Data processing agreement

PERSONAL DATA PROCESSING AGREEMENT (DPA) – FLOWMEETS

1. Parties and relationship to the Agreement

1.1 The Customer is the Data Controller. Flowmeets is the Data Processor.

1.2 This DPA forms an integral part of the Agreement. In the event of any conflict regarding data protection matters, this DPA shall prevail.

2. Subject matter, duration, nature and purpose

2.1 Subject matter: Flowmeets’ processing of personal data in order to provide the Service under the Agreement.

2.2 Duration: For the term of the Agreement and thereafter for the period required for export/deletion pursuant to this DPA.

2.3 Nature and purpose: To store, organise, transfer, analyse (where applicable) and otherwise process personal data in order to deliver the Service.

3. Instructions

3.1 Flowmeets shall process personal data only in accordance with the Customer’s documented instructions, this DPA and applicable law.

3.2 If Flowmeets considers that an instruction infringes data protection legislation, Flowmeets shall notify the Customer.

4. The Customer’s responsibilities

The Customer is responsible for:

a) having a lawful basis and providing information to data subjects,

b) ensuring that instructions are clear and lawful,

c) obtaining any necessary consents when recording/transcription is used (if applicable), and

d) ensuring that only data that may lawfully be processed is entered into the Service.

5. Flowmeets’ obligations

Flowmeets shall:

a) ensure confidentiality for authorised personnel,

b) implement appropriate technical and organisational measures in accordance with Appendix 2,

c) assist the Customer with data subjects’ rights to a reasonable extent,

d) assist with DPIAs and prior consultation with the supervisory authority to a reasonable extent, and

e) maintain the documentation of categories of processing to the extent required under processor obligations.

6. Sub-processors – list upon request

6.1 The Customer grants Flowmeets a general authorisation to engage sub-processors.

6.2 Flowmeets shall ensure that sub-processors are subject to written agreements that, in all material respects, correspond to this DPA.

6.3 Flowmeets shall be liable for the acts and omissions of its sub-processors.

6.4 An up-to-date list of sub-processors shall be provided to the Customer upon request.

6.5 Flowmeets shall notify the Customer at least thirty (30) days in advance before a sub- processor is added or replaced. The Customer may object on reasonable data protection grounds.

7. Place of processing and third-country transfers

7.1 Personal data shall be stored and processed within the EU/EEA.

7.2 Transfers to a third country may only take place subject to the Customer’s written approval and with an appropriate transfer mechanism pursuant to GDPR Chapter V.

8. Government/authority requests

8.1 If Flowmeets receives a binding request from a public authority relating to personal data processed on the Customer’s behalf, Flowmeets shall, unless prohibited by law, notify the Customer without undue delay.

8.2 Flowmeets shall, to a reasonable extent, assist the Customer with information enabling the Customer to assess the request.

9. Personal data breaches

9.1 Notification by the Processor Flowmeets shall, without undue delay and no later than 24 hours after Flowmeets becomes aware of a personal data breach, notify the Customer. The notification shall be made via the incident channel agreed between the Parties.

9.2 Contents of the notification The notification under Clause 9.1 shall contain the information that Flowmeets can reasonably provide at the time and shall be drafted so that the Customer can fulfil its obligations under the GDPR, including, where required, notifying the Swedish Authority for Privacy Protection (IMY) within 72 hours from the time the Customer becomes aware of the breach. Where possible, the information shall include:

1. a description of the nature of the breach and what has occurred,

2. the categories of data subjects concerned and, where possible, the approximate number of data subjects, as well as the categories of personal data and, where possible, the approximate number of records,

3. the likely consequences/risks for data subjects, and

4. measures taken and planned to address the breach and mitigate possible adverse effects.

9.3 Ongoing updates If Flowmeets cannot provide all relevant information in the initial notification, Flowmeets shall, without undue delay, provide additional information as the investigation progresses, enabling the Customer to update its risk assessment and any reporting to authorities.

9.4 Allocation of roles – authority notification and communication to data subjects The Parties agree that:

1. The Customer is responsible for assessing whether the breach must be notified to IMY (i.e., whether the breach is likely to result in a risk to the rights and freedoms of natural persons) and, where applicable, ensuring that such notification is made within the time limits under the GDPR.

2. The Customer is also responsible for informing the affected data subjects without undue delay where the breach is likely to result in a high risk to the rights and freedoms of natural persons.

3. Flowmeets shall assist the Customer with such information as is reasonably required for these assessments and measures, to the extent Flowmeets has access to the information and such assistance is possible without compromising security.

