Data Processing Agreement

Version 1.0 of 12 November 2026. The German version governs; this is its translation.

between

the Customer — the business that holds an Autoflowly account and runs one or more apps ("Controller"),

and

Jules Guilain Kenfack, trading as Autoflowly Software, Bernhardhausen Str. 1/2, 75417 Mühlacker, Germany, privacy@autoflowly.com ("Processor").

1. Subject matter and term

1.1 The Processor builds, hosts and operates business applications ("apps") for the Controller, with their database, files and AI assistants, and in doing so processes personal data of the Controller's customers, prospects and staff solely on the Controller's behalf.

1.2 This agreement runs for the term of the service contract (Autoflowly's Terms of Service) and ends with it. Where the protection of personal data is concerned it takes precedence over the Terms.

1.3 It does not cover the account holder's own data (registration, billing, use of the platform). For that data Autoflowly is a controller in its own right and the Privacy Policy applies.

2. Nature, purpose, data and data subjects

3. Instructions

3.1 The Processor processes the data only on the Controller's documented instructions. This agreement, the Terms of Service, the Controller's settings and inputs in the platform (builder, dashboard, mobile app) and its approvals in the Inbox are instructions.

3.2 The Controller gives individual instructions in text form to privacy@autoflowly.com.

3.3 If the Processor considers an instruction unlawful, it says so without delay and may suspend it until the Controller confirms or changes it.

3.4 The Processor does not use the data for its own purposes and does not use it to train AI models, its own or anyone else's.

4. Confidentiality

Everyone at the Processor with access to the data is bound to confidentiality or under a statutory duty of secrecy. Autoflowly accesses an app only to resolve a fault or at the Controller's request, and each access is logged.

5. Technical and organisational measures (Art. 32)

The Processor applies the measures in Annex 1. It may develop them further as long as the level of protection does not fall, and documents material changes.

6. Sub-processors

6.1 The Controller gives general authorisation for the sub-processors listed in Annex 2.

6.2 The Processor announces a new or replaced sub-processor at least 30 days in advance by e-mail to the account address and on autoflowly.com/privacy. The Controller may object on substantial data-protection grounds. If the objection cannot be resolved, the Controller may terminate the affected service with effect from the change.

6.3 The Processor binds every sub-processor by contract to the same data-protection duties and is liable for a sub-processor's breaches as for its own.

6.4 Services the Controller connects itself (its own Stripe, PayPal, Twilio, WhatsApp, Telegram, Google or other account) are not Autoflowly's sub-processors but the Controller's own providers.

7. Transfers to third countries

7.1 The database and files of an app belonging to a Controller based in the EU/EEA, the United Kingdom or Switzerland are held on servers in Germany (Frankfurt am Main or Berlin). If, exceptionally, there is no room there when the app is created, the Processor states the location and moves the app to Germany on request.

7.2 Data is transferred to a third country only where Art. 44 et seq. GDPR are met: an adequacy decision (in particular the EU–US Data Privacy Framework for certified recipients) or the EU Standard Contractual Clauses with supplementary measures. Recipients and safeguards are listed in Annex 2.

7.3 Where the Controller uses the AI assistant, the content needed for it is sent to the AI providers in Annex 2. The Controller can switch AI features off per app.

8. Assistance to the Controller

8.1 Data subject rights: if a data subject contacts the Processor, it forwards the request to the Controller without delay and does not answer it itself. The platform gives the Controller access, correction, export and erasure of individual records in the dashboard.

8.2 Security, impact assessment, consultation: the Processor assists the Controller to a reasonable extent with its duties under Art. 32 to 36 GDPR.

9. Personal data breaches

The Processor notifies the Controller of a breach without undue delay and within 48 hours of becoming aware of it, by e-mail to the account address. The notice states, as far as known: the nature of the breach, the types of data and approximate number of people affected, likely consequences, measures taken and proposed, and a contact point. Missing details follow later.

10. Audits

10.1 The Processor demonstrates compliance with suitable documentation (description of measures, logs, reports; certificates once available).

10.2 Where that is not enough, the Controller may audit, itself or through an auditor bound to confidentiality, on at least 30 days' notice, at most once a year (more often for good cause), during normal business hours. Audits must not endanger operations or other customers' data.

11. Erasure and return

11.1 The Controller can export its data at any time.

11.2 After the service contract ends or an app is deleted, the Processor erases its data within 30 days; backups are overwritten within a further 30 days. The Processor's statutory retention duties are unaffected.

11.3 An app switched off for inactivity keeps its data until erasure under the Terms of Service; the Controller is notified before erasure.

12. Professional secrecy and special categories

Where the Controller is bound by professional secrecy (§ 203 German Criminal Code, § 43e BRAO and equivalent rules), the data processing agreement with the professional-secrecy clause, which the Controller accepts in the app's dashboard, applies to that app and takes precedence over this agreement for it. For health data and other Art. 9 data: processing in Germany only unless the Controller chooses otherwise, and AI features only after the Controller switches them on.

13. Liability

Art. 82 GDPR applies. Otherwise the liability rules of the Terms of Service apply.

14. Final provisions

14.1 Changes require text form. The Processor may adapt the agreement to changes in the law and announces changes 30 days in advance.

14.2 German law applies. Place of jurisdiction, where permitted, is the Processor's seat.

14.3 If a provision is invalid, the rest of the agreement remains in force.

14.4 This agreement forms part of Autoflowly's Terms of Service (section 8). It is concluded when the Controller accepts the Terms and applies as soon as the Controller processes other people's personal data in an app. No separate signature is needed. On request the Processor issues a signed copy in text form: privacy@autoflowly.com.

Annex 1 — Technical and organisational measures

Annex 2 — Sub-processors