Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between GenticFlow Ltd. ("we", "us") and the organization subscribing to the GenticFlow Service ("you"). It governs Personal Data we process on your behalf, including where you provide managed IT services to other organizations. The contracting provider is GenticFlow Ltd., not its individual officers, directors, employees, or shareholders.

1. Definitions

• "Applicable Data Protection Law" means privacy, data protection, and data breach notification laws and binding regulations applicable to the processing under this DPA, including, where applicable, the GDPR, UK GDPR and UK Data Protection Act 2018, and US State Privacy Laws, as amended or replaced.
• "US State Privacy Laws" means applicable US state privacy statutes and their binding regulations, including the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"), the Virginia Consumer Data Protection Act, Colorado Privacy Act, Connecticut Data Privacy Act, Utah Consumer Privacy Act, and other applicable state privacy laws. Each law applies only to the extent its scope and requirements cover the relevant processing.
• "Personal Data" means information relating to an identified or identifiable natural person and includes personal information, sensitive personal information, and sensitive data as defined by Applicable Data Protection Law, including information linked or reasonably linkable to a consumer or household where that law so provides.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion.
• "Data Subject" means the individual to whom Personal Data relates and includes a consumer under applicable US State Privacy Laws.
• "GDPR" means the General Data Protection Regulation (EU) 2016/679.
• "UK GDPR" means the GDPR as incorporated into UK law and amended from time to time.
• "Controller" and "Processor" have the meanings given by Applicable Data Protection Law. "Business", "Service Provider", "Contractor", "Sell", and "Share" have the meanings given by the CCPA where it applies; "targeted advertising" has the meaning given by the applicable US State Privacy Law. These terms do not assign a statutory role where the law or facts do not support it.
• "MSP" means an organization using the Service to provide managed IT services to third-party clients ("MSP Clients").
• "SCCs" means the Standard Contractual Clauses approved by the European Commission for international data transfers.
• "Subprocessor" means a third party engaged by us to process Personal Data on your behalf, including a further processor or subcontracted Service Provider where applicable.
• "Personal Data Breach" means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data we process on your behalf.

2. Roles and Responsibilities

2.1 Your Capacity and Authority

The parties' roles are determined for each processing activity:

• Internal IT: Where you determine the purposes and means of processing for your own organization, you act as Controller and, where applicable, Business. We act as Processor and, where applicable, Service Provider or Contractor.
• Managed IT Services: Where you process Personal Data on an MSP Client's behalf, you act as its Processor or Service Provider and we act as your Subprocessor or subcontracted Service Provider, as applicable. The MSP Client or another upstream organization remains the Controller or Business.
• Multiple Roles: An MSP may also act as Controller for separate processing, such as managing its own workforce. Being an MSP does not by itself determine your role for all Personal Data.

You represent and warrant that you have authority to enter into this DPA and give the instructions it describes. You are responsible, within your role, for:

• Establishing the required lawful grounds and ensuring legally required notices, permissions, and consents are in place for agent deployment, monitoring, integrations, AI-assisted support, and other instructed processing
• Where you act for an MSP Client, obtaining and maintaining all required upstream authorizations to appoint us and our Subprocessors and permit applicable international transfers
• Ensuring your instructions reflect the authorized instructions of the relevant Controller and promptly informing us if your authority changes or ends
• Handling Data Subject requests and regulatory obligations, or transmitting them to the relevant Controller, with our assistance under this DPA

2.2 Processor

When processing Personal Data on your behalf, we will:

• Process Personal Data only on your documented instructions, including this DPA and your authorized use and configuration of the Service, unless processing is required by applicable law; where legally permitted, we will inform you of that requirement before processing
• Ensure personnel are bound by confidentiality obligations
• Implement appropriate technical and organizational security measures
• Assist you in responding to Data Subject requests
• Delete or return Personal Data upon termination (at your choice)
• Make available information necessary to demonstrate compliance
• Inform you promptly if, in our opinion, an instruction infringes Applicable Data Protection Law, and suspend the affected processing while the parties resolve the instruction

Neither party is relieved of obligations imposed on it by Applicable Data Protection Law. We do not assume your or an MSP Client's role as Controller merely by providing the Service or assistance under this DPA.

