Data Processing Agreement

1. Definitions

"Controller" means the Flowtriq customer. "Processor" means Flowtriq. "Personal Data" means any information relating to identified or identifiable natural persons submitted to the Service.

2. Scope of Processing

Flowtriq processes Personal Data solely to provide the Service as described in the Terms of Service and as instructed by the Controller. Flowtriq will not process Personal Data for any other purpose.

3. Sub-processors

Flowtriq engages the following sub-processors:

• Stripe, Inc.: Payment processing (United States)
• Infrastructure hosting provider: Server hosting and storage

We will notify you of any changes to sub-processors with at least 30 days notice.

4. Security Measures

Flowtriq implements appropriate technical and organisational measures including: TLS encryption in transit, encryption at rest for PCAP data, access controls, and audit logging.

5. Data Subject Rights

Flowtriq will assist the Controller in responding to data subject rights requests to the extent technically feasible within the constraints of the Service.

6. Data Breach Notification

Flowtriq will notify the Controller within 72 hours of becoming aware of a Personal Data breach affecting data processed under this DPA.

7. Data Transfers

Data is processed and stored in the Controller's chosen region. Cross-border transfers are conducted under Standard Contractual Clauses or equivalent mechanisms.

8. Deletion

Upon account termination, Flowtriq will delete or anonymise Personal Data within 30 days, unless retention is required by law.