Data Processing Addendum (DPA)
Last updated: October 14, 2026
Art. 28 GDPR processor terms for business customers who use AACFlow to process personal data of their users, customers or staff.
This DPA is entered into between the customer ("Controller") and Chibilyaev Alexandr, [[TO BE FILLED: street and number]], [[TO BE FILLED: postal code]] [[TO BE FILLED: city]], Germany ("Processor", AACFlow), and forms part of the Terms of Service once accepted or signed by the customer. To countersign or request a signed copy: legal@aacflow.io.
1. Subject matter, duration, nature and purpose
The Processor processes personal data solely to provide the AACFlow platform (workflow and agent automation, knowledge bases, tables, logs) on the Controller's documented instructions for the term of the main agreement. Categories of data subjects and data are set out in Annex I.
2. Instructions (Art. 28(3)(a))
The Processor processes data only on documented instructions, including regarding transfers to third countries, unless required by Union or Member State law (in which case it informs the Controller beforehand). Use of platform features constitutes an instruction. The Processor informs the Controller without delay if it believes an instruction infringes data-protection law.
3. Confidentiality (point (b))
Persons authorised to process the data are bound by confidentiality or a statutory duty of confidentiality.
4. Security (point (c), Art. 32)
The Processor implements the measures in Annex II and the security overview and keeps them appropriate without reducing the agreed level of protection.
5. Subprocessors (point (d))
The Controller gives general authorisation for the subprocessors listed at /subprocessors. The Processor imposes data-protection obligations at least equivalent to this DPA on each subprocessor and remains liable for them.
6. Changes of subprocessors
New or replaced subprocessors are announced at least 30 days in advance on the subprocessor page and, on request, by e-mail. The Controller may object on reasonable data-protection grounds within that period; if no solution is found, it may terminate the affected service with a pro-rata refund of prepaid, unused fees.
7. Assistance (points (e), (f))
The Processor assists the Controller with data-subject requests (Arts. 12-22), security, breach notification, data-protection impact assessments and prior consultation (Arts. 32-36), and forwards any data-subject request it receives without undue delay.
8. Personal data breach
The Processor notifies the Controller without undue delay after becoming aware of a breach, target: [[TO BE FILLED: Owner - breach-notification target, e.g. 48 hours]], with the information available to it under Art. 33(3).
9. Deletion and return (point (g))
On termination the Processor deletes or returns all personal data at the Controller's choice (export via platform features or on request), unless law requires retention. Backups are overwritten in the regular cycle. [[TO BE FILLED: Owner - deletion period after termination, e.g. 30 days]]
10. Audits (point (h))
The Processor makes available all information necessary to demonstrate compliance and allows audits, including inspections, by the Controller or an appointed auditor: no more than once a year, on at least 30 days' notice, during business hours and without disproportionate disruption. The Controller bears the cost unless a breach is found.
11. International transfers
Where data is transferred to countries without an adequacy decision (in particular to subprocessors in the USA or Russia), the EU Standard Contractual Clauses (Decision (EU) 2021/914) - Module 2 (controller to processor) and Module 3 (processor to subprocessor) - are deemed agreed and incorporated by reference; for the United Kingdom the UK Addendum applies. Where applicable, transfers also rely on the EU-US Data Privacy Framework. Supplementary measures: encryption in transit, access restriction, transparency on government requests.
12. Liability, precedence, governing law
Liability follows the main agreement; Art. 82 GDPR is unaffected. In data-protection matters this DPA (and the SCCs) prevail over the Terms. Governing law: [[TO BE FILLED: governing law]]; place of jurisdiction for merchants: [[TO BE FILLED: place of jurisdiction]], where permitted.
Annex I - Description of processing
| Item | Description |
|---|---|
| Controller | The customer (as identified in the order/account) |
| Processor | Chibilyaev Alexandr, [[TO BE FILLED: street and number]], [[TO BE FILLED: postal code]] [[TO BE FILLED: city]], Germany |
| Data protection contact / DPO | [[TO BE FILLED: Data protection officer / privacy contact (if legally required)]] |
| Data subjects | The customer's staff and users, its customers and prospects, and any other individuals whose data the customer places in workflows, knowledge bases or tables |
| Categories of data | Identification data (name, e-mail), communication content, workflow inputs/outputs, prompts and AI outputs, usage and log data; no special categories (Art. 9) unless expressly agreed |
| Processing operations | Storage, retrieval, transmission to models/integrations chosen by the customer, deletion |
| Duration | Term of the main agreement plus return/deletion |
Annex II - Technical and organisational measures
- Access control: authentication, session management, optional SSO/SCIM.
- Authorisation: role-based permissions, audit logging.
- Transfer control: TLS in transit, egress/SSRF protection for outbound requests.
- Encryption of stored credentials (AES-256-GCM).
- Separation: tenant workspaces and organizations.
- Availability and recovery: [[TO BE FILLED: Owner - backup concept]]
- Details: Security overview.