2.3 MSP Communications

Where you act for an MSP Client, you are our primary contact for that processing. You are responsible for transmitting authorized instructions to us and promptly passing our relevant notices and assistance to the MSP Client or upstream Controller. We provide privacy requests, Personal Data Breach notifications, and Subprocessor notices to you through your designated account or privacy contact.

We will not communicate directly with MSP Clients or their Data Subjects about privacy requests or issue privacy or breach notices to them unless you authorize us in writing or applicable law requires it, except to acknowledge and redirect a request under Section 7. Where legally permitted, we will notify you before a legally required direct communication. This provision does not restrict ordinary Service interactions you authorize, such as end-user chat and support workflows, or rights that applicable law or the SCCs require us to honor directly.

2.4 Processing in Our Own Capacity

This DPA does not govern separate processing for which we determine the purposes and means as Controller, such as administering our business relationship, billing, and our own marketing contacts, as described in the Privacy Policy. This distinction does not authorize us to repurpose Personal Data processed on your behalf or avoid the restrictions in Section 16. The actual processing and Applicable Data Protection Law determine our role.

3. Data Processing Details

3.1 Subject Matter and Purpose

You disclose Personal Data to us only for the limited and specified purposes of collecting and analyzing endpoint diagnostics; investigating IT issues; performing remediation and commands authorized by your approval policies; managing support tickets and end-user chat; running configured workflows and integrations; and providing the hosting, storage, access management, security, troubleshooting, and support necessary for those activities. AI-assisted analysis is part of these instructed support activities. Processing includes collection, organization, storage, retrieval, analysis, transmission, and deletion of the data described below.

3.2 Duration

Processing continues for the duration of the Service and the limited return, deletion, and retention periods in Section 10. This DPA continues to protect Personal Data while we retain it.

3.3 Categories of Data Subjects

• Your employees and contractors
• End-users of managed endpoints
• IT administrators and technicians
• MSP Clients' employees, contractors, and end-users where you provide managed IT services
• Other individuals whose Personal Data appears in support content or endpoint data submitted through your authorized use of the Service

3.4 Types of Personal Data

• Contact information (names, email addresses, phone numbers)
• Account credentials and authentication data
• Device identifiers and hostnames
• IP addresses and network information
• System logs and diagnostic data
• User activity within the Service
• Support ticket content and communications

These categories may include sensitive data, such as account access credentials or sensitive information included in logs, tickets, or documents. You must limit submissions to data necessary for authorized IT support, apply appropriate access and approval controls, and comply with any additional requirements for sensitive data. Specially regulated uses requiring a separate agreement are subject to Section 9 of the Terms of Service.

4. Security Measures

We will maintain technical and organizational measures appropriate to the nature of the Personal Data and the risks of processing, including the measures below. We may update these measures as technology and risks change without materially reducing the overall protection of Personal Data. No measure guarantees that all security incidents can be prevented.

4.1 Technical Measures

• Encryption of data in transit using TLS
• Application-layer encryption of sensitive fields with per-tenant key separation
• Two-factor authentication for administrative access (TOTP and FIDO2 passkeys)
• Role-based access controls
• Intrusion detection and monitoring systems
• Automated vulnerability scanning
• Secure software development lifecycle

4.2 Organizational Measures

• Access authorization and confidentiality requirements for personnel handling Personal Data
• Security guidance and training appropriate to personnel responsibilities
• Confidentiality agreements
• Incident response procedures
• Business continuity and disaster recovery plans
• Vendor security assessments

5. Subprocessors

5.1 Authorization

You give general written authorization for us to engage Subprocessors to provide the activities in Section 3, subject to Section 5.3. Before a Subprocessor processes Personal Data, we will enter into a written contract requiring the data protection obligations applicable to its processing under this DPA, including applicable US restrictions. We remain responsible for our Subprocessors' performance of those obligations as required by Applicable Data Protection Law, subject to Section 11 to the extent permitted by law.

