Legal
Data Processing Addendum
Effective: July 21, 2026
This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Customer and GAASFlow when GAASFlow processes personal data on Customer’s behalf in providing the Service.
1. Roles
Customer is the controller (or processor acting for its client controllers) of Customer personal data. GAASFlow is a processor (or sub-processor) processing personal data only on Customer’s documented instructions as embodied in the Service configuration and these Terms.
2. Nature and purpose of processing
Processing includes hosting, storage, retrieval, transmission, display, backup, security logging, and support access as needed to provide multi-tenant engagement software to Customer’s authorized users.
3. Categories of data subjects
Customer personnel; optionally client personnel appearing in engagement files Customer chooses to upload (e.g., names in PBC items or correspondence).
4. Categories of personal data
Identification and contact data, authentication data, professional role data, and any personal data contained in Customer Data Customer elects to store in the Service.
5. Duration
For the term of the subscription/trial and any post-termination retention period required for export, dispute resolution, or law.
6. Sub-processors
Customer authorizes GAASFlow to engage infrastructure and operational sub-processors (including cloud hosting and email delivery) under written agreements imposing data protection obligations no less protective than this DPA. A current sub-processor summary is available on request (Support@GAASFlow.com).
7. Security
GAASFlow implements technical and organizational measures appropriate to the risk, including encryption in transit, access controls, tenancy isolation, and credential hashing, as further described at /security.
8. Assistance
Taking into account the nature of processing, GAASFlow will reasonably assist Customer with data subject requests, security incidents affecting Customer Data, and information needed for Customer’s own compliance assessments (Support@GAASFlow.com).
9. Deletion or return
Upon termination, Customer may export Customer Data using available product features. Upon written request, GAASFlow will delete or return Customer Data within a commercially reasonable period, except copies retained as required by law or for legitimate backup integrity (which will remain protected and then purged on schedule).
10. International transfers
Where personal data is transferred internationally, parties will ensure an appropriate transfer mechanism is in place as required by applicable law.
Contact: Support@GAASFlow.com · Related: Privacy Policy