location apply to the data you send to it.
5. Data subject requests and assistance
5.1 Taking into account the nature of the processing, FlowForma will provide reasonable assistance to help you respond to requests from data subjects exercising their rights. You remain responsible for responding to those requests.
5.2 If FlowForma receives a request directly relating to Customer Personal Data, FlowForma may refer the requester to you unless prohibited by law.
5.3 FlowForma will provide reasonable assistance with data protection impact assessments and consultations with supervisory authorities where required by applicable law and relevant to the Product. Material assistance beyond normal support may be charged at FlowForma's then-current professional services rates, with prior notice.
6. Personal data breaches
6.1 FlowForma will notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and will provide the information reasonably available to FlowForma to help you meet your own notification obligations.
6.2 Notifying you of a breach is not an admission of fault or liability.
7. Audit and compliance information
7.1 FlowForma will make available the information reasonably necessary to demonstrate compliance with this DPA, including relevant security documentation, certifications or summaries where available.
7.2 You have no general right to carry out intrusive audits or vulnerability testing, or to access FlowForma systems or other customers' information. Where an audit is legally required and the information available is not sufficient, FlowForma will reasonably cooperate with a proportionate audit, subject to reasonable notice, confidentiality, scope and security requirements. Unless the audit finds a material breach by FlowForma, you will bear your own costs, and FlowForma may charge reasonable costs for material assistance beyond normal support.
8. Return and deletion
8.1 During your subscription term you may use each Product's standard export and download features. Bespoke extraction, migration or transformation work may be chargeable.
8.2 After your subscription ends, your workspace is disabled for 30 days. It is then soft-deleted and, 30 days later, permanently deleted by an automated deletion process, unless the law requires retention or the parties agree otherwise in writing.
8.3 Residual copies expire on their own cycles: database backups on a rolling 30-day basis, deleted files through storage soft-delete within 90 days, and operational logs within 365 days. Microsoft's Azure OpenAI abuse-monitoring process may retain prompts and outputs for up to 30 days. Residual data remains protected under the agreement until it is deleted or expires.
8.4 Process Automation only Process and form data stays in your own Microsoft 365 tenant, under your control and your Microsoft 365 retention policies.
8.5 FlowForma may keep limited records required for legal, regulatory, accounting, fraud-prevention, security or contract-enforcement purposes, subject to applicable confidentiality and data protection obligations.
Annex A: Details of processing
| Item | Details |
|---|---|
| Subject matter | Providing and supporting the Products you subscribe to, including storing workspace and process data; extracting and indexing documents and evidence; AI analysis; sending invitations, one-time passcodes and notifications; maintaining audit trails; and operating, securing and monitoring the Products. |
| Duration | For your subscription term and until deletion completes under clause 8. |
| Data subjects | Your users and invited users; vendors, suppliers and other third-party respondents; named contacts; and individuals who appear in documents, form responses or free text you submit. |
| Types of personal data | Names; business email addresses; organization and vendor information; identity-provider identifiers; roles and membership records; form, process, contract and assessment content; questionnaire responses; uploaded documents and extracted text; AI findings and citations; notification content; audit records; IP addresses and technical and usage metadata. |
| Special category data | The Products do not request special category data. Documents or free text you control may contain it. You are responsible for deciding whether submitting such data is appropriate and lawful. |
| Frequency | Continuous, or as initiated by you while using the Products. |
| Where stored data is held | FlowForma Process Automation: process and form data in your own Microsoft 365 tenant and region; platform data in FlowForma's Microsoft Azure environment in the region you choose (Europe, Asia-Pacific, India or the Americas). FlowForma Contract, FlowForma Agent Trust and FlowForma Assure: European Economic Area: Ireland (primary), the Netherlands (backups and replicas), Sweden (AI service data). |
Annex B: Security measures and subprocessors
The technical and organizational measures FlowForma maintains are described on our Security page. The current subprocessors for each Product are listed on our Subprocessors page.