5.2 Current Subprocessors

This list identifies providers used for the purposes shown. Their role depends on the processing they perform; for example, a payment provider may separately act as a Controller for its own legal obligations. Providers that do not process Personal Data on your behalf are not Subprocessors for that activity. A listed location or transfer mechanism does not itself guarantee eligibility for a particular transfer; we will use a valid mechanism under Section 6 where required.

5.3 Changes to Subprocessors

We will notify you of any intended changes to Subprocessors at least 30 days in advance. You may object to a new Subprocessor by providing written notice within 14 days. If we cannot reasonably accommodate your objection, you may terminate the affected services.

6. International Data Transfers

Where processing involves a restricted international transfer under Applicable Data Protection Law, we will ensure a valid transfer mechanism is in place before the transfer:

• Adequacy Decisions: We may rely on an applicable adequacy decision while it remains valid and covers the recipient and transfer.
• EU-U.S. Data Privacy Framework: We may rely on the DPF only where the applicable adequacy decision remains valid and the recipient's active certification covers the transferred data.
• Standard Contractual Clauses: Where required and applicable, we use the appropriate SCC module for the parties' actual roles, as described in Appendix A.
• UK Transfers: Where UK GDPR requires safeguards and no applicable adequacy regulation covers the transfer, we will use the ICO-approved International Data Transfer Addendum to the EU SCCs or International Data Transfer Agreement, completed for the relevant transfer, or another legally valid safeguard.
• Supplementary Measures: Where required, we implement additional technical and organizational measures to ensure adequate protection.

Upon request, we will provide copies of relevant SCCs and information about supplementary measures.

7. Data Subject and Consumer Rights

Taking into account the nature of processing and information available to us, we will assist you through appropriate technical and organizational measures in responding to requests under Applicable Data Protection Law within the applicable deadlines. This includes, where applicable:

• Right of access
• Right to rectification
• Right to erasure ("right to be forgotten")
• Right to restriction of processing
• Right to data portability
• Right to object
• Rights to opt out of sale, sharing, targeted advertising, or qualifying profiling, and to limit certain uses or disclosures of sensitive personal information
• Information needed to address an appeal of a consumer rights decision where required by law

You or the relevant Controller are responsible for verifying the requester and deciding the response. We act on your authorized instructions and will not independently disclose, delete, or alter Personal Data in response to a request unless applicable law requires it. If we receive a request directly, we will promptly notify you unless prohibited by law and may acknowledge receipt and direct the requester to you. For MSP Client data, requests and our assistance are routed through the MSP under Section 2.3. This does not prevent us from handling requests concerning data we process as Controller in our own right.

8. Data Breach Notification

If we become aware of a Personal Data Breach, we will:

• Notify you without undue delay, and in any event within 72 hours after awareness or sooner where Applicable Data Protection Law requires; we will not wait for a completed investigation before providing the initial notice
• Provide information about the nature of the breach, categories of data affected, and approximate number of Data Subjects
• Describe likely consequences and measures taken or proposed to address the breach
• Cooperate with your investigation and regulatory notifications
• Document all breaches, including facts, effects, and remedial actions

We may provide information in phases as it becomes available without undue further delay. Notices will include a contact for follow-up. You are responsible for keeping your contact details current and for any notifications you must make to MSP Clients, Controllers, individuals, or authorities. We will provide the assistance required by Applicable Data Protection Law; Section 2.3 governs direct communications in MSP relationships. A notification or cooperation does not itself constitute an admission of fault or liability.

9. Audits and Compliance

9.1 Audit Rights

We will make available information necessary to demonstrate compliance and allow and cooperate with reasonable audits and inspections by you or a qualified independent assessor you designate. You will first review available documentation and independent assessment reports where these reasonably satisfy the applicable requirement. Further audits normally require reasonable notice, take place during business hours, and occur no more than once per year. These procedural limits do not prevent an audit or other reasonable and appropriate compliance steps required by Applicable Data Protection Law, the SCCs, a competent authority, or reasonable evidence of material non-compliance or a Personal Data Breach.

