Data Processing Addendum – Flowenix AI Automation Agency

1. Definitions

"Personal Data" means any data relating to an identified or identifiable natural person processed by Flowenix on Client's behalf under the Services. "Processing," "Controller," "Processor," and "Data Subject" carry the meanings given under applicable data protection law (including, where Client's data subjects are located in the EU/UK, the GDPR/UK GDPR). "Sub-processor" means any third-party platform or service provider engaged by Flowenix to process Personal Data in delivering the Services.

2. Roles

Client is the Controller of Personal Data processed under the Services. Flowenix is the Processor, acting only on Client's documented instructions as set out in the applicable SOW or as reasonably necessary to deliver the Services.

3. Scope, Nature, and Duration of Processing

Flowenix processes Personal Data solely to build, operate, and maintain the automations, workflows, and integrations described in the applicable SOW — which may include contact/lead data, WhatsApp message content and metadata (via the WhatsApp Business Platform/Meta Cloud API), CRM records, and data passed through connected AI model providers for processing (e.g., generating responses, classifying intent). Categories of Data Subjects are Client's own customers, leads, or contacts. Flowenix does not process Personal Data for its own purposes beyond service delivery.

Duration. Processing continues for the term of the applicable SOW and any agreed support or maintenance period, followed by the retention and deletion terms in Section 13.

4. AI Model Providers and Model Training

Where the Services route Personal Data through a third-party AI model provider, Flowenix commits that:

• Flowenix does not use Client's Personal Data to train, fine-tune, or otherwise improve any machine learning model, whether its own or a third party's.
• Flowenix selects and configures AI model providers so that Personal Data submitted through the Services is not used by that provider for model training, using the provider's business/enterprise API terms and zero-retention or no-training options where the provider offers them.
• The specific AI model providers used in Client's project, and their applicable retention settings, are identified in the applicable SOW.
• Where a Client instruction or a Client-selected tool requires use of a provider that does not offer a no-training option, Flowenix will inform Client in writing before that provider is used, and Client's decision to proceed is treated as a documented instruction under Section 5.

5. Client Instructions and Consent

Flowenix will process Personal Data only per Client's documented instructions. Client is solely responsible for having a valid legal basis and, where required, obtaining consent from Data Subjects for the processing and automated communications carried out through the Services (per Section 4 of the Terms of Service). Flowenix will promptly notify Client if, in its reasonable opinion, an instruction violates applicable data protection law.

6. Sub-processors

Client authorizes Flowenix's use of the following categories of Sub-processors as examples:

• Cloud hosting/infrastructure providers
• Meta Platforms, Inc. (WhatsApp Business Platform/Cloud API)
• AI model providers used in automation workflows
• CRM/workflow platforms integrated per the SOW

The specific Sub-processors engaged for Client's project will be identified in the applicable SOW, which Client acknowledges by signing. Flowenix will give Client at least 30 days' written notice before engaging any new Sub-processor after SOW signature. Client may object on reasonable data-protection grounds within that period; if the parties cannot resolve the objection, Client may terminate the affected portion of the Services without penalty and Flowenix will refund any prepaid fees covering Services not yet delivered. Flowenix remains responsible for each Sub-processor's compliance with the obligations of this DPA, subject to the liability limitations in Section 15.

7. International Transfers

Client acknowledges that Personal Data may be transferred to and processed in countries outside Client's home jurisdiction, including the United States and other countries where Flowenix and its Sub-processors operate. Where required by applicable law, Flowenix will rely on an appropriate transfer mechanism, being: an adequacy decision of the competent authority (including, for transfers to certified US recipients, the EU–US Data Privacy Framework and its UK extension); the EU Standard Contractual Clauses; the UK International Data Transfer Agreement or Addendum; or another mechanism expressly permitted by the applicable law. Flowenix will make available, on Client's request, details of the mechanism relied on for a given Sub-processor.

8. Security Measures

Flowenix implements technical and organizational measures appropriate to the risk, including encrypted storage and transmission, two-factor authentication for critical systems, access limited to personnel who need it to perform the Services, and regular internal review of these measures. Flowenix will not materially decrease these measures during the term of the engagement.

9. Personnel

Flowenix ensures that personnel authorized to process Personal Data are bound by confidentiality obligations (per Section 8 of the Terms of Service) and are trained on their data protection responsibilities appropriate to their role.

10. Data Breach Notification

Flowenix will notify Client without undue delay, and in any event within 48 hours of becoming aware, of any confirmed breach involving Personal Data processed under this DPA. "Becoming aware" means when Flowenix has reasonable certainty that a qualifying breach occurred, not the point of initial suspicion pending investigation. Notification will include available details of the breach's nature, likely consequences, and remediation steps taken or proposed. Client is solely responsible for any notification obligations owed to its own Data Subjects or regulators.

11. Assistance

Flowenix will provide reasonable assistance to Client, at Client's cost for anything beyond minor effort, in: responding to Data Subject requests (access, correction, deletion, portability, restriction, and objection); carrying out data protection impact assessments and any prior consultation with a supervisory authority; and meeting Client's own security, breach notification, and regulatory obligations — in each case to the extent such matters relate to Personal Data processed under this DPA and Client cannot reasonably address them itself.

12. Audit Rights

Client may request, no more than once per 12-month period absent a reasonable belief of non-compliance, reasonable evidence of Flowenix's compliance with this DPA (e.g., written responses to a security questionnaire). On-site or third-party audits, if requested, are at Client's cost and subject to reasonable advance notice and confidentiality protections for Flowenix's other clients' data.

13. Data Retention and Deletion

Flowenix retains Personal Data only for as long as necessary to deliver the Services or as instructed by Client. Upon termination of the engagement (per Section 13 of the Terms of Service), Flowenix will, within 30 days of Client's request, delete or return all Personal Data in its possession, except where retention is required by applicable law — in which case Flowenix will continue to protect the data under this DPA's terms and limit processing to the purpose of that legal requirement. Absent a Client request, Flowenix will delete Personal Data held in Flowenix-operated systems after the 30-day export window described in Section 13 of the Terms of Service. WhatsApp message content specifically is deleted per Meta's then-current platform retention policy, independent of Flowenix's own systems.

14. US State Privacy Laws

Where Client is subject to the California Consumer Privacy Act as amended by the CPRA, or a comparable US state privacy law, Flowenix acts as a "service provider" (or "processor" under the equivalent state term) with respect to personal information processed on Client's behalf. Flowenix will not sell or share that personal information, will not retain, use, or disclose it for any purpose other than performing the Services specified in the SOW or as otherwise permitted by that law, and will not combine it with personal information received from other sources except as that law permits. Flowenix certifies that it understands and will comply with these restrictions.

15. Liability

Liability arising under this DPA is subject to the limitations and cap set out in Section 10 of the Terms of Service, except that this cap does not limit either party's liability for a breach of this DPA that constitutes gross negligence or willful violation of applicable data protection law, to the extent such limitation is unenforceable under that law.

16. Governing Law

This DPA is governed by the same governing law and dispute resolution terms as the Terms of Service (Section 14) — Delaware law, with a 30-day good-faith negotiation period followed by exclusive jurisdiction of Delaware state or federal courts — except where a specific data protection law (e.g., GDPR, Law 09-08) mandates a different resolution mechanism for data-subject-related claims, in which case that mandatory law controls solely as to that claim.

17. Contact

Email: support@flowenix.com
Website: www.flowenix.com