Data Processing Agreement

You are the controller of personal data in the business data you upload or connect. Flow Pilot is your processor and processes it only on your documented instructions, which are these terms and your use of the service.

Subject matter: provision of the Flow Pilot service. Duration: the term of your subscription plus the deletion period. Data subjects: your staff, clients, prospects and contacts. Data types: names, contact details, communications, invoices and task records.

• Encryption in transit (TLS) and at rest.
• Row-level access controls so each account sees only its own data.
• Least-privilege staff access, logging and request rate limiting.

Anyone authorised to process your data is bound by confidentiality obligations.

You authorise us to use subprocessors for hosting, payments, email and AI processing. We impose equivalent data protection terms on them and will notify you of changes, giving you the right to object.

Where data leaves the UK or EEA we rely on adequacy decisions or the UK International Data Transfer Addendum and EU Standard Contractual Clauses.

We help you respond to data subject requests and notify you without undue delay, and within 48 hours, of becoming aware of a personal data breach affecting your data.

On termination we delete your data within 30 days unless the law requires retention. We make available the information needed to demonstrate compliance and allow reasonable audits on notice.