Data processing agreement

How we handle personal data for your brand, as your processor. It forms part of our Terms and applies automatically.

Last updated 23 October 2026. Provided by FLOWSTATE MAIL LTD, a company registered in Nigeria (RC number [Placeholder: RC number]).

This Data Processing Agreement ("DPA") is between FLOWSTATE MAIL LTD, a company registered in Nigeria, registered office [Placeholder: registered office address] ("Flowstate", the processor), and the customer that has accepted the Flowstate Terms of Service ("Customer", the controller). It forms part of the Terms and applies automatically whenever Flowstate processes Customer Personal Data. If you need a signed copy, email team@flowstatemail.com.

1. Definitions

Data Protection Laws: every law on personal data that applies to the processing, including the EU GDPR, the UK GDPR and Data Protection Act 2018, the Nigeria Data Protection Act 2023 (NDPA) and the NDPC's directives, the California Consumer Privacy Act as amended (CCPA) and other US state privacy laws, and Canada's PIPEDA.
Customer Personal Data: personal data that Flowstate processes for the Customer under the Terms, including data in the Customer's store, Klaviyo account and uploads.
Subprocessor: a third party Flowstate engages to process Customer Personal Data.
Security Incident: a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data, or the exposure of the Customer's Klaviyo credentials held by Flowstate.
"Controller", "processor", "data subject", "personal data", "processing", "service provider", "business purpose", "sell" and "share" have the meanings in the Data Protection Laws.

2. Roles and instructions

The Customer is the controller (or a "business" under the CCPA) and Flowstate is the processor (or "service provider") for Customer Personal Data.
Flowstate processes Customer Personal Data only on the Customer's documented instructions. The Terms, this DPA, the Customer's settings (including its chosen Klaviyo access level and autopilot setting) and its requests in the app are those instructions. Flowstate will tell the Customer if it believes an instruction breaks Data Protection Laws, and may then pause that processing.
If the law requires Flowstate to process Customer Personal Data otherwise, Flowstate will tell the Customer first unless the law forbids it.
The Customer is responsible for having a lawful basis and all notices and consents needed for Flowstate to process Customer Personal Data, including for the people on its email lists.

3. Details of the processing

The subject matter, nature, purpose, duration, types of data and data subjects are in Annex I below.

4. Confidentiality

Flowstate ensures that everyone it authorises to process Customer Personal Data is bound by confidentiality and only has access as needed for the Service.

5. Security

Flowstate keeps appropriate technical and organisational measures in place to protect Customer Personal Data, described in Annex II. It may update them as long as protection is not reduced.

6. Subprocessors

The Customer gives general authorisation for Flowstate to use the Subprocessors on its subprocessor list.
Flowstate will give at least 14 days' notice of a new or replacement Subprocessor by updating the list and emailing account owners. The Customer may object on reasonable data-protection grounds within that period. If we can't resolve the objection, the Customer may cancel and receive a pro-rata refund of prepaid fees for the unused period.
Flowstate puts a written contract in place with each Subprocessor that protects Customer Personal Data at least as well as this DPA, and remains responsible for its Subprocessors' performance.
Klaviyo, Shopify and other services the Customer connects are the Customer's own providers, not Flowstate's Subprocessors.

7. Helping the Customer

Data subject requests. Flowstate will promptly pass on any request it receives about Customer Personal Data, and help the Customer answer requests to access, correct, delete, restrict, port or object, by appropriate technical and organisational measures.
Assessments and regulators. Flowstate will give reasonable help with data protection impact assessments, consultations with regulators, and the Customer's security obligations, taking into account the information available to Flowstate.

8. Security Incidents

Flowstate will tell the Customer without undue delay, and within 48 hours, after becoming aware of a Security Incident affecting Customer Personal Data. If the incident may have exposed the Customer's Klaviyo credentials, Flowstate will tell the Customer within 24 hours so it can revoke them and meet its own obligations to Klaviyo.
The notice will describe, as far as known, what happened, the data and approximate number of people affected, the likely consequences, a contact point, and the steps taken or proposed. Information may be given in stages.
Flowstate will take reasonable steps to contain and fix the incident, keep a record of it, and cooperate with the Customer. Notifying the Customer is not an admission of fault.

9. Deletion and return

When the Customer disconnects Klaviyo, Flowstate deletes the stored Klaviyo key straight away.
When the Terms end, Flowstate keeps Customer Personal Data for 90 days so the Customer can return or ask for an export, then deletes it. Backups are overwritten within a further 30 days. The Customer may ask for earlier deletion at any time.
Flowstate may keep data where the law requires, and then only for that purpose, kept confidential and protected.

10. Audits and information

Flowstate will make available the information reasonably needed to show compliance with this DPA, including answers to a reasonable security questionnaire once a year. If that is not enough to meet a legal requirement, the Customer may run an audit (itself or through an independent auditor bound by confidentiality) on 30 days' notice, during business hours, at its own cost, no more than once a year unless a regulator requires it or after a Security Incident.

