Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between GenticFlow Ltd. ("Processor", "we", "us") and the customer ("Controller", "you") and governs the processing of personal data in connection with the GenticFlow Service.

1. Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion.
• "Data Subject" means the individual to whom Personal Data relates.
• "GDPR" means the General Data Protection Regulation (EU) 2016/679.
• "SCCs" means the Standard Contractual Clauses approved by the European Commission for international data transfers.
• "Subprocessor" means any third party engaged by GenticFlow Ltd. to process Personal Data on behalf of the Controller.

2. Roles and Responsibilities

2.1 Controller

You (the customer) are the Data Controller for:

• Customer Data you upload or input into the Service
• Device Diagnostic Data collected by endpoint agents you deploy
• Personal data of your employees, contractors, and end-users

As Controller, you are responsible for:

• Ensuring lawful basis for processing (consent, legitimate interest, contract, etc.)
• Providing required notices to Data Subjects
• Responding to Data Subject requests (with our assistance)
• Ensuring compliance with applicable data protection laws

2.2 Processor

GenticFlow Ltd. acts as Data Processor and will:

• Process Personal Data only on your documented instructions
• Ensure personnel are bound by confidentiality obligations
• Implement appropriate technical and organizational security measures
• Assist you in responding to Data Subject requests
• Delete or return Personal Data upon termination (at your choice)
• Make available information necessary to demonstrate compliance

3. Data Processing Details

3.1 Subject Matter and Purpose

Processing is performed to provide the GenticFlow Ltd. IT support and automation platform, including endpoint management, diagnostics, remote support, and workflow automation.

3.2 Duration

Processing continues for the duration of your subscription plus any retention period required by law or as specified in the Terms of Service.

3.3 Categories of Data Subjects

• Your employees and contractors
• End-users of managed endpoints
• IT administrators and technicians
• Your customers (if using client portal features)

3.4 Types of Personal Data

• Contact information (names, email addresses, phone numbers)
• Account credentials and authentication data
• Device identifiers and hostnames
• IP addresses and network information
• System logs and diagnostic data
• User activity within the Service
• Support ticket content and communications

4. Security Measures

GenticFlow Ltd. implements the following security measures:

4.1 Technical Measures

• Encryption of data in transit using TLS
• Application-layer encryption of sensitive fields with per-tenant key separation
• Two-factor authentication for administrative access (TOTP and FIDO2 passkeys)
• Role-based access controls
• Intrusion detection and monitoring systems
• Automated vulnerability scanning
• Secure software development lifecycle

4.2 Organizational Measures

• Background checks for staff with production access
• Security awareness training
• Confidentiality agreements
• Incident response procedures
• Business continuity and disaster recovery plans
• Vendor security assessments

5. Subprocessors

5.1 Authorization

You authorize GenticFlow Ltd. to engage Subprocessors to assist in providing the Service. We maintain contracts with all Subprocessors that impose data protection obligations substantially similar to this DPA.

5.2 Current Subprocessors

This list covers Subprocessors that process Customer Personal Data. Supporting vendors that do not access Customer Personal Data (for example certificate issuance or secret management providers) are not Subprocessors and are documented in our security documentation.

5.3 Changes to Subprocessors

We will notify you of any intended changes to Subprocessors at least 30 days in advance. You may object to a new Subprocessor by providing written notice within 14 days. If we cannot reasonably accommodate your objection, you may terminate the affected services.

6. International Data Transfers

When Personal Data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place:

• Adequacy Decisions: Transfers to countries with EU adequacy decisions require no additional safeguards.
• EU-U.S. Data Privacy Framework: For transfers to US providers certified under the EU-U.S. Data Privacy Framework (DPF), we may rely on the DPF, which is covered by a European Commission adequacy decision.
• Standard Contractual Clauses: For transfers to other countries, or where a provider is not DPF-certified, we rely on SCCs approved by the European Commission.
• Supplementary Measures: Where required, we implement additional technical and organizational measures to ensure adequate protection.

Upon request, we will provide copies of relevant SCCs and information about supplementary measures.

7. Data Subject Rights

We will assist you in responding to Data Subject requests to exercise their rights under GDPR, including:

• Right of access
• Right to rectification
• Right to erasure ("right to be forgotten")
• Right to restriction of processing
• Right to data portability
• Right to object

If we receive a request directly from a Data Subject, we will promptly notify you unless prohibited by law.

8. Data Breach Notification

In the event of a confirmed Personal Data breach affecting Personal Data we process on your behalf, GenticFlow Ltd. will:

• Notify you without undue delay (and in any event within 72 hours) after becoming aware of the breach
• Provide information about the nature of the breach, categories of data affected, and approximate number of Data Subjects
• Describe likely consequences and measures taken or proposed to address the breach
• Cooperate with your investigation and regulatory notifications
• Document all breaches, including facts, effects, and remedial actions

9. Audits and Compliance

9.1 Audit Rights

Upon reasonable notice, you may audit our compliance with this DPA. Before requesting an audit, you agree to first review the security documentation and attestations made available under Section 9.2; an audit may be requested to the extent that documentation does not reasonably demonstrate compliance. Audits shall be conducted during normal business hours, no more than once per year (unless required by regulatory authority), and subject to confidentiality obligations. Any audit is at your sole expense, and we may charge reasonable fees for the staff time required to support it.

9.2 Certifications

GenticFlow Ltd. will provide its Technical and Organizational Measures (TOMs) documentation upon request as part of customer security reviews. Additional security documentation and attestations are available under NDA.

10. Data Retention and Deletion

10.1 During Subscription

We retain Personal Data for the duration of your subscription as necessary to provide the Service.

10.2 Upon Termination

Upon termination of your subscription, we will:

• Provide you with the ability to export your data for 30 days
• Delete Personal Data within 90 days of termination, unless retention is required by law
• Provide written certification of deletion upon request

10.3 Backup Retention

Backup copies may be retained for up to 180 days for disaster recovery purposes, after which they will be securely deleted.

11. Liability

Each party's liability under this DPA is subject to the limitations set forth in the Terms of Service. Nothing in this DPA limits either party's liability for breaches of data protection law to the extent such limitation is not permitted under applicable law.

12. Conflict

In the event of any conflict between this DPA and the Terms of Service, this DPA shall prevail with respect to data protection matters. In all other respects, the Terms of Service shall govern.

13. Term and Termination

This DPA remains in effect for as long as GenticFlow Ltd. processes Personal Data on your behalf. The obligations in this DPA survive termination to the extent necessary to complete deletion of Personal Data and fulfill legal requirements.

14. Amendments

We may update this DPA to reflect changes in law, regulatory guidance, or our processing activities. Material changes will be notified at least 30 days in advance. Continued use of the Service constitutes acceptance of the updated DPA.

15. Contact

For questions about this DPA or to exercise your rights:
GenticFlow Ltd.
Data Protection Officer: [email protected]
Legal: [email protected]

Appendix A: Standard Contractual Clauses

Where required for international data transfers, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) are incorporated by reference. Module Two (Controller to Processor) applies to transfers of Customer Data.

The following applies to the SCCs:

• Clause 7 (Docking clause): Not used
• Clause 9 (Subprocessors): Option 2 (general authorization with 30-day notice)
• Clause 11 (Redress): Optional clause not used
• Clause 17 (Governing law): Laws of Ireland
• Clause 18 (Forum): Courts of Ireland

A fully executed copy of the SCCs is available upon request.