9.5 Breach register and documentation Flowmeets shall document personal data breaches occurring within the scope of the processing on the Customer’s behalf to the extent required to enable the Customer to meet the requirement to document personal data breaches. Upon the Customer’s request, Flowmeets shall provide relevant extracts from such documentation to a reasonable extent.

9.6 Coordination with other incident requirements If a breach may also fall under other incident reporting regimes in addition to the GDPR (e.g., cybersecurity incident reporting), the Parties shall promptly cooperate to enable parallel handling. This shall not affect the Customer’s responsibility for GDPR notification and communication to data subjects under Clause 9.4.

10. Security measures

10.1 Flowmeets shall maintain appropriate technical and organisational security measures in accordance with Appendix 2.

10.2 The Customer acknowledges that certain details may be security-sensitive; Flowmeets may provide summaries or audit reports instead of full disclosure, to the extent this meets the requirements and is reasonable.

11. Audit

11.1 The Customer may conduct an audit of Flowmeets compliance at most once per year, with at least 30 days’ notice, during business hours and without unreasonably disrupting operations.

11.2 The audit may be performed by the Customer or an independent auditor subject to confidentiality.

11.3 Flowmeets may satisfy audit requirements by providing relevant third-party reports/certifications where available.

12 Return and deletion

12.1 Upon termination of the Agreement, Flowmeets shall make personal data available for secure download for at least 30 days.

12.2 Thereafter, Flowmeets shall delete personal data unless continued storage is required by law.

12.3 Deletion of backup copies may take place in accordance with Flowmeets’ standard backup routines, provided that the personal data is not actively used and is deleted within a reasonable time in accordance with such routines.

13 Liability

13.1 The Parties’ liability under this DPA is subject to the limitations of liability in the MSA, except where such limitation is not permitted under mandatory law.

14. Governing law and disputes

14.1 Swedish law shall apply. Any dispute shall be resolved in accordance with the dispute resolution clause in the MSA (arbitration).

Appendix 1 – Description of the Processing

APPENDIX 1 – DESCRIPTION OF THE PROCESSING (to the Data Processing Agreement)

1. Background and allocation of roles

1.1 The Customer is the Data Controller and Flowmeets is the Data Processor to the extent that Flowmeets processes personal data on the Customer’s behalf within the scope of the Service.

1.2 This Appendix constitutes the Customer’s documented instructions to the extent it describes the subject matter, nature, purposes and categories, and it supplements the other instructions set out in the DPA.

2. Subject matter

2.1 The processing concerns the provision of Flowmeets’ platform and related features, including (depending on plan/configuration): scheduling/calendar, automated communications, and AI features such as transcription, summaries, coaching and scorecards.

3. Nature of the processing

3.1 The processing may include the following operations (to the extent the relevant functionality is enabled and used):

• collection/receipt of personal data from the Customer and/or integrated systems,
• storage and structuring of data (including metadata),
• access management and authorisation controls,
• transfer/display of data to authorised users,
• generation of transcripts, summaries and other AI-based insights,
• logging and monitoring for security and troubleshooting purposes,
• export of data at the Customer’s request or via standard functionality,
• deletion and decommissioning in accordance with the DPA.

4. Purposes

4.1 The purpose is to deliver, operate, maintain and secure the Service under the Agreement, and to provide the features selected by the Customer (including, where applicable, AI features).

4.2 Flowmeets may not process personal data for its own incompatible purposes (e.g. training of public or external AI models) unless otherwise expressly agreed.

5. Categories of data subjects

5.1 The processing may concern personal data relating to the following categories of data subjects:

1. the Customer’s employees,

2. the Customer’s consultants (to the extent they are granted user access or are included in meeting data),

3. meeting participants (external and internal),

4. invited participants (e.g. prospects/customers/partners), and

5. administrators and other authorised users of the Service.

6. Categories of personal data (examples)

6.1 The processing may include the following categories of personal data (examples, non- exhaustive):

• Account and contact details: name, email address, company, role/title, user ID
• Scheduling data: meeting time, title, participants, agenda, RSVP status, related calendar data
• Recordings and transcripts: audio/video, text transcripts, summaries, coaching notes/scorecards (if enabled)
• Metadata and logs: IP address, device, browser, timestamps, activity logs and security logs

7. Special categories of personal data and other sensitive data

7.1 As a starting point, the Customer shall not instruct Flowmeets to process special categories of personal data or data relating to criminal convictions and offences (“Sensitive Data”) within the scope of the Service.

