Data processing agreement

English translation provided for convenience. In case of any discrepancy, the Italian version prevails.

Annexed to the Flow service contract (terms of use accepted at checkout or signed contract for custom plans).

Parties

• Controller: the Customer, as identified in the service contract (the «Customer»).
• Processor: GRK Interactive S.r.l., via Bergognone 27, 20144 Milan (MI), Italy, tax code and VAT number 05814140967 («GRK»), which provides the Flow service.

1. Subject matter

GRK processes on behalf of the Customer the personal data contained in the documents, messages and information that the Customer and its users enter in Flow, for the sole purpose of providing the service described in the contract: storage, synchronisation, sharing, previews, search, editor, electronic signature, team chat and the KAi assistant.

2. Nature, purpose and duration

• Nature: storage, organisation, consultation, text extraction for search, generation of previews, transmission to the users and guests indicated by the Customer, erasure.
• Purpose: solely the provision of the service. No use for training models, profiling, marketing or analysing the contents for GRK's own purposes. The KAi suggestions record serves only to suggest automations to the user who turned them on for themselves: GRK does not make it available to the Customer and does not use it to monitor or assess work.
• Duration: that of the service contract, plus the time needed for return and deletion (section 11).

3. Categories of data and data subjects

• Data subjects: the Customer's users (employees, collaborators), guests and signatories invited by the Customer, persons mentioned in the documents.
• Data: users' account data (name, email, role), access and activity logs, file contents and their metadata, extracted text, chat messages, questions to the KAi assistant, signature request data and, for users who turn on KAi suggestions, the record of their operations on files (kept 90 days, deleted when turned off).
• Special categories (Art. 9): Flow does not require them; if the Customer uploads them in documents, they remain under its responsibility as controller and are protected like all other contents.

4. Customer's instructions

GRK processes the data only on documented instructions from the Customer. The contract, this agreement and the use of Flow's features (for example sharing a file, inviting a user, asking KAi) are the instructions. If it considers that an instruction infringes the law, GRK informs the Customer.

5. Confidentiality

The persons authorised by GRK to process the data are bound by confidentiality. Access to production systems is limited to the GRK technical staff who need it. GRK does not look at the Customer's contents except to provide the service, solve a problem reported by the Customer or comply with a legal obligation. Every access by GRK staff to a Customer's contents is recorded before it takes place, with the reason, the reference of the request and the duration; the record cannot be changed and, on request, GRK tells the Customer about the accesses concerning it.

6. Security

GRK adopts the technical and organisational measures described in Annex 2 (including: encrypted connections, encryption of backups before upload, encrypted folders, anti-virus checks, two-step verification, activity log).

7. Assistance to the Customer

GRK assists the Customer, as far as possible with Flow's features and with support, in responding to data subjects' requests (access, rectification, erasure, portability), in impact assessments and in consulting the authority, taking into account the nature of the processing.

8. Sub-processors

1. The Customer gives GRK general authorisation to engage the sub-processors in Annex 1.
2. GRK imposes on each sub-processor data protection obligations equivalent to this agreement and remains liable for their performance.
3. New sub-processor: GRK notifies the Customer by email at the address of the account contact at least 30 days before it starts processing the data.
4. Objection: within those 30 days the Customer may object in writing, on reasonable grounds relating to data protection. The parties seek a solution in good faith (for example not using that provider for the Customer's data, or turning off for it the feature that requires it).
5. If no solution is found, the Customer may withdraw from the service concerned without penalty, with a refund of the part of the fee already paid and not used. The contract does not lapse by itself: withdrawal is the Customer's choice.
6. Moving data from one data centre to another of the same sub-processor within the European Union is not a new sub-processor and does not require notice.
7. If the Customer chooses its own storage (BYO), that provider is chosen and contracted by the Customer and is not a sub-processor of GRK.

9. Transfers outside the European Union

The data is stored and processed in the European Union. Some sub-processors belong to groups with offices outside the EU: for any access from outside the EU the safeguards stated in Annex 1 apply (Commission standard contractual clauses, Data Privacy Framework). GRK does not transfer data outside the EU by its own choice without informing the Customer as in section 8.

10. Data breaches

GRK informs the Customer without undue delay, and in any case within 48 hours of becoming aware of it, of any personal data breach concerning it, with the information available and the information the Customer needs for its notifications to the authority and to the data subjects.

11. End of the service: return and deletion

During the contract, if the Customer moves to a plan that does not include a feature, the data produced by that feature remains for the period stated in the email GRK sends at that moment (normally 30 days), with a last notice before deletion; it is then deleted. Files are never deleted because of a change of plan. The rule is the same for all features, electronic signature included: signed documents are the Customer's files and contain the certification page with the evidence of the signature; the register of signature requests follows the general rule (Terms of use, sections 6 and 15).

At the end of the contract the Customer can export its data with Flow's features for the period stated in the end-of-service email (at least 30 days; Terms of use, section 15). GRK then deletes the data from the active systems; backup copies leave the retention cycle within the backup retention period, unless required by law. From that moment, keeping the documents, including signed ones, is the Customer's responsibility.

12. Audits

GRK makes available to the Customer the information needed to demonstrate compliance with this agreement and allows audits, including through an auditor appointed by the Customer, with reasonable notice, during working hours and without compromising the security of other customers.

13. Miscellaneous

In case of conflict between this agreement and the service contract, this agreement prevails as regards data protection. Italian law; courts of Milan, as in the terms of use.

Annex 1: Sub-processors

Stripe (payments) is not in this list: it processes the billing data of the relationship between GRK and the Customer, of which GRK is controller, not the data GRK processes on behalf of the Customer. It is listed in the privacy notice.

Annex 2: Technical and organisational measures

Access and identity

• Users sign in through Flow's identity service (single sign-on), on servers in the European Union; passwords, where used, are stored only as hashes (Argon2).
• Two-step verification for platform operators; for the Customer's users, where the plan includes it.
• Permissions by space and by folder decided by the Customer's administrators; separate roles for administrators and members.

Separation and confidentiality

• Each Customer's data is logically separated from that of other Customers in every table and every operation.
• Connections to the service always encrypted (HTTPS/TLS).
• File contents stored with the storage provider (Annex 1), encrypted at rest by the provider; in encrypted folders, contents are encrypted by Flow before upload, with per-folder keys kept encrypted.
• Service credentials and secrets stored encrypted with a master key kept outside the database.

Integrity and protection

• Anti-malware check of every uploaded file, archives included; a file that cannot be checked is not accepted (except password-protected PDFs and Office documents).
• Content fingerprint of every stored file, used to verify its integrity.
• Log of the Customer's activity (accesses, changes, shares) and a separate log of the platform operators' actions.

Availability and recovery

• Database backup at least daily, encrypted before upload, in a separate archive in the European Union (Annex 1), kept for the period stated in section 11.
• Backup restore tests run by the platform.
• Automatic check of the services every minute, from outside the infrastructure hosting them, with status and the history of the last 90 days published on status.kaigrid.ai.
• File version history and trash, according to the Customer's plan.

End of processing

• A single deletion rule for features no longer included in the plan and at the end of the contract (section 11), with notices to the Customer before deletion.

Organisation

• Access to production systems limited to the GRK technical staff who need it.
• Notification of data breaches to the Customer within 48 hours (section 10).
• List of sub-processors kept up to date and communicated with notice (section 8).