This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Flixy (“Processor”) and the Customer (“Controller”) and applies whenever Flixy processes personal data on behalf of the Customer, in accordance with article 28 of the GDPR, the UK GDPR and equivalent laws (including, as a “service provider”, the CCPA).
1. Subject matter and details
| Item | Description |
|---|---|
| Subject matter | Hosting and operation of the Customer’s websites and business modules |
| Duration | Term of the agreement, plus deletion period |
| Nature and purpose | Storage, hosting, transmission, display, statistics, form/orders/bookings management, email notifications, backups; reviews, chat, newsletters, SMS and email reminders, loyalty, coupons and gift cards, memberships, quotes and invoices when the Customer turns them on; the Customers file gathering these contacts in one profile per person, with the tags and notes the Customer adds, and their export at the Customer’s request; email automations sent to the Customer’s contacts on the Customer’s instructions, with the sending log, personal promo codes and unsubscriptions; machine translation of the Customer’s website content when the Customer turns on the Multilingual website |
| Data subjects | Visitors, prospects, customers, and contacts of the Customer’s websites |
| Categories of data | Identification and contact data, messages, order and booking details, technical and usage data (IP, device, pages viewed); no special categories unless the Customer decides so under its own responsibility |
2. Obligations of Flixy
- Process personal data only on the Controller’s documented instructions (these Terms and the Customer’s configuration of the Service), unless required by law, in which case Flixy informs the Controller unless prohibited.
- Ensure persons authorized to process the data are bound by confidentiality.
- Implement appropriate technical and organizational measures (art. 32), including encryption in transit, access control, logging, backups, and isolation.
- Assist the Controller, considering the nature of the processing, in responding to data subject requests, and with security, breach notification, impact assessments and prior consultations.
- Notify the Controller without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting Customer data.
- At the end of the service, delete or return personal data at the Controller’s choice, within 90 days, unless storage is required by law.
- Make available information necessary to demonstrate compliance and allow audits, by providing documentation, or, where reasonably required, an audit by an independent auditor under confidentiality, at the Controller’s expense, no more than once a year with 30 days’ notice.
3. Sub-processors
The Controller grants general authorization to engage sub-processors. The current list is set out in the Privacy Policy. Flixy will inform the Controller of any intended change by updating the list and, for paying customers who subscribe to notifications, by email at least 15 days in advance; the Controller may object on reasonable grounds and, failing resolution, terminate the affected service. Flixy imposes equivalent data protection obligations on its sub-processors and remains liable for them.
4. International transfers
Transfers outside the EEA, UK or Switzerland are made on the basis of adequacy decisions (including the EU-US Data Privacy Framework) or Standard Contractual Clauses (Module 2 or 3 as applicable) and the UK Addendum, which are incorporated by reference where needed.
5. Controller’s obligations
The Controller is responsible for the lawfulness of the processing, for providing privacy notices and collecting consent where required (including cookie consent on its website), for the accuracy of the data, and for not uploading special categories of data unless necessary and lawful.
6. CCPA
Flixy will not sell or share personal information received from the Customer, retain, use or disclose it outside the direct business relationship, or combine it with other data except as permitted by the CCPA.
7. Precedence
In case of conflict between this DPA and the Terms regarding data protection, this DPA prevails. Liability under this DPA is subject to the limitations of the Terms, except where prohibited by law.
Questions about this document? Write to legal@flixy.studio.
This English version is the binding version. Translations are provided for convenience only, except where mandatory local law requires otherwise.