Audits must protect confidentiality, security, other organizations' data, and business continuity. Access is limited to information and systems relevant to your processing; intrusive testing requires prior written agreement on scope and safeguards, without restricting mandatory audit rights. You bear your ordinary audit costs. We may charge reasonable, pre-agreed fees for additional assistance where legally permitted, but fees or confidentiality arrangements will not obstruct mandatory rights or required cooperation. For MSP Client data, you coordinate requests on the relevant Controller's behalf without limiting its mandatory rights.

9.2 Certifications

We will provide relevant Technical and Organizational Measures (TOMs) documentation upon request. Existing independent reports or attestations may be provided subject to appropriate confidentiality arrangements. This DPA does not represent that GenticFlow holds any certification unless we expressly identify a current certification as our own.

9.3 Compliance Assistance

Taking into account the nature of processing and information available to us, we will provide assistance required by Applicable Data Protection Law with security obligations, breach notifications, data protection and risk assessments, required cybersecurity audits, and prior consultation with authorities. Where applicable, this includes information needed for obligations concerning automated decision-making. We provide this assistance to you, including for onward provision to an MSP Client or Controller. You remain responsible for your compliance decisions and filings; we remain responsible for our own legal obligations.

Assistance under this DPA does not constitute approval of a regulated AI use or a determination that a deployment is outside the EU AI Act. Each party retains the duties applicable to its actual role, including any provider duties applicable to us. The intended use, employment-related restrictions, and AI transparency responsibilities in Section 3 of the Terms of Service apply to AI-assisted processing under this DPA.

10. Data Retention and Deletion

10.1 During Subscription

We retain Personal Data only as reasonably necessary and proportionate for the purposes in Section 3, in accordance with authorized retention settings and instructions. We will assist with lawful deletion requests during the subscription; the termination periods below do not postpone applicable rights-request deadlines.

10.2 Upon Termination

At the end of the Service, we will return or delete Personal Data at your choice, subject to legally required retention and the limited backup arrangements below. Unless you instruct earlier deletion or applicable law requires an earlier deadline, we will:

• Provide you with the ability to export your data for 30 days
• Delete Personal Data within 90 days of termination, unless retention is required by law
• Provide written certification of deletion upon request

10.3 Backup Retention

Backup copies may be retained for up to 180 days following termination for disaster recovery, subject to any shorter period required by law. They remain protected under this DPA and isolated from ordinary use pending deletion. If a backup is restored, applicable deletion instructions will be reapplied before the restored data is returned to ordinary use. Where law requires continued retention, we will retain only the required data for that requirement, restrict its use accordingly, and delete it when that requirement ends.

11. Liability

To the extent permitted by law, liability between the parties arising out of or relating to this DPA is subject to the exclusions and aggregate liability cap in Section 16 of the Terms of Service. Claims under this DPA, the Terms, and the Service share that cap; this DPA does not create a separate or additional cap. Nothing limits liability that cannot lawfully be limited, Data Subjects' statutory rights, obligations or liability under the SCCs that cannot be restricted, or the powers of a competent authority. Neither party assumes an obligation to reimburse regulatory fines except to the extent lawfully recoverable under the parties' agreement and applicable law.

12. Conflict

The SCCs and any applicable mandatory UK transfer clauses prevail over conflicting terms. Subject to that priority, this DPA prevails over conflicting Terms of Service or Privacy Policy provisions concerning processing on your behalf; Section 16 supplements this DPA where US State Privacy Laws apply. The Terms otherwise govern, including liability as expressly provided in Section 11. Nothing in these documents reduces mandatory protections under Applicable Data Protection Law.

13. Term and Termination

This DPA remains in effect for as long as GenticFlow Ltd. processes Personal Data on your behalf. The obligations in this DPA survive termination to the extent necessary to complete deletion of Personal Data and fulfill legal requirements.

14. Amendments

We may update this DPA to reflect changes in law, regulatory guidance, or our processing activities. Material changes will be notified at least 30 days in advance. Continued use of the Service constitutes acceptance of the updated DPA.

