Data Processing Agreement (DPA)

§ 1 Subject Matter and Duration of Processing

1.1 Subject matter

FlowToo processes personal data on behalf of the Client within the scope of providing the SaaS platform "FlowToo". The platform offers AI-powered customer service automation for Shopify stores, in particular:

• Ticket inbox and automated handling of customer support inquiries
• AI-powered analysis and answering of support tickets
• Returns management
• Retention functions
• WISMO tracking (Where Is My Order)
• Cancellation handling
• Admin dashboard for managing support processes
• Integration with the Client's Shopify store for retrieving order and customer data

1.2 Duration

The term of this DPA follows the term of the main contract. The DPA begins with the Client's registration and ends upon complete termination of the main contract and completed deletion of all data processed on behalf of the Client in accordance with § 11.

§ 2 Nature and Purpose of Processing

Processing takes place exclusively for the provision of the contractually agreed services:

• Email/ticket processing: receipt, storage and automated answering of customer support inquiries
• AI-powered analysis: processing of ticket contents for categorisation and generation of response suggestions via the Base44 platform
• E-commerce data retrieval: retrieval of order, shipping and customer data from the Client's Shopify store
• Shipment tracking: querying of tracking status via 17TRACK for returns/WISMO functions
• Payment processing: management of the FlowToo subscription via Stripe (primarily concerns the Client themselves, not their end customers)
• Email sending: sending of automated support responses via Mailgun

Processing takes place on the documented instruction of the Client pursuant to Art. 28 (3) (a) GDPR. The main contract and the use of the platform functions are deemed to constitute documented instructions.

§ 3 Types of Personal Data

3.1 Data of the Client's end customers

• Contact data: name, email address, telephone number and address where applicable
• Communication contents: ticket/email contents, attachments
• Order data: order numbers, order status, shipping information, product information
• Return data: return reasons, return status
• Tracking data: shipment numbers, shipping status

3.2 Data of the Client's employees

• Access data: name, email address, role within the organisation
• Usage data: activity logs within the admin dashboard

Note: As a rule, no special categories of personal data pursuant to Art. 9 GDPR are processed, unless such data is unintentionally contained in ticket contents. The Client is obliged to inform their end customers accordingly.

§ 4 Categories of Data Subjects

• End customers of the Client who communicate with the Client's support by email/ticket
• Purchasers in the Client's Shopify store
• Employees of the Client who use FlowToo

§ 5 Obligations of the Processor

5.1 Adherence to instructions

FlowToo processes personal data exclusively on the documented instruction of the Client (Art. 28 (3) (a) GDPR), unless a legal obligation exists. FlowToo will inform the Client without undue delay if, in its own assessment, an instruction violates data protection law.

5.2 Confidentiality

FlowToo ensures that all persons with access to the data are committed to confidentiality. This obligation continues to apply after the end of the engagement.

5.3 Support of the Client

FlowToo supports the Client in fulfilling data subject rights (Chapter III GDPR) and in the obligations under Art. 32–36 GDPR (security, data breach notification, impact assessment).

5.4 Contact

Data protection inquiries: info@flowtoo.de

§ 6 Technical and Organisational Measures (TOMs)

FlowToo employs the following measures pursuant to Art. 32 GDPR:

6.1 Platform security

FlowToo runs on the infrastructure of Base44, Inc. Base44 is certified to SOC 2 Type II and ISO 27001 and is GDPR compliant. This includes in particular:

• Encryption of data transmission and storage
• Access controls in accordance with best-practice standards
• Regular penetration tests and external security audits (by Base44)

6.2 FlowToo's own measures

• Password-protected access to the admin dashboard
• Access restriction to authorised employees/agents
• Regular review of the sub-processors used regarding the currency of their security standards

§ 7 Sub-Processors (Subcontractors)

7.1 Authorisation

The Client hereby grants its general authorisation for the engagement of the sub-processors listed below pursuant to Art. 28 (2) GDPR.

7.2 Current sub-processors

7.3 Right to object

FlowToo will inform the Client by email of planned changes regarding sub-processors at least 14 days before their engagement. The Client may object within 7 days of receipt on justified data protection grounds.

§ 8 Rights of Data Subjects

FlowToo supports the Client in fulfilling requests from data subjects (Art. 15–22 GDPR). If a data subject contacts FlowToo directly, the request will be forwarded to the Client without undue delay; FlowToo does not decide on such requests independently.

§ 9 Audit Rights of the Client

Upon request, FlowToo will provide the Client with the information necessary to demonstrate compliance with this DPA, including by reference to Base44's certifications (SOC 2, ISO 27001). On-site audits are possible after prior notice (at least 30 days) during normal business hours; the costs are borne by the Client unless violations are found.

§ 10 Notification of Personal Data Breaches

FlowToo will inform the Client without undue delay, but at the latest within 48 hours of becoming aware, of any personal data breach in connection with the data processing. The notification will contain a description of the nature of the breach, the categories of data concerned, the likely consequences and the countermeasures taken.

§ 11 Deletion and Return of Data

After termination of the main contract or upon request, FlowToo will delete all personal data processed on behalf of the Client within 30 days, unless a statutory retention obligation prevents this (e.g. invoice data: 10 years in accordance with tax law requirements). FlowToo will confirm the deletion in writing upon request.

§ 12 Third-Country Transfers

Insofar as data is transferred to countries outside the EU/EEA, the following applies:

• USA (Base44 and its sub-processors, Mailgun, Stripe): transfer on the basis of the EU-US Data Privacy Framework (DPF), in which Base44 actively participates, supplemented by Standard Contractual Clauses (SCCs)
• Israel (Wix.com Ltd. as Base44's parent company): the EU Commission has issued an adequacy decision for Israel (Art. 45 GDPR) — equivalent level of protection without an additional mechanism being required
• China (17TRACK, Shenzhen): as no adequacy decision exists for China, the transfer takes place on the basis of EU Standard Contractual Clauses plus additional technical safeguards. Only tracking numbers and shipping status are transmitted, no names or addresses of end customers.
• Canada (Shopify, depending on configuration): adequacy decision of the EU Commission

§ 13 Liability

The liability of the parties is governed by Art. 82 GDPR. FlowToo is liable for damage caused by breach of the GDPR obligations specifically imposed on the processor or by acting contrary to instructions.

§ 14 Obligations of the Client

The Client is responsible for:

• the lawfulness of the data processing (legal basis vis-à-vis their end customers)
• informing their end customers about the processing by FlowToo (Art. 13/14 GDPR)
• maintaining a record of processing activities (Art. 30 GDPR) covering the data processing by FlowToo

§ 15 Final Provisions

15.1 In the event of contradictions between this DPA and other agreements, this DPA takes precedence insofar as data protection is concerned.

15.2 Should individual provisions be invalid, the remainder of the agreement remains valid.

15.3 German law applies. The place of jurisdiction is, to the extent legally permissible, the registered office of the Processor (Würzburg).

15.4 Amendments require text form; material amendments will be communicated by email at least 30 days before they take effect.