Data Processing Agreement

2.1 Subject Matter.

Flowboost Industries B.V. processes Company Personal Data on behalf of the Client for the purpose of providing the Services as described in this DPA and the Agreement.

2.2 Nature and Purpose.

The nature and purpose of processing, the types of Personal Data, and the categories of Data Subjects are set out in Schedule 1 to this DPA.

2.3 Duration.

Flowboost Industries B.V. shall process Company Personal Data for the duration of the Agreement, unless otherwise agreed in writing or required by applicable law. Upon termination or expiry of the Agreement, Flowboost Industries B.V. shall handle Company Personal Data in accordance with Article 11 of this DPA.

4.1 General Authorisation.

The Client provides general authorisation to Flowboost Industries B.V. to engage Sub-processors for the purposes of providing the Services. The current list of approved Sub-processors is set out in Schedule 2 to this DPA. An up-to-date list of approved Sub-processors is available to Clients upon written request at [email protected].

4.2 New Sub-processors.

Flowboost Industries B.V. may add or replace Sub-processors at any time. An up-to-date list of approved Sub-processors is available upon written request at [email protected] in accordance with Article 4.1. The Client may object to any Sub-processor in writing at any time. If Flowboost Industries B.V. is unable to accommodate a reasonable, documented objection, the Client may terminate the Agreement or the relevant part of the Services with 30 days' written notice, without penalty.

4.3 Objection.

If the Client raises a reasonable, documented objection to a new Sub-processor and Flowboost Industries B.V. is unable to accommodate that objection, the Client may terminate the Agreement or the relevant part of the Services with 30 days' written notice, without penalty.

4.4 Sub-processor Obligations.

Flowboost Industries B.V. shall impose data protection obligations on each Sub-processor that are no less protective than those set out in this DPA. Flowboost Industries B.V. remains fully liable to the Client for the performance of each Sub-processor's obligations.

5.1 Assistance with Data Subject Requests.

Flowboost Industries B.V. shall, taking into account the nature of the processing, assist the Client by implementing appropriate technical and organisational measures to enable the Client to respond to requests from Data Subjects exercising their rights under Chapter III of the GDPR (including rights of access, rectification, erasure, restriction, portability, and objection).

5.2 Notification of Requests.

Flowboost Industries B.V. shall promptly notify the Client if it receives a Data Subject request in respect of Company Personal Data, and shall not respond to such request except on the documented instructions of the Client, or as required by applicable law.

6.1 Technical measures.

Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk of varying likelihood and severity to the rights and freedoms of natural persons, Flowboost Industries B.V. shall implement and maintain appropriate technical and organisational security measures, including:

1. encryption of Company Personal Data in transit and at rest;
2. ongoing confidentiality, integrity, availability, and resilience of processing systems and services;
3. the ability to restore availability and access to Company Personal Data in a timely manner in the event of a physical or technical incident;
4. a process for regularly testing, assessing, and evaluating the effectiveness of technical and organisational measures for ensuring the security of processing;
5. access controls ensuring that Company Personal Data is accessible only to authorised personnel on a need-to-know basis;
6. pseudonymisation of Company Personal Data where appropriate and reasonably practicable.

6.2 Confidentiality obligations.

Flowboost Industries B.V. shall take reasonable steps to ensure that any staff with access to Company Personal Data are subject to appropriate confidentiality obligations.

6.3 Processing on Documented Instructions.

Flowboost Industries B.V. shall ensure that any staff authorised to process Company Personal Data do so only in accordance with the documented instructions of the Client and the terms of this DPA.

7.1 Notification Obligation.

Flowboost Industries B.V. shall notify the Client without undue delay, and in any event within 72 hours of becoming aware, of any Personal Data Breach affecting Company Personal Data.

7.2 Content of Notification.

Such notification shall include, to the extent then available:

1. a description of the nature of the Personal Data Breach, including where possible the categories and approximate number of Data Subjects affected and records concerned;
2. the name and contact details of the data protection contact at Flowboost Industries B.V.;
3. a description of the likely consequences of the Personal Data Breach; and
4. a description of the measures taken or proposed to address the breach, including, where appropriate, measures to mitigate its possible adverse effects.

7.3 Phased Notification.

Where all information required under Article 7.2 is not available at the time of initial notification, Flowboost Industries B.V. shall provide the remaining information in phases without undue delay.

7.4 Cooperation and Remediation.

Flowboost Industries B.V. shall cooperate with the Client and take reasonable steps to assist in the investigation, mitigation, and remediation of any Personal Data Breach. Flowboost Industries B.V. will provide the Client with sufficient information to enable the Client to meet its own notification obligations under applicable Data Protection Laws.

