This data processing agreement is concluded between the customer (“the data controller”) and FlowDule ApS (“the data processor”) and forms an integral part of the terms of service. It sets out the terms for processing under Art. 28 of the General Data Protection Regulation.
1. Subject matter and duration
FlowDule processes personal data on behalf of the data controller for as long as the data controller uses the platform.
2. Nature and purpose of the processing
The processing covers the storage and handling of bookings, client and journal data, payments and communication for the purpose of providing the platform’s features.
3. Types of data and categories of data subjects
Ordinary personal data about the data controller’s clients and employees and - where the journal module is used - special categories (health data).
4. The data processor’s obligations
- Processes only on documented instructions from the data controller.
- Ensures confidentiality among persons with access.
- Takes appropriate technical and organisational measures (Art. 32).
- Assists the data controller in fulfilling data subjects’ rights and obligations under Art. 32-36.
- Deletes or returns data upon termination.
- Makes information available for audit.
5. Sub-processors
The data controller gives general authorisation for the use of sub-processors. Current sub-processors are listed in Sub-processors. Significant changes are notified so that the data controller can object.
6. Transfers to third countries
Any transfers outside the EEA take place on a valid transfer basis (SCC or the Data Privacy Framework).
7. Personal data breaches
The data processor notifies the data controller without undue delay after becoming aware of a breach, so that the data controller can comply with the 72-hour deadline under Art. 33.