11. International transfers

Flowstate is established in Nigeria and its main providers are in the United States. Flowstate may process Customer Personal Data in Nigeria, the United States and the other countries shown on the subprocessor list.
EU transfers. Where Customer Personal Data subject to the EU GDPR is transferred to Flowstate in a country without an adequacy decision, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) are incorporated into this DPA by reference: Module 2 (controller to processor) where the Customer is a controller, and Module 3 (processor to processor) where the Customer is itself a processor. For the Clauses: the optional docking clause (Clause 7) applies; Clause 9 option 2 (general written authorisation, with the notice period in section 6) applies; the optional wording in Clause 11 does not apply; Clause 17 option 1 applies with the law of [Placeholder: EU member state, for example Ireland]; and the courts in Clause 18 are the courts of that member state. Annexes I to III of the Clauses are completed by Annexes I and II below and the subprocessor list.
UK transfers. For personal data subject to the UK GDPR, the UK International Data Transfer Addendum (version B1.0) issued by the Information Commissioner is incorporated, with Table 1 completed by the parties' details above, Tables 2 and 3 by the EU Clauses as set out here and the Annexes, and in Table 4 either party may end the Addendum as its section 19 allows.
Swiss transfers. The EU Clauses apply with the changes needed under Swiss law, with the Swiss Federal Data Protection and Information Commissioner as the competent authority.
Onward transfers. Flowstate's transfers to its Subprocessors rely on the EU-US Data Privacy Framework where the Subprocessor is certified, or on the Standard Contractual Clauses (Module 3) and the UK Addendum.
Nigeria. Transfers of personal data out of Nigeria follow sections 41 to 43 of the NDPA, and Flowstate records the basis for each transfer.
If a transfer mechanism is invalidated, the parties will work together in good faith on an alternative.

12. US state privacy laws

Where the CCPA or another US state privacy law applies, Flowstate:

processes Customer Personal Data only for the business purposes in Annex I and the Terms;
will not sell or share it (including for cross-context behavioural advertising);
will not retain, use or disclose it for any purpose other than those business purposes, or outside the direct business relationship with the Customer;
will not combine it with personal data from other sources or customers, except as the law allows;
will comply with the applicable law and give the same level of privacy protection the law requires of the Customer;
will tell the Customer if it can no longer meet these obligations;
allows the Customer to take reasonable steps to stop and fix unauthorised use;
passes these obligations on to its Subprocessors.

Flowstate certifies that it understands and will comply with these restrictions.

13. Nigeria

For processing subject to the NDPA, Flowstate complies with the obligations of a data processor in section 29 (including telling the Customer when it engages a new processor, by the process in section 6) and the breach duties in section 40.

14. Liability and order of precedence

Each party's liability under this DPA is subject to the limits in the Terms, except where Data Protection Laws or the Standard Contractual Clauses do not allow it. If this DPA conflicts with the Terms, this DPA wins on personal data. If it conflicts with the Standard Contractual Clauses, the Clauses win.

15. Term

This DPA lasts as long as Flowstate processes Customer Personal Data.

Annex I: Details of the processing

Parties. Data exporter (controller): the Customer, as identified in its Flowstate account; contact: its account owner. Data importer (processor): FLOWSTATE MAIL LTD, [Placeholder: registered office address], team@flowstatemail.com.
Subject matter and nature. Providing the Flowstate service: researching the Customer's store, planning, writing, designing and checking marketing emails and flows, reporting on Klaviyo performance, account checks, and (only at the access level the Customer chooses) creating drafts and scheduling approved campaigns in the Customer's Klaviyo account.
Purpose. Only to provide, secure and support the Service for the Customer.
Duration. The term of the Terms, plus the deletion periods in section 9.
Categories of data subjects. The Customer's staff and contractors who use Flowstate or appear as email senders; the Customer's customers, subscribers and reviewers whose data is in its store or Klaviyo account; anyone whose data the Customer chooses to upload or paste into the app.
Categories of personal data. Staff: names, work email addresses, roles, messages and comments. Customers and subscribers: Flowstate reads aggregate numbers and list and segment counts, not individual profiles; its Klaviyo access technically allows reading profiles (email, name, location, consent status, engagement and order history), so these categories are listed in case a future feature the Customer turns on needs them. Reviewers: names or initials and review text shown on the Customer's public store.
Sensitive data. None intended. The Customer must not upload special categories of data.
Frequency. Continuous while the Customer uses the Service.
Competent supervisory authority (EU Clauses). The authority of the EU member state where the Customer is established, or where its EU representative is.

Annex II: Security measures

Encryption: Klaviyo API keys encrypted at rest with AES-256-GCM; all traffic over HTTPS; the hosting provider encrypts storage volumes and backups at rest.
Access control: every request is checked against the account's team roles (owner, editor, viewer). Worker and internal routes require a secret. Files are served through signed links.
Authentication: passwordless one-time sign-in links that expire after 30 minutes and work once; sessions expire after 30 days.
Least privilege in Klaviyo: the Customer chooses read-only, drafts only or full access; Flowstate checks the key's real scopes before allowing a level; every write passes one gate, is logged with who asked, is named "FS | ...", and nothing is scheduled without approval of that exact email unless the Customer turns on autopilot.
Data minimisation: subscriber data is read as counts, not profiles. Klaviyo keys are never sent to AI providers or webhooks.
Abuse protection: rate limits on sign-in, sign-up, chat, jobs and public tools; spend caps on AI usage.
AI providers: used under business terms that forbid training on our content, with default deletion within 30 days.
Backups: daily, kept 30 days, stored with a provider under a data processing agreement. [Placeholder: confirm the backup location]
People: access limited to the founder; confidentiality obligations for anyone given access later.
Incidents: a breach log, and the notice timelines in section 8.
Vendors: written data processing agreements with each Subprocessor.

Annex III: Subprocessors

See the current subprocessor list.

Related policies

This is a draft. Have a lawyer review it before relying on it.