Data Processing Agreement (DPA)
GDPR Art. 28 — how FlowMan.net processes personal data on your behalf.
1. Purpose and roles
This Data Processing Agreement (DPA) supplements the Terms of Service and governs the processing of personal data by FlowMan.net (the "Processor") on behalf of the customer (the "Controller") within the meaning of Art. 28 GDPR. It applies whenever the customer processes, through the platform, data relating to its own employees, clients, workshop participants or survey respondents.
2. Data processed and purposes
Categories: professional identity and contact details (name, email), workshop usage data (answers, votes, notes, maturity assessments), content imported by the customer. Sole purpose: providing the FlowMan.net suite features. No sale or advertising use of the data.
3. Instructions and confidentiality
FlowMan.net processes data only on the customer's documented instructions (through use of the platform). Persons authorised to process data are bound by confidentiality obligations.
4. Sub-processors
The customer authorises the following sub-processors. Any change will be notified with a right to object:
- Stripe — Payments and invoicing (billing data) — USA/EU, PCI-DSS certified.
- Resend — Transactional email delivery (email address, notification content).
- PostHog (EU Cloud) — Product analytics and session replay — hosted in the European Union, inputs masked by default.
- Cloud hosting — Application and database hosting, encrypted backups.
5. Security measures
TLS encryption in transit, strict per-organisation data isolation (multi-tenant), two-factor authentication, OTP verification for sensitive operations, daily encrypted backups with 14-day retention, admin access logging.
6. Assistance with data subject rights
The platform natively provides: full data export (ZIP), permanent account deletion (7-day grace period or immediate OTP-verified deletion), self-service rectification. FlowMan.net assists the customer with any additional data subject request within 72 business hours: dpo@flowman.net.
7. Data breach
In the event of a personal data breach, FlowMan.net notifies the customer without undue delay and no later than 48 hours after becoming aware of it, with the information required for its notification obligations (Art. 33 GDPR).
8. Term, return and deletion
This DPA applies for the duration of the subscription. Upon termination, the customer may export all of its data (ZIP); data is then permanently deleted from active systems within 30 days and from backups within 44 days (retention cycle).
9. Audit
FlowMan.net makes available the documentation necessary to demonstrate compliance. An audit may be conducted once a year, remotely, with 30 days' notice and under a confidentiality agreement.
Audience measurement (PostHog, EU) only with your consent. No advertising cookies.We use cookies required for the site to work and, with your consent, audience-measurement cookies (PostHog, hosted in the EU) to improve FlowMan.net. No advertising cookies. Cookie policy
Hosting scripts (performance, network security) stay active as they are required for the service.Some scripts tied to the hosting infrastructure (performance and network security) remain active: they are required for the service to work and are not subject to consent.