Skip to content

Flowmap Data Processing Addendum

Version 1.0 · Effective November 11, 2026

This Data Processing Addendum (“DPA”) forms part of the agreement between Flowmap, Inc. (“Flowmap”) and the customer identified in that agreement (“Customer”) governing Customer’s use of Flowmap’s services (the “Agreement”). This DPA applies when Flowmap processes Customer Personal Data on Customer’s behalf in providing the Services. Capitalized terms not defined here have the meanings given in the Agreement.

This DPA becomes binding when Customer enters into an Agreement or order form that incorporates it by reference, or when the parties otherwise agree to it in writing. It is effective on the effective date of the Agreement unless the parties agree otherwise. If there is a conflict between this DPA and the Agreement concerning the processing of Customer Personal Data, this DPA controls.

1. Definitions

For purposes of this DPA:

  • “Applicable Data Protection Law” means laws and regulations applicable to Flowmap’s processing of Customer Personal Data under the Agreement, including, as applicable, the GDPR, UK GDPR, and U.S. State Privacy Laws.
  • “Customer Personal Data” means personal data, personal information, or similarly protected information contained in Customer Data that Flowmap processes on Customer’s behalf to provide the Services.
  • “Data Subject,” “controller,” “processor,” and “processing” have the meanings given to them by Applicable Data Protection Law. “Controller” includes “business,” and “processor” includes “service provider” and “contractor,” where those terms apply.
  • “GDPR” means Regulation (EU) 2016/679. “UK GDPR” means the GDPR as incorporated into United Kingdom law.
  • “Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data processed by Flowmap. It does not include unsuccessful attempts that do not compromise Customer Personal Data.
  • “Subprocessor” means a third party engaged by Flowmap to process Customer Personal Data on Customer’s behalf.
  • “U.S. State Privacy Laws” means comprehensive U.S. state privacy laws applicable to Customer Personal Data, including the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”).

2. Roles and scope

As between the parties, Customer is the controller of Customer Personal Data and Flowmap is the processor. If Customer is itself a processor, Flowmap is Customer’s subprocessor. Each party will comply with the obligations that apply to it under Applicable Data Protection Law.

This DPA does not apply where Flowmap processes personal data as a controller, including account, billing, business contact, and Service usage information that Flowmap processes for its own legitimate business purposes as described in Flowmap’s Privacy Policy.

3. Customer instructions

Flowmap will process Customer Personal Data only on Customer’s documented instructions, including as necessary to provide, secure, maintain, and support the Services in accordance with the Agreement, this DPA, Customer’s configuration and use of the Services, and other written instructions agreed by the parties. Flowmap may process Customer Personal Data as required by law, in which case it will notify Customer before processing unless the law prohibits notice.

Customer is responsible for the lawfulness of its instructions and Customer Personal Data, including providing required notices, obtaining required consents, and establishing a valid legal basis for processing. Customer will not instruct Flowmap to process Customer Personal Data in violation of Applicable Data Protection Law. Flowmap will promptly inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Law.

4. Confidentiality

Flowmap will ensure that personnel authorized to process Customer Personal Data are bound by appropriate confidentiality obligations and access it only as necessary to perform their responsibilities.

5. Security

Taking into account the state of the art, costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risks to Data Subjects, Flowmap will maintain appropriate technical and organizational measures designed to protect Customer Personal Data. The current measures are described in Schedule 2. Customer acknowledges that security measures evolve and Flowmap may update them, provided that updates do not materially reduce the overall protection of Customer Personal Data.

6. Subprocessors

Customer gives Flowmap general written authorization to engage Subprocessors. Flowmap will require each Subprocessor to protect Customer Personal Data through a written agreement that imposes data protection obligations no less protective in substance than those in this DPA, to the extent applicable to the services performed. Flowmap remains responsible for each Subprocessor’s performance of its obligations as required by Applicable Data Protection Law.

Flowmap’s current Subprocessor list is available by contacting legal@flowmap.com. Customer may subscribe to notice of new Subprocessors through that address. Flowmap will provide notice before a new Subprocessor begins processing Customer Personal Data. Customer may object on reasonable data protection grounds by emailing Flowmap within 15 days after notice. The parties will work in good faith to resolve the objection. If they cannot, Flowmap may provide an alternative, avoid use of the Subprocessor for Customer, or permit Customer to terminate the affected Services without penalty and receive a pro rata refund of prepaid fees for the terminated period.

7. Data Subject requests

Taking into account the nature of the processing, Flowmap will provide reasonable assistance through appropriate technical and organizational measures for Customer to respond to requests from Data Subjects to exercise their rights. If Flowmap receives a request relating to Customer Personal Data directly from a Data Subject, Flowmap will direct the requester to Customer and will not respond substantively unless Customer instructs it to do so or the law requires it.