15. Contact

For questions about this DPA or processing assistance, contact us below. Individuals whose data is managed by an organization or MSP should normally contact that organization or MSP first; Section 7 applies to requests received by us.
GenticFlow Ltd.
Data Protection Contact: [email protected]
Legal: [email protected]

16. US Privacy Law Terms

16.1 Scope and Processing Capacity

To the extent US State Privacy Laws apply to Personal Data processed on your behalf, we act as a Processor and, under the CCPA where applicable, Service Provider or Contractor, including in a subcontracted capacity when you act for an MSP Client. We will comply with the obligations applicable to that capacity and provide the level of privacy protection required by the applicable law, including the same level of protection required of a Business by the CCPA for the Personal Data covered by this DPA.

16.2 Restrictions and Certification

For Personal Data processed on your behalf, we will not:

• Sell or Share the Personal Data as defined by the CCPA or sell it as defined by another applicable US State Privacy Law
• Process the Personal Data for targeted advertising or cross-context behavioral advertising
• Retain, use, or disclose the Personal Data for a purpose other than the specific purposes in Section 3, including for another commercial purpose, except as expressly permitted by the applicable US State Privacy Law and its regulations
• Retain, use, or disclose the Personal Data outside the direct business relationship established by this DPA, except as expressly permitted by the applicable US State Privacy Law and its regulations
• Combine the Personal Data with personal information received from or on behalf of another person, or collected from our own interactions with individuals, except as expressly permitted by the applicable US State Privacy Law and its regulations

We certify that we understand these restrictions and will comply with them. Any permitted exception remains subject to other Applicable Data Protection Law and does not authorize unrelated advertising, unrestricted product development, or reuse contrary to your lawful instructions. Sensitive personal information is subject to the same restrictions and any additional requirements of applicable law.

16.3 Oversight and Remediation

You may take reasonable and appropriate steps under Section 9 to ensure that we use Personal Data consistently with your obligations under applicable US State Privacy Laws, including where you exercise those rights on an MSP Client's behalf. We will notify you promptly if we determine that we can no longer meet our obligations. Upon notice, you may take reasonable and appropriate steps to stop and remediate unauthorized processing, including instructing us to suspend affected processing and return or delete affected Personal Data, subject to lawful retention requirements. We will cooperate with those steps. Our Subprocessors must be bound by corresponding applicable obligations under Section 5.

16.4 De-identified Data

We may create or use de-identified or aggregated data from Personal Data only where permitted by this DPA and Applicable Data Protection Law. We will take reasonable measures to ensure that de-identified data cannot be associated with, or used to infer information about, an identifiable individual or household. We publicly commit to maintain and use it in de-identified form and not attempt re-identification, except solely to test the effectiveness of de-identification where expressly permitted by applicable law. We will contractually require recipients of de-identified data to comply with applicable de-identification safeguards and restrictions. Data that remains personal, including pseudonymized data, remains subject to this DPA; labeling it aggregated or de-identified does not remove that protection.

Appendix A: Standard Contractual Clauses

Where required and applicable to an international transfer, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) are incorporated by reference using the module appropriate to the actual exporter and importer roles. Module Two applies to Controller-to-Processor transfers; Module Three applies to Processor-to-Processor transfers, including a qualifying transfer from an MSP acting as Processor to a Subprocessor, or from us to a further Subprocessor. The use of the Service by an MSP does not itself make a transfer restricted or determine which module applies.

The following applies to the SCCs:

• Clause 7 (Docking clause): Not used
• Clause 9 (Subprocessors): Option 2 (general authorization with 30-day notice)
• Clause 11 (Redress): Optional clause not used
• Clause 17 (Governing law): Laws of Ireland
• Clause 18 (Forum): Courts of Ireland

Before relying on the SCCs for a transfer, the parties to that transfer will complete the required annexes identifying the exporter and importer and their contacts, competent supervisory authority, transfer details, security measures, and applicable Subprocessors. Sections 3, 4, and 5 and the relevant order and security documentation supply the applicable processing information; transfer-specific details must reflect the actual transfer. Copies of the applicable completed clauses are available on request, subject to lawful confidentiality protections. For UK transfers, the instrument described in Section 6 must also be completed where required.