Data processing agreement

Roles

For the content of your workspace (projects, tasks, comments, files and the people in it) you are the controller and we are your processor. For account details we need to run the service for each person (sign-in, billing, security), we are the controller, as described in the privacy policy.

What we process

• Purpose: providing thisflow as described in the terms: storing, syncing, sharing and showing your workspace, notifications, imports, exports and the features you choose to use, including AI features.
• Duration: for as long as you use the workspace, then until deletion as described below.
• People concerned: members and guests of your workspace, and people mentioned in its content.
• Kinds of data: names, email addresses, profile pictures, the content of tasks, comments and files, assignments, activity history and technical data such as IP addresses. Do not put special categories of data (such as health data) in thisflow unless you have assessed that it is appropriate.

Our obligations

• We process the data only on your documented instructions, which are these terms and what you do in the app, unless the law requires otherwise; we tell you if we think an instruction breaks the law.
• Everyone at thisflow with access to the data is bound by confidentiality.
• We protect the data with the technical and organisational measures described on the security page.
• We help you answer requests from the people concerned (access, correction, deletion, export), mostly through the app's own tools.
• We help you with data protection impact assessments and consultations where they concern thisflow.
• We tell you without undue delay after we become aware of a personal data breach that affects your workspace, with what we know and what we are doing about it.

Subprocessors

You allow us to use the subprocessors listed on the subprocessors page. Each is bound by a written agreement with data protection obligations like the ones in this DPA. We tell workspace owners before we add or replace a subprocessor, so you can object; if we cannot address an objection, you may end the agreement.

Transfers outside the EU/EEA

The data is stored in Sweden. Where a subprocessor handles it outside the EU/EEA, the transfer relies on an adequacy decision (such as the EU–US Data Privacy Framework) or the European Commission's standard contractual clauses.

Deletion

When a workspace is deleted, it can be restored for 30 days and is then deleted for good; deleted data leaves the backups within 14 days after that. You can export the workspace at any time before.

Audits

We make available the information you need to show that this DPA is followed, and we answer reasonable written questions. If that is not enough, you or an auditor you appoint, bound by confidentiality, may audit us on reasonable notice, at your cost and at most once a year unless a breach gives cause.

Liability and order

The limits of liability in the terms apply to this DPA as far as the law allows. If this DPA and the terms disagree on personal data, this DPA wins.