This Data Processing Addendum (“DPA”) forms part of the agreement between you (“Controller”) and Workflow, Inc. (“Processor”) for the provision of the Workflow Service.

1. Roles

The Controller determines the purposes and means of processing personal data. The Processor processes personal data only on documented instructions from the Controller.

2. Subprocessors

We engage vetted subprocessors to support the Service and maintain a current list. We notify Controllers of changes and remain responsible for subprocessor compliance.

3. Security measures

• Encryption of personal data in transit and at rest.
• Access controls and audit logging.
• Regular testing and review of security measures.

4. International transfers

Where personal data is transferred across borders, we rely on appropriate safeguards such as Standard Contractual Clauses.

5. Data subject requests

We assist the Controller in responding to data subject requests and in meeting obligations relating to security, breach notification, and impact assessments.

6. Deletion

Upon termination, we delete or return personal data in accordance with the agreement, subject to legal retention requirements.

To execute a signed DPA, contact hello@workflow.com.