8.1 DPIA Assistance.

Flowboost Industries B.V. shall provide reasonable assistance to the Client with any data protection impact assessments (DPIAs) and prior consultations with Supervisory Authorities or other competent data privacy authorities which the Client reasonably considers to be required under Articles 35 and 36 of the GDPR, in each case solely in relation to the processing of Company Personal Data by Flowboost Industries B.V. and taking into account the nature of the processing and the information available to Flowboost Industries B.V.

8.2 Proactive DPIA Notification.

Where Flowboost Industries B.V. becomes aware that a new processing activity is likely to require a DPIA under Article 35 GDPR, it shall inform the Client accordingly.

9.1 Information and Compliance Evidence.

Flowboost Industries B.V. shall make available to the Client, upon reasonable written request, all information reasonably necessary to demonstrate compliance with the obligations set out in this DPA and Article 28 GDPR.

9.2 Audit and Inspection Rights.

Flowboost Industries B.V. shall allow for and contribute to audits and inspections conducted by the Client or a mandated third-party auditor, provided that:

1. the Client provides at least 30 days' prior written notice of any audit;
2. audits are conducted during normal business hours and in a manner that minimises disruption to Flowboost Industries B.V.'s operations;
3. the auditor is bound by appropriate confidentiality obligations; and
4. the costs of the audit are borne by the Client, unless the audit reveals a material breach of this DPA by Flowboost Industries B.V.

9.3 Certifications as Audit Equivalent.

Flowboost Industries B.V. may satisfy audit obligations in whole or in part by providing relevant security documentation or internal audit reports where available.

10.1 EU Data Residency.

Flowboost Industries B.V. stores and processes Company Personal Data within the European Economic Area (EEA) by default, using infrastructure hosted in the EU (primarily Google Cloud, Netherlands region).

10.2 Transfers Outside the EEA.

Where the use of a Sub-processor requires a transfer of Company Personal Data to a country outside the EEA that does not benefit from an adequacy decision under Article 45 GDPR, Flowboost Industries B.V. shall ensure that such transfer is subject to appropriate safeguards, including:

1. Standard Contractual Clauses (SCCs) adopted by the European Commission under Article 46(2)(c) GDPR; or
2. any other transfer mechanism recognised as valid under applicable Data Protection Laws.

10.3 Sub-processor Transfer Mechanisms.

The applicable transfer mechanisms for each Sub-processor are set out in Schedule 2.

11.1 Return or Deletion Upon Termination.

Upon termination or expiry of the Agreement, Flowboost Industries B.V. shall, at the Client's choice:

1. make Company Personal Data available for export via the Portal for a period of 30 days following termination; and/or
2. securely delete or anonymise all Company Personal Data within 30 days of the end of the export period.

11.2 Confirmation of Deletion.

Flowboost Industries B.V. shall confirm the completion of deletion in writing upon the Client's reasonable request, subject to any legally mandated retention obligations.

11.3 Legally Mandated Retention.

Notwithstanding the above, Flowboost Industries B.V. may retain Company Personal Data to the extent required by applicable law (including Dutch fiscal law requiring retention of financial records for seven years), in which case Flowboost Industries B.V. shall ensure that such data is processed only for the purposes required by applicable law and is protected by appropriate security measures.

11.4 Sub-processor Deletion Obligations.

Flowboost Industries B.V. shall ensure that Sub-processors delete or return Company Personal Data in accordance with this Article upon termination of the relevant sub-processing arrangement.

12.1 Relationship with Agreement.

This DPA forms part of and is subject to the Agreement. In the event of any conflict between this DPA and the General Terms and Conditions in respect of data processing matters, this DPA shall prevail.

12.2 Confidentiality.

Each party shall keep the terms of this DPA and any information received about the other party in connection with it confidential, except to the extent required by applicable law or as necessary to perform obligations under this DPA.

12.3 Liability.

Each party's liability under this DPA is subject to the limitations and exclusions set out in Article 11 of the General Terms and Conditions, except to the extent that applicable Data Protection Laws impose greater liability.

12.4 Notices.

All notices under this DPA shall be given in accordance with Article 18.4 of the General Terms and Conditions.

12.5 Amendments.

Flowboost Industries B.V. may update this DPA to reflect changes in Data Protection Laws or its processing activities, with at least 30 days' prior written notice to the Client.

12.6 Governing Law.

This DPA is governed by Dutch law. Any disputes arising in connection with this DPA shall be subject to the exclusive jurisdiction of the District Court of Rotterdam (Rechtbank Rotterdam).