1. Scope and roles
This DPA forms part of the GridFlow agreement where GridFlow processes personal data on behalf of a customer. The customer is controller and GridFlow is processor for that customer data. GridFlow remains an independent controller for accounts, security, commerce, support, legal compliance and its own service operations.
2. Processing details
3. Customer instructions
GridFlow will process customer personal data only on documented instructions in the agreement and normal product use, including authorised integration and AI requests, unless law requires otherwise. If an instruction appears unlawful, GridFlow may pause it and inform the customer. The customer is responsible for lawful collection, notices, bases, user permissions and outreach instructions.
4. Confidentiality and security
People authorised to process customer data are bound by confidentiality. GridFlow maintains proportionate technical and organisational measures including tenant-scoped database policies, server-side authorisation, encrypted provider credentials, token hashing, MFA support, trusted-device limits, input/body limits, rate controls, audit trails, protected transport, backup/restore procedures, vulnerability checks and incident response. Measures may evolve without materially reducing protection.
5. Subprocessors and transfers
The customer generally authorises the subprocessors listed in the public Subprocessor List for the stated services. GridFlow will provide reasonable notice of a material new subprocessor and consider a reasoned data-protection objection. GridFlow remains responsible for required processor obligations in its subprocessor contracts. Restricted international transfers will use a valid UK mechanism where required.
6. Assistance
Taking account of the processing and information available, GridFlow will reasonably assist with data-subject requests, security, breach notifications, data-protection impact assessments and regulator consultations. Customer-facing export, correction, suppression, integration disconnect and closure workflows support this assistance. Additional bespoke work may be chargeable if lawful and agreed.
7. Incidents
GridFlow will notify the customer without undue delay after becoming aware of a personal-data breach affecting customer data and provide available information needed for the customer’s assessment. Notification is not an admission of fault. The customer controls notifications for breaches where it is controller, unless law requires GridFlow to notify directly.
8. Return and deletion
On closure, GridFlow will delete or return customer data according to the agreement and Retention Schedule unless law requires retention. Protected backups are isolated from normal use and expire through rotation. Limited transaction, suppression, acceptance or security evidence may be retained as controller data where necessary and lawful.
9. Audit information
GridFlow will provide information reasonably necessary to demonstrate these obligations. Audits should first use current security documentation and evidence; an on-site or intrusive audit requires reasonable notice, confidentiality, minimal disruption and agreement on scope and cost. GridFlow may refuse access that would weaken another customer’s security or reveal protected secrets.
10. Priority and law
This DPA prevails over conflicting general terms for processor obligations. UK GDPR terms have their statutory meanings. The governing-law and dispute provisions in the Terms apply unless mandatory data-protection law requires otherwise.
Contact
GridFlow Support
gridflowsupport@gmail.com