Data Processing Addendum

This Data Processing Addendum (DPA) forms part of the agreement between AIWON BUSINESS SERVICES LTD (trading as InflowQ, the Processor) and the customer that uses the InflowQ platform (the Controller). It applies to all Personal Data that InflowQ processes on the Controller's behalf in providing the service.

Capitalised terms not defined here have the meaning given in the UK GDPR and the Data Protection Act 2018 (together, Data Protection Law).

For Customer Data, the Customer is the Controller and InflowQ is the Processor. The Customer is responsible for having a lawful basis to collect the Personal Data it submits, for giving its own clients the required privacy information, and for the accuracy of that data.

• Subject matter: provision of the InflowQ client intake platform.
• Duration: the term of the agreement, plus any period needed to return or delete Customer Data.
• Nature and purpose: hosting, storing, retrieving and transmitting intake submissions and related account data so the Customer can run its intake process.
• Types of Personal Data: contact details, case or enquiry details and other information the Customer's clients submit through intake forms, plus Customer user account data.
• Categories of data subjects: the Customer's prospective and existing clients, and the Customer's staff users.

InflowQ will:

• process Customer Data only on the Controller's documented instructions, including the agreement and this DPA, unless required to do otherwise by law (in which case it will tell the Controller first where legally permitted);
• ensure that anyone authorised to process Customer Data is bound by confidentiality;
• implement appropriate technical and organisational security measures, including encryption in transit, access controls and logging;
• assist the Controller, taking into account the nature of processing, in responding to data subject requests;
• assist the Controller with security, breach notification, data protection impact assessments and prior consultation, as far as is reasonable;
• make available the information needed to demonstrate compliance with this DPA, and allow for reasonable audits on reasonable notice, no more than once a year unless required by a regulator or following a breach.

The Controller gives general authorisation for InflowQ to use sub-processors. Current sub-processors include Amazon Web Services (AWS) for cloud hosting and related infrastructure (including authentication, storage, databases and content delivery), primarily in the UK (London) region.

InflowQ will bind each sub-processor to data protection terms no less protective than this DPA and remains responsible for their performance. InflowQ will give notice of any new sub-processor, and the Controller may object on reasonable data protection grounds.

InflowQ primarily hosts and processes Customer Data in the UK. If Personal Data is transferred outside the UK, InflowQ will ensure an appropriate safeguard is in place, such as an adequacy decision, the UK International Data Transfer Addendum or Standard Contractual Clauses.

InflowQ will notify the Controller without undue delay after becoming aware of a Personal Data breach affecting Customer Data, and will provide the information reasonably needed for the Controller to meet its own notification duties.

When the agreement ends, InflowQ will, at the Controller's choice, return or delete Customer Data within a reasonable period, and delete existing copies unless the law requires storage. Backups are deleted in line with their normal rotation cycle.

Liability under this DPA is subject to the limitations in the main agreement. If this DPA conflicts with the main agreement on the processing of Personal Data, this DPA prevails. This DPA is governed by the laws of England and Wales.

To request a signed copy of this DPA, email privacy@inflowq.com.