Data Processing Agreement
Last update: October 13, 2026
Parties and scope
This agreement supplements the ActaFlow Terms where ACTAFLOW S.R.L. processes personal data on the customer’s behalf to provide the service. The customer acts as controller, or as a processor authorised by its controller; ActaFlow acts as processor or subprocessor respectively. Customer information needed for billing, security and contract management is processed by ActaFlow as controller under its privacy notice.
Subject matter and instructions
Processing lasts for service delivery and the time needed to return or delete data afterwards. It includes collection from authorised sources, storage, organisation, search, AI analysis, output generation, disclosure to authorised recipients and deletion. Instructions consist of the contract, configurations and requests made by authorised platform users. ActaFlow processes data only on those instructions, including for transfers, unless legally required otherwise, in which case it informs the customer in advance where permitted. ActaFlow informs the customer if it considers an instruction to infringe applicable data protection law.
Data and data subjects
Data includes information in messages, documents, Knowledge, integrations, playbooks and runs: identity, contact, professional, contractual and administrative information, and other content selected by the customer. Data subjects may include employees, contractors, customers, suppliers and correspondents. Special-category and criminal-offence data are not required to use the service; the customer assesses lawfulness and appropriate safeguards before providing them. Growth may also include advertising account identifiers and authorisations, campaign and performance data, professional lead information, prompts, images, videos, voiceover scripts and audio files. Data subjects may also include prospective customers and people represented in submitted materials.
Confidentiality and security
ActaFlow restricts access to authorised persons subject to confidentiality obligations. It applies risk-appropriate measures, including authentication, workspace and role authorisation, protection in transit and at rest, encryption of integration credentials, operational records and deletion procedures. Customers manage team access, instructions, approvals and their own devices. Measures are described in the privacy notice and may evolve without reducing the contractually required level of protection.
Subprocessors and transfers
The customer gives general authorisation for the providers listed in the privacy notice’s Providers section for their respective functions. ActaFlow imposes substantially equivalent data protection duties, remains responsible for subprocessors’ performance and informs the customer before additions or replacements, allowing reasonable time for reasoned objections. If a legitimate objection cannot be resolved, the parties consider an alternative or termination of the affected function. Transfers outside the EEA require an applicable GDPR Chapter V safeguard; general subprocessor authorisation alone is insufficient.
Assistance and incidents
Taking into account the nature of processing and available information, ActaFlow assists with data subject requests and obligations concerning security, breaches, impact assessments and prior consultation. It notifies the customer without undue delay after becoming aware of a personal data breach, providing available information and subsequent updates. The customer retains the controller’s responsibilities for notification to authorities and data subjects.
Return, deletion and audits
At the end of processing, the customer may request return of available data and deletion of copies, except where law requires retention. Technical copies follow their deletion cycles and remain protected and unused for other purposes. ActaFlow makes information needed to demonstrate compliance with this agreement available and allows proportionate, coordinated assessments that respect other customers’ confidentiality, including audits by the customer or an independent auditor. Contact for this agreement: info@actaflow.ai.