Last updated: October 31, 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service between Basalticware, Lda., which operates Flowzao (the "Processor"), and the organization that uses Flowzao (the "Customer" or "Controller"). It governs the processing of Customer Data by the Processor on behalf of the Controller, as required by Article 28 of the GDPR.
"Customer Data" means the personal data in the content that the Customer and its users keep in Flowzao: tickets, interventions (including photos, drawn signatures and signer names), comments, attachments, time logs, feedback ratings and ecosystem data. The Customer is the controller of Customer Data, and the Processor processes it only on the Customer's instructions.
Basalticware is a controller, not a processor, of the personal data it needs to provide and run Flowzao: users' account and sign-in data, the Customer's billing contact and billing records, notification tokens, security and technical logs, and data about visitors to the website. That processing is described in the privacy policy and is not covered by this DPA.
"Personal Data", "Processing", "Data Subject", "Controller", and "Processor" have the meanings given in the General Data Protection Regulation (EU) 2016/679 ("GDPR").
Subject matter: hosting and processing Customer Data to provide the Flowzao service desk platform. Duration: for the term of the agreement, and until Customer Data is deleted under section 10. Nature and purpose: storing, displaying, organizing, sending (including by email and push notification to the Customer's users) and backing up Customer Data, so that the Customer can manage tickets, interventions and collaboration in ecosystems.
Categories of data subjects: the Customer's users (such as employees, technicians and administrators); the Customer's clients and their representatives, including people who sign an intervention; and users of partner organizations in shared ecosystems. Types of personal data: names, contact details and other information included in tickets and comments, photos, drawn signatures and signer names, intervention times and notes, time logs and feedback ratings.
Flowzao is not designed for special categories of personal data (Article 9 GDPR), and the Customer should not store them in Flowzao.
The Processor shall: process Customer Data only on documented instructions from the Controller, which are this DPA, the Terms of Service and the Controller's use and settings of the service; inform the Controller if, in its opinion, an instruction infringes the GDPR; ensure that personnel are bound by confidentiality; implement appropriate technical and organizational security measures; assist the Controller in responding to data subject requests and in meeting its obligations under Articles 32 to 36 of the GDPR; delete or return Customer Data upon termination; and make available all information necessary to demonstrate compliance.
When the Controller connects its own Anthropic API key, sending the content needed for the AI features to Anthropic is processing on the Controller's instructions (see section 5).
The Processor uses the following sub-processors for Customer Data: Neon (database hosting, EU: Frankfurt, Germany); Cloudflare (application hosting on its global network, CDN, and file storage in R2, in Western Europe); Resend (email delivery, US); Expo (push notification delivery, US); Apple (Apple Push Notification service, for iOS devices); Google (Firebase Cloud Messaging, for Android devices). The Controller authorizes these sub-processors. The Processor will notify the Controller before adding or replacing a sub-processor, so that the Controller can object.
Stripe processes payments and billing data, for which Basalticware is the controller. It does not process Customer Data and is not a sub-processor under this DPA.
Anthropic is not a sub-processor of the Processor: it receives data only when the Controller connects its own Anthropic API key, under the Controller's own agreement with Anthropic, and only for the AI features its users invoke or the Controller uses.
Customer Data is stored in the EU: the database in Frankfurt (Neon, eu-central-1) and files in Cloudflare R2, in Western Europe. Requests are processed on Cloudflare's global network, in the data centre closest to the user, which can be outside the EU/EEA. Emails and push notifications pass through Resend, Expo, Apple and Google, which may process them outside the EU/EEA. For any transfer outside the EU/EEA, the Processor relies on an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework, for certified providers) or on the Standard Contractual Clauses.
The Processor implements: encryption in transit (TLS 1.3) and at rest; access controls and authentication; regular security reviews; incident response procedures; backup and disaster recovery.
The Processor will notify the Controller of any personal data breach affecting Customer Data without undue delay, and in any event within 72 hours of becoming aware of it, providing all relevant details.
The Processor shall make available to the Controller all information necessary to demonstrate compliance with this DPA and allow for audits and inspections by the Controller or an authorized auditor.
This DPA shall remain in effect for the duration of the agreement. Upon termination, the Processor shall delete all Customer Data within 30 days, unless retention is required by law.
For data protection questions: hello@basalticware.com