Data Processing Agreement (DPA)

Section 1 — Subject matter, nature and purpose of the processing

1. The subject matter of the assignment is the processing of personal data by the Processor for the Controller in connection with the provision and operation of flow present.
2. The nature, scope and purpose of the processing, the type of personal data as well as the categories of data subjects are set out conclusively in Annex 1.
3. The processing takes place exclusively within the European Union or the European Economic Area, unless expressly provided otherwise in Annex 3.

Section 2 — Duration of the assignment

The agreement begins with the Controller’s registration or first use of the service and runs for an indefinite period. It ends automatically upon termination of the usage relationship (deletion of the account or organisation). The provisions on deletion and return (Section 9) remain effective beyond the end of the agreement.

Section 3 — Right of instruction of the Controller

1. The Processor processes personal data solely on the documented instructions of the Controller, including with regard to transfers to third countries, unless it is required to process such data by Union or Member State law.
2. Use of the service in accordance with the documentation and the configuration settings that have been made is deemed to be a documented instruction. Individual instructions are given in text form to datenschutz@flowpresent.org.
3. The Processor shall inform the Controller without undue delay if, in its opinion, an instruction infringes data-protection provisions. It is entitled to suspend the execution of the instruction concerned until it is confirmed or amended.

Section 4 — Obligations of the Processor

The Processor undertakes in particular:

• to carry out the processing solely within the scope of this agreement and the instructions of the Controller;
• to ensure that persons authorised to process the data have committed themselves to confidentiality, unless they are already under an appropriate statutory obligation of confidentiality (Art. 28(3)(b), Art. 29, Art. 32(4) GDPR);
• to implement and maintain the technical and organisational measures pursuant to Art. 32 GDPR in accordance with Annex 2;
• to assist the Controller, to the extent possible, in fulfilling its obligations under Art. 32–36 GDPR (Section 6);
• to provide a data-protection contact for data-protection enquiries (datenschutz@flowpresent.org); there is currently no statutory obligation to designate a data protection officer;
• to maintain a record of all categories of processing activities carried out on behalf of the Controller pursuant to Art. 30(2) GDPR;
• to inform the Controller without undue delay if a supervisory authority takes action against the Processor, insofar as this concerns the processing carried out on behalf of the Controller.

Section 5 — Technical and organisational measures (Art. 32 GDPR)

1. The Processor implements the technical and organisational measures described in Annex 2 to protect the personal data and maintains them for the duration of the agreement.
2. The measures are subject to technical progress. The Processor is entitled to develop them further, provided that the agreed level of protection is not undercut. Material changes are documented.

Section 6 — Assistance obligations

1. The Processor assists the Controller, by appropriate technical and organisational measures, in responding to requests by data subjects to exercise their rights (Art. 12–23 GDPR). If a data subject contacts the Processor directly, the Processor forwards the request to the Controller without undue delay.
2. The Processor assists the Controller in complying with the obligations under Art. 32–36 GDPR (data security, notification of breaches, data protection impact assessment, prior consultation), taking into account the nature of the processing and the information available to it.

Section 7 — Notification of personal data breaches

The Processor shall notify the Controller of any personal data breach that comes to its attention affecting data processed on behalf of the Controller without undue delay — as a rule within 48 hours of becoming aware of it. The notification shall contain at least the information required under Art. 33(3) GDPR, insofar as available. The notification to the supervisory authority pursuant to Art. 33 GDPR as well as, where applicable, the communication to the data subjects pursuant to Art. 34 GDPR is the responsibility of the Controller.

Section 8 — Sub-processing

1. The Controller consents to the use of the sub-processors listed in Annex 3 (general written authorisation pursuant to Art. 28(2) GDPR).
2. The Processor shall inform the Controller in advance in text form (e.g. by email or via a published list at flowpresent.org) of any intended changes concerning the addition or replacement of sub-processors. The Controller may object to a change within 14 days on important data-protection grounds; in the event of an objection, the parties are obliged to reach an amicable solution, failing which the Controller has a right of termination.
3. The Processor shall contractually bind each sub-processor to data-protection obligations equivalent to those of this agreement (Art. 28(4) GDPR). Where a sub-processor breaches its data-protection obligations, the Processor remains liable to the Controller as for its own conduct.
4. Ancillary services (telecommunications, maintenance or comparable services) as well as optional third-party services that are only triggered by a separate action of the Controller or the participants (see Annex 3, Section B) do not constitute sub-processing within the meaning of this agreement.

Section 9 — Deletion and return after the end of the agreement

1. Upon completion of the processing, the Processor shall delete all personal data processed on behalf of the Controller or return it, at the Controller’s choice, unless a statutory retention obligation exists.
2. The Controller may export its data itself at any time during the term of the agreement. Upon deletion of the account or organisation via the settings, the associated content and uploaded files are removed immediately.
3. Statutory retention obligations (in particular for billing data) remain unaffected; such data is blocked for the duration of the statutory periods and subsequently deleted.

Section 10 — Rights of monitoring and verification

1. The Processor makes available to the Controller all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR and allows for and contributes to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller.
2. Proof may also be provided by means of appropriate certifications, current audit reports or reports of independent bodies (e.g. ISO 27001 of the infrastructure providers used) as well as by a documented self-assessment.
3. On-site inspections shall be carried out with reasonable advance notice, during normal business hours and without disrupting operations.

Section 11 — Final provisions

1. Amendments and supplements to this agreement require text form. This also applies to any amendment of this clause.
2. In the event of contradictions between this agreement and other agreements of the parties, the provisions of this agreement prevail on data-protection matters.
3. Should individual provisions be invalid, the validity of the remaining provisions shall remain unaffected. The parties shall replace the invalid provision with a valid one that comes as close as possible to its economic purpose.
4. The law of the Federal Republic of Germany applies.

1. Confidentiality

• Physical access control: operation in ISO 27001-certified data centres of the infrastructure providers used (AWS region eu-central-1, Frankfurt); no own physical server operation.
• System access control: passwordless authentication via magic link (no password storage); session cookies httpOnly and Secure.
• Data access control: role- and organisation-based access restriction; data accessible exclusively to the respective team; separation at database level.
• Separation control: multi-tenant data storage, logical separation of data per organisation.
• Pseudonymisation: participant responses are stored via a random, device-bound key without any link to a user account.

2. Integrity

• Transmission control: transport encryption (TLS) for all data transfers; encryption of data at rest at infrastructure level.
• Input control: traceable editing of collaborative documents; logging of relevant system and access events.

3. Availability and resilience

• Regular data backup by the infrastructure service providers used.
• Monitoring of stability and security; error and outage detection.
• Redundant, scalable cloud infrastructure.

4. Procedures for regular review, assessment and evaluation

• Data protection by design and by default (Art. 25 GDPR): data minimisation, no advertising trackers, no usage profiles for advertising purposes.
• Assignment control: contractual binding of all sub-processors; review of the protective measures taken.
• Incident management process for handling security incidents.