Data Processing Addendum

1. Roles

Your company decides what personal information goes into BatchFlow (for example your staff's names and signatures, and your customers' and suppliers' contacts) and why: it is the controller. We process that information only to provide the service, on your instructions: we are the processor.

2. What we commit to

• Process your data only to run the service and support you, and as the law requires.
• Keep it confidential; only staff who need to, and who are bound to confidentiality, can reach it, and support sees your setup only while your owner allows it.
• Protect it as our Security page describes.
• Tell you without undue delay, and within 72 hours, after we learn of a breach affecting your data.
• Help you answer requests from the people your records are about, and with assessments your regulators ask for.
• Let you export everything at any time, and delete it as the Terms of Service say when your plan ends.

3. Subprocessors

We use the service providers listed in our Privacy Policy (hosting, database, email, payments, and the integrations you choose to use). We'll tell you 30 days before adding one, and you may object.

4. Where data is processed

Your data is stored in the United States.

5. A signed copy

For a signed copy for your files, write to