Data processing agreement

This agreement forms part of the terms between your company (the controller) and () (the processor), as required by Article 28 of the GDPR.

1. Subject and duration

We process personal data contained in the records you bring into BeamFlow — such as customer contacts on quotations, orders and enquiries — for as long as you use the service.

2. Instructions

We process personal data only on your documented instructions, which are the terms, this agreement, and the actions your users take in BeamFlow. We tell you if an instruction appears to break the law.

3. Confidentiality and security

• People with access are bound by confidentiality.
• Data is encrypted in transit and connector credentials are encrypted at rest with per-company keys.
• Every write to a connected system needs a recorded approval, and audit records are hash-chained so tampering is detectable.
• Access to production is limited, logged and protected with multi-factor authentication.

4. Sub-processors

You authorise the sub-processors listed on the sub-processors page. We give 30 days' notice of new sub-processors so you can object.

5. Assistance

We help you answer data-subject requests, carry out impact assessments, and meet your security obligations, taking into account the nature of the processing.

6. Personal data breaches

We notify you without undue delay, and within 48 hours of becoming aware, of a breach affecting your data, with the information you need to report it.

7. Deletion and return

When the agreement ends you can export your data. We then delete it within 30 days, unless the law requires us to keep it.

8. Audits

We make available the information needed to demonstrate compliance and allow reasonable audits, with 30 days' notice and at most once a year unless a breach has occurred.