Data Processing Addendum

The subject matter, duration, nature and purpose of processing, the types of Personal Data, and the categories of Data Subjects are set out in Annex I below, as required by GDPR Article 28(3).

Documented instructions.Floe will process Personal Data only on Customer’s documented instructions, including with regard to international transfers. The Terms, this DPA, and Customer’s use and configuration of the Service constitute Customer’s complete documented instructions. Floe will inform Customer if, in its opinion, an instruction infringes Data Protection Law, unless legally prohibited from doing so.

Customer responsibilities. Customer is responsible for establishing a lawful basis for the processing, for the accuracy and legality of Personal Data it provides, and for providing any notices and obtaining any consents required from Data Subjects — including notice that agent sessions are recorded.

Floe ensures that personnel authorised to process Personal Data are bound by an appropriate obligation of confidentiality, are granted access only on a least-privilege basis and only as necessary to provide the Service, and receive training on their data protection responsibilities.

Floe implements and maintains the technical and organisational measures set out in Annex II, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as required by GDPR Article 32. Floe may update these measures provided the overall level of security is not reduced.

General authorisation. Customer grants Floe general written authorisation to engage sub-processors to process Personal Data. The current list is published at floe.so/subprocessors and forms Annex III to this DPA.

Notice and objection. Floe will update that page at least 30 days before a new sub-processor begins processing Personal Data, and will notify Customers who have subscribed to sub-processor notifications. Customer may object on reasonable data-protection grounds within that period. If the parties cannot resolve the objection, Customer may terminate the affected part of the Service on written notice and receive a pro-rata refund of prepaid fees for the terminated portion.

Flow-down and liability.Floe imposes data protection obligations on each sub-processor that are no less protective than those in this DPA, and remains fully liable to Customer for each sub-processor’s performance.

Data Subject requests.Taking into account the nature of the processing, Floe will assist Customer by appropriate technical and organisational measures, insofar as possible, to respond to requests to exercise Data Subject rights under Chapter III of the GDPR. The Service’s dashboard provides self-service access, export, and deletion for the Personal Data it holds. If Floe receives a request directly from a Data Subject relating to Customer’s Personal Data, it will not respond substantively and will refer the request to Customer without undue delay.

DPIAs and prior consultation. Floe will provide reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities under GDPR Articles 35 and 36, taking into account the information available to Floe.

Floe will notify Customer of a Personal Data Breach affecting Personal Data without undue delay after becoming aware of it, and in any event within 72 hours of becoming aware. Notification will describe the nature of the breach, the categories and approximate number of Data Subjects and records affected so far as known, the likely consequences, and the measures taken or proposed. Where the full information is not available at once, Floe will provide it in phases without further undue delay.

Floe’s notification is not an acknowledgement of fault or liability. Report suspected security issues to security@floe.so.

On termination or expiry of the Terms, Floe will delete Personal Data within 30 days, except to the extent Floe is required by applicable law to retain it. Customer may export its Personal Data through the dashboard at any time during the subscription term and for 30 days after termination. Personal Data in backups is purged within 30 days of deletion from primary systems. Anonymised, aggregated data that cannot reasonably identify any individual is not subject to this Section.

Floe will make available to Customer information reasonably necessary to demonstrate compliance with GDPR Article 28, including its then-current third-party audit reports once available. Customer may, no more than once in any twelve-month period and on 30 days’ written notice, request an audit limited to information relevant to Floe’s processing under this DPA. Audits are subject to confidentiality obligations and must not unreasonably disrupt Floe’s business. A supervisory authority may audit where Data Protection Law requires it, without the frequency limit above.

Floe processes Personal Data in the United States. Where Customer transfers Personal Data subject to the GDPR to Floe, the parties agree that the Standard Contractual Clausesapproved by the European Commission in Implementing Decision (EU) 2021/914 (“SCCs”) are incorporated into this DPA by reference and apply as follows:

• Module Two (controller to processor) applies where Customer is a controller; Module Three (processor to processor) applies where Customer is itself a processor.
• Clause 7 (docking) applies. In Clause 9, Option 2 (general written authorisation) applies with the 30-day notice period in Section 5 above.
• In Clause 11, the optional independent dispute-resolution body does not apply. In Clause 17, the SCCs are governed by the law of Ireland. In Clause 18(b), disputes are resolved before the courts of Ireland.
• Annexes I, II and III to the SCCs are populated by Annex I, Annex II, and the sub-processor page referenced in Section 5 of this DPA respectively.

For transfers subject to the UK GDPR, the UK International Data Transfer Addendumto the SCCs (version B1.0) applies, with Tables 1 to 3 populated by the corresponding details in this DPA and Table 4 selecting “neither party”. For transfers subject to Swiss law, references to the GDPR are read as references to the Swiss FADP and the competent authority is the Swiss Federal Data Protection and Information Commissioner.

This DPA supplements the Terms. In the event of a conflict concerning the processing of Personal Data, the SCCs prevail over this DPA, and this DPA prevails over the remainder of the Terms. This DPA takes effect when Customer accepts the Terms and continues until Floe has deleted all Personal Data in accordance with Section 8.

If your organisation requires a countersigned copy of this DPA, contact legal@floe.so.

Subject matter. Provision of the Floe AI agent platform: running demo, onboarding, and support sessions, qualifying and scoring leads, and producing session analytics.

Duration. The term of the Terms, plus the retention and deletion periods described in Section 8 and in the Privacy & Data-Use Disclosure.

Nature and purpose. Collection, recording, transcription, storage, structuring, analysis, retrieval, disclosure to Customer, and erasure, for the purpose of delivering the Service.

Categories of Data Subjects.Customer’s personnel and authorised users; End Users who interact with a Floe-powered agent, including prospects, customers, and product users.

Types of Personal Data. Identity and contact data (name, email address, job title, company); conversation content (audio, video of the product UI as navigated by the agent, and text transcripts); device and network data (IP address, browser and device type, approximate location derived from IP); engagement and attribution data (referring URL, campaign parameters, pages viewed, actions taken); and derived qualification signals, including ICP fit scores.

Special categories. None. The Terms prohibit submitting special categories of personal data as defined in GDPR Article 9. Any such data submitted inadvertently is deleted on discovery.

Frequency. Continuous, for the duration of the Terms.

Competent supervisory authority.Determined under Clause 13 of the SCCs by reference to the Customer’s place of establishment or its EU representative.

• Encryption. TLS 1.3 in transit; AES-256 at rest. Demo Credentials are encrypted at rest in per-account isolated storage and are never shared across customers.
• Tenant isolation.Per-account data isolation enforced at the application and query layer, so one customer’s data is not commingled with another’s.
• Access control. Role-based access control with least-privilege enforcement; access to production limited to personnel who require it; authentication required for all administrative access.
• Agent guardrails. The Demo Agent is restricted from destructive actions — inviting or removing users, changing permissions, connecting integrations, sending real messages, or making purchases.
• Retention and deletion.Automated retention sweep purges session recordings and transcripts on the schedule described in the Privacy & Data-Use Disclosure; deletion propagates to backups within 30 days.
• Monitoring. Application error monitoring and performance tracing; logging of administrative activity.
• Vulnerability management. Dependency scanning and periodic security testing; remediation prioritised by severity.
• Incident response. Documented procedures with customer notification on the timeline in Section 7.
• Model training exclusion. Customer Data, Demo Credentials, and Demo Interaction Data are not used to train or fine-tune general-purpose AI models.

Floe’s SOC 2 Type II audit is in progress. See our Security documentation for current status and for controls available to enterprise customers.