Data Processing Agreement
Our commitments when we process personal data on your behalf, including transfers from the EU and UK.
Draft for review. This agreement is a draft pending review by a Singapore-qualified lawyer. It is not final and may change before Everdeck launches.
This Data Processing Agreement ("DPA") forms part of the Terms of Service between FLOW FN PTE. LTD. (UEN 202617303Z) ("FLOW FN", "Processor") and the customer that uses Everdeck ("Customer", "Controller"). It applies whenever FLOW FN processes personal data in Customer Content on the Customer's behalf. Terms not defined here have the meaning given in the Terms of Service or in the applicable data protection law.
1. Roles
The Customer is the controller of personal data in Customer Content, or a processor acting for its own customers. FLOW FN is the Customer's processor, or sub-processor, and processes that data only to provide the Service.
"Data Protection Law" means every law that applies to the processing, including the Personal Data Protection Act 2012 of Singapore (PDPA), the EU General Data Protection Regulation (GDPR), the UK GDPR and the California Consumer Privacy Act (CCPA), as each applies.
2. Instructions
2.1 FLOW FN processes personal data only on the Customer's documented instructions. The Terms of Service, this DPA and the Customer's configuration of the Service, including the charters, tools, connections and approval policies it sets, are those instructions.
2.2 FLOW FN will tell the Customer if it believes an instruction breaks Data Protection Law, unless the law prohibits it.
2.3 Where the CCPA applies, FLOW FN acts as a service provider. It will not sell or share the personal data, or retain, use or disclose it outside the direct business relationship with the Customer or for any purpose other than providing the Service.
3. Confidentiality
FLOW FN ensures that everyone it authorises to process personal data is bound by confidentiality and accesses the data only as needed to provide, secure and support the Service.
4. Security
FLOW FN maintains the technical and organisational measures in Annex 2 and in our Security Overview. It may update them, provided the overall level of protection does not decrease.
5. Sub-processors
5.1 The Customer gives general authorisation for FLOW FN to engage sub-processors. The current list is on our Subprocessors page.
5.2 FLOW FN will give account owners at least 30 days' notice by email before it adds or replaces a sub-processor. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may end the affected part of the Service and receive a refund of prepaid fees for the period after it ends.
5.3 FLOW FN imposes data protection obligations on each sub-processor that are no less protective than this DPA, and remains responsible for their performance.
6. Assistance
6.1 Requests from individuals. FLOW FN will promptly pass on any request it receives from an individual about Customer Content, and will not respond to it except on the Customer's instructions. Taking into account the nature of the processing, FLOW FN will help the Customer respond, including through the deletion features of the Service and, where the Customer asks, by providing a copy of the relevant Customer Content.
6.2 Assessments and consultations. FLOW FN will give reasonable help with data protection impact assessments and consultations with regulators that relate to the Service.
7. Personal data breaches
7.1 FLOW FN will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Content.
7.2 The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of individuals and records affected, the likely consequences, and the measures taken or proposed. FLOW FN will add information as it becomes available and help the Customer meet its own notification duties, including to the Personal Data Protection Commission of Singapore and to supervisory authorities.
8. Return and deletion
When the Customer's subscription ends, its account stays available to read for 30 days, and FLOW FN will provide a copy of Customer Content in a machine-readable format if the Customer asks within that time. FLOW FN then deletes it, and backups expire within the periods in our Data Retention Schedule, unless the law requires FLOW FN to keep it.
9. Audits
FLOW FN will make available the information reasonably needed to demonstrate compliance with this DPA. If that information is not enough, the Customer may, at its own cost and no more than once a year, with at least 30 days' notice, audit FLOW FN's compliance through an independent auditor bound by confidentiality, in a way that does not disrupt the Service or put other customers' data at risk.
10. International transfers
10.1 FLOW FN stores Customer Content in Singapore. Some sub-processors may process limited data elsewhere, as listed on the Subprocessors page.
10.2 Where personal data is transferred out of Singapore, FLOW FN ensures that the recipient provides a standard of protection comparable to the PDPA.
10.3 Where the GDPR applies to a transfer from the European Economic Area to FLOW FN, the standard contractual clauses adopted by the European Commission in Decision 2021/914 are incorporated into this DPA: Module 2 where the Customer is a controller and Module 3 where it is a processor. Clause 7 (docking) applies; under Clause 9, option 2 (general authorisation) applies with the notice period in section 5.2; the option in Clause 11 does not apply; Clauses 17 and 18 select the law and courts of Ireland; and Annexes 1 and 2 of this DPA complete the clauses' annexes.
10.4 For transfers from the United Kingdom, the UK International Data Transfer Addendum to those clauses applies. For transfers from Switzerland, the clauses apply with the changes Swiss law requires.
11. Liability, governing law and precedence
Each party's liability under this DPA is subject to the limits in the Terms of Service, except where Data Protection Law does not allow them. This DPA is governed by the laws of Singapore, and disputes under it are resolved by SIAC arbitration seated in Singapore as the Terms of Service provide, except where the standard contractual clauses require otherwise. If this DPA and the Terms of Service conflict about personal data, this DPA prevails. If the standard contractual clauses conflict with either, the clauses prevail.
Annex 1: Details of the processing
| Item | Details |
|---|---|
| Subject matter | Providing Everdeck, a platform for AI agents that work on the Customer's tasks with the Customer's apps. |
| Duration | The term of the Customer's subscription, plus the 30 days after it ends and the deletion periods above. |
| Nature and purpose | Hosting, storage, retrieval, transmission to the AI model providers and apps the Customer chooses, search (including sending text to our embedding provider so it can be found by meaning), and other processing the Customer directs through the Service. |
| Individuals | The Customer's members and staff; and the Customer's own customers, suppliers, candidates and other contacts whose data appears in Customer Content. |
| Personal data | Names and contact details; messages, tasks and documents; records from connected apps, such as orders, tickets and CRM entries; and any other personal data the Customer chooses to process. |
| Special categories | None intended. The Customer must not process special categories of personal data without a lawful basis and appropriate safeguards. |
| Sub-processors | Listed on the Subprocessors page. |
Annex 2: Technical and organisational measures
- Location. Customer Content is stored in Singapore. Sub-processors outside Singapore receive only the data the Subprocessors page lists for them.
- Tenant isolation. Row-level security in the database binds every request to one account, and automated tests check that isolation before every release.
- Encryption. TLS for data in transit; encryption at rest; credentials sealed with AES-256-GCM under per-account data keys protected by AWS KMS.
- Access control. Mandatory two-factor authentication for every user; a fresh second-factor check for sensitive changes; role-based permissions; staff access that is read-only by default and logged.
- Logging. An append-only, hash-chained audit log of changes and agent actions; secrets removed from server logs.
- Agent safeguards. Tool allowlists, a policy check before every tool call, and approvals by a person for actions that move money, delete data or change permissions.
- Resilience. Managed database backups with point-in-time recovery, and tested restores.
- Incident response. A documented process for assessing and notifying personal data breaches.
- Development. Code review, automated tests, dependency vulnerability scans, and an independent penetration test before general availability.
Contact
Data protection questions and notices under this DPA: [email protected].