7.2 If the Customer nevertheless instructs Flowmeets to process such data, the Customer shall:

• ensure that the Customer has a lawful basis and complies with applicable requirements, and
• in good time inform Flowmeets that such processing occurs and specify which additional safeguards are required, so that Flowmeets can assess whether the processing can be carried out and implement appropriate measures.

7.3 Flowmeets is entitled to refrain from, or make such processing conditional upon, additional requirements if necessary for security, compliance or capacity reasons.

8. Duration of the processing

8.1 The processing continues for the term of the Agreement.

8.2 After termination of the Agreement, an export/download period and deletion apply in accordance with the DPA, including handling of backups in accordance with the DPA’s deletion provisions.

8.3 Standard retention (unless otherwise agreed): scheduling and transcription data for as long as the account is active; recordings for up to three (3) years unless deleted earlier by the Customer.

9. Sub-processors (information)

9.1 Flowmeets may engage sub-processors in accordance with the DPA. An up-to-date list of sub-processors shall be provided to the Customer upon request.

9.2 Clarity regarding subcontractors is central in cloud setups and should be handled in a structured manner to avoid ambiguity in the contractual relationship.

APPENDIX 2 – TECHNICAL AND ORGANISATIONAL SECURITY MEASURES (to the Data Processing Agreement)

1. Purpose and scope

1.1 This Appendix describes the minimum requirements for technical and organisational security measures that Flowmeets shall implement and maintain when processing personal data as processor on behalf of the Customer.

1.2 The measures shall be risk-based and adapted to the nature of the processing and the associated risks. This Appendix shall be interpreted together with the DPA and the other security provisions in the Agreement.

2. Minimum requirements

2.1 Access control

a) Role-based access control (RBAC) and the principle of least privilege.

b) Multi-factor authentication (MFA) where possible and reasonable, in particular for administrative accounts.

c) Processes for access management, including approval, modification and deprovisioning of access rights.

2.2 Encryption and data protection

a) Encryption in transit (e.g., TLS) and encryption at rest where appropriate.

b) Secure management of encryption keys and secrets (see also Section 2.9).

2.3 Logging, monitoring and alerts

a) Logging of relevant events (e.g., authentication, changes to permissions, exports, administrative actions) to the extent technically feasible and proportionate.

b) Monitoring and alerting for anomalous behaviour or suspicious activities.

c) Procedures to protect logs (integrity protection, access restrictions, traceability).

2.4 Backup and restore

a) Regular backups and tested restore procedures.

b) Documented procedures for backup management and restoration.

c) Backups shall be protected by appropriate security measures.

2.5 Incident management and escalation

a) Documented incident management procedures (identification, triage, remediation, recovery and “lessons learned”).

b) Escalation procedures (internally and towards the Customer in accordance with the DPA’s incident clauses).

c) Capability to provide the Customer with relevant incident information without undue delay in accordance with the DPA.

2.6 Vulnerability management and patching

a) Procedures to identify, prioritise and remediate vulnerabilities.

b) Patch management and update processes for relevant system components.

2.7 Personnel procedures (organisational measures)

a) Background checks where proportionate and permitted.

b) Confidentiality undertakings for authorised personnel.

c) Onboarding/offboarding procedures ensuring that access is granted and removed in a timely manner.

d) Ongoing security and privacy training for relevant personnel.

2.8 Segregation of environments

a) Segregation between the production environment and the test/development environment where appropriate.

b) If production data is used for testing, this shall only occur where necessary and subject to appropriate safeguards (e.g., anonymisation/pseudonymisation where possible).

2.9 Secure management of keys and secrets

a) Secure storage, access control and rotation of secrets (API keys, tokens, encryption keys).

b) Restriction of access to secrets to authorised personnel/systems.

c) Logging and traceability for access to secrets where possible.

3. Changes and updates to security measures

3.1 Flowmeets may update the security measures to address evolving threats, technological developments and compliance requirements, provided that the overall level of protection is not materially reduced.

3.2 If the Customer has specific security requirements, these shall be agreed separately (e.g., a Security Schedule) and ranked in accordance with the order of precedence in the Agreement.

4. Link to audit and follow-up

4.1 The Customer may verify compliance through an audit in accordance with the DPA.

4.2 In certain cases, Flowmeets may satisfy audit requirements by providing third-party reports/certifications in accordance with the DPA.

4.3 This type of security appendix helps avoid ambiguity in cloud agreements regarding subcontractors, follow-up and security.