8. Compliance assistance

Taking into account the nature of processing and information available to Flowmap, Flowmap will provide reasonable assistance to Customer with data protection impact assessments, prior consultations with supervisory authorities, and Customer’s obligations under Articles 32 through 36 of the GDPR or equivalent provisions of Applicable Data Protection Law. Flowmap may charge reasonable fees for assistance that is unusually burdensome or outside the standard functionality of the Services, unless the assistance is required because of Flowmap’s breach of this DPA.

9. Security Incidents

Flowmap will notify Customer without undue delay after becoming aware of a Security Incident. To the extent known and reasonably available, the notice will describe the nature of the Security Incident, the categories and approximate number of affected Data Subjects and records, the likely consequences, the measures taken or proposed to address it, and a contact for follow-up. Flowmap may provide information in phases as its investigation progresses. Flowmap will take reasonable steps to contain, investigate, and mitigate the Security Incident and will reasonably cooperate with Customer’s response. Notification is not an admission of fault or liability. Customer is responsible for determining whether to notify Data Subjects, regulators, or others and for making those notifications.

10. Return and deletion

During the term, Customer may access and export Customer Personal Data using available Service functionality. At Customer’s choice, Flowmap will delete or return Customer Personal Data after the Services end and will delete remaining copies, unless applicable law requires continued retention. Customer Personal Data in backups will remain protected under this DPA and be deleted in accordance with Flowmap’s ordinary backup lifecycle. This section does not require deletion of data that Flowmap processes as a controller or data that has been irreversibly anonymized.

11. Information and audits

Flowmap will make available information reasonably necessary to demonstrate compliance with this DPA. Customer may request an audit no more than once in any 12-month period, except after a Security Incident or where a regulator requires otherwise. The parties will first use Flowmap’s then-current independent audit reports, certifications, written responses, or similar documentation, if available and reasonably sufficient. Any further audit must be conducted by Customer or an independent auditor bound by confidentiality, during normal business hours, on reasonable advance notice, and without unreasonably disrupting Flowmap’s operations or compromising the security or confidentiality of other customers. Customer will bear its audit costs unless the audit identifies a material breach of this DPA by Flowmap.

12. International data transfers

Customer authorizes Flowmap to process Customer Personal Data in the United States and in other countries where Flowmap and its Subprocessors operate, subject to the safeguards in this section.

For a transfer of Customer Personal Data subject to the GDPR to a country not recognized as providing an adequate level of protection, the standard contractual clauses in European Commission Implementing Decision (EU) 2021/914 (“EU SCCs”) are incorporated into this DPA by reference. Module Two applies where Customer is a controller and Flowmap is a processor; Module Three applies where Customer is a processor and Flowmap is a subprocessor. For each applicable module:

  • the optional docking clause in Clause 7 applies;
  • Option 2 in Clause 9 applies, with the notice period in Section 6 of this DPA;
  • the optional language in Clause 11 does not apply;
  • in Clause 17, Option 1 applies and the governing law is the law of Ireland;
  • the courts of Ireland are selected under Clause 18; and
  • Schedules 1 through 3 of this DPA complete Annexes I through III.

For a restricted transfer subject to the UK GDPR, the EU SCCs as completed above apply as modified by the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (“UK Addendum”), which is incorporated by reference. Tables 1 through 3 are completed using the parties’ information and Schedules 1 through 3 of this DPA; in Table 4, either party may end the UK Addendum as set out in Section 19 of the UK Addendum.

The parties will interpret this DPA to provide safeguards no less protective than the EU SCCs or UK Addendum. If those mechanisms are replaced or invalidated, the parties will work in good faith to implement a valid alternative transfer mechanism.

For transfers subject to the Swiss Federal Act on Data Protection, the EU SCCs apply with references to the GDPR understood to include the Swiss Federal Act on Data Protection, references to the European Union and Member States understood to include Switzerland, and the competent supervisory authority understood to be the Swiss Federal Data Protection and Information Commissioner.

13. U.S. state privacy terms

Where U.S. State Privacy Laws apply, Flowmap acts as Customer’s service provider, contractor, or processor. Flowmap will process Customer Personal Data only for the limited and specified purposes described in the Agreement and this DPA. Flowmap will not:

  • sell or share Customer Personal Data;
  • retain, use, or disclose Customer Personal Data outside the direct business relationship with Customer or for any purpose other than the specified business purposes, except as permitted by U.S. State Privacy Laws; or
  • combine Customer Personal Data with personal information received from another person or collected from Flowmap’s own interactions with a consumer, except as permitted by law.

Flowmap will provide the same level of privacy protection required of Customer by applicable U.S. State Privacy Laws, will notify Customer if it determines it can no longer meet its obligations, and grants Customer the right to take reasonable and appropriate steps to help ensure that Flowmap uses Customer Personal Data consistently with Customer’s obligations. Upon notice, Customer may take reasonable and appropriate steps to stop and remediate unauthorized use. Flowmap certifies that it understands and will comply with the restrictions and obligations in this Section 13.

14. Liability and general terms

Each party’s liability arising out of this DPA is subject to the exclusions and limitations of liability in the Agreement, except to the extent those limitations are prohibited by Applicable Data Protection Law. If this DPA, the Agreement, and an applicable transfer mechanism conflict, the transfer mechanism controls, followed by this DPA, then the Agreement. This DPA terminates when Flowmap no longer processes Customer Personal Data, except for provisions that by their nature survive termination.

Schedule 1 — Details of processing

A. Parties

Data exporter: Customer and its authorized affiliates, as identified in the Agreement or applicable order form. Customer’s contact details and activities relevant to the transfer are those stated in the Agreement. Customer is a controller or processor, as applicable.

Data importer: Flowmap, Inc., 16036 Blythe St, Los Angeles, California 91406, United States; legal@flowmap.com. Flowmap’s relevant activities are providing the Services described in the Agreement. Flowmap is a processor or subprocessor, as applicable.

B. Processing

  • Subject matter and purpose: Providing, securing, maintaining, and supporting Flowmap’s customer journey and workflow Services as configured and used by Customer.
  • Duration: The term of the Agreement, plus the period needed to return or delete Customer Personal Data as described in this DPA.
  • Nature of processing: Collection, recording, organization, storage, retrieval, consultation, use, transmission, integration, automation, analysis, support, deletion, and other processing necessary to provide the Services.
  • Data Subjects: Customer’s users, personnel, contractors, leads, prospects, contacts, clients, customers, and other individuals whose data Customer or its users submit to or connect with the Services.
  • Categories of data: Names and identifiers; contact, organization, and profile details; form responses; communications and message content; appointment and scheduling information; uploaded files; workflow, transaction, and relationship data; information from services connected by Customer; and technical data such as IP address, device, browser, and activity logs.
  • Sensitive data: The Services are not intended for Customer Personal Data subject to special protections unless expressly permitted by the Agreement or otherwise agreed by Flowmap in writing. Customer will not submit sensitive or special-category data without establishing a lawful basis and implementing any safeguards required by Applicable Data Protection Law. The protections in Schedule 2 apply to any sensitive data that the parties have agreed Flowmap may process.
  • Frequency: Continuous or as initiated and configured by Customer during the term of the Agreement.
  • Subprocessor transfers: As necessary for the Subprocessor to provide its contracted services, for the duration of those services and subject to Section 6.

C. Supervisory authority

The competent supervisory authority is determined under Clause 13 of the EU SCCs. It is the authority with responsibility for Customer’s compliance with the GDPR for the relevant transfer or, where Clause 13(b) applies, the authority identified under that clause based on Customer’s EU representative or the location of the affected Data Subjects.

Schedule 2 — Technical and organizational measures

Flowmap maintains measures designed to protect the confidentiality, integrity, and availability of Customer Personal Data, including:

  • encryption of data in transit using TLS 1.2 or later and encryption of sensitive connected-service credentials and integration secrets at rest using AES-256-GCM;
  • credential protections, authenticated sessions, signed same-site session cookies, CSRF protections, and secure browser headers;
  • logical access controls, including organization- and role-scoped authorization, designed to limit access to authorized users and personnel;
  • confidentiality obligations and access practices designed to limit personnel access to what is needed for their responsibilities;
  • application monitoring, structured error reporting, and operational logging designed to support detection and investigation of service issues;
  • backup and recovery procedures, supervised application processes, and change practices designed to support resilience and availability;
  • processes for responding to suspected security incidents and notifying affected customers as required by this DPA; and
  • contractual confidentiality, security, and data protection requirements for Subprocessors that process Customer Personal Data.

More information about Flowmap’s safeguards is available on the Security page.

Schedule 3 — Subprocessors

The parties agree that Flowmap’s current Subprocessor list, available from legal@flowmap.com, completes Annex III of the EU SCCs. The list identifies each Subprocessor’s name, location, and processing function. Flowmap will provide additions and replacements in accordance with Section 6.

Questions about this DPA or requests for a copy of the current Subprocessor list may be sent to legal@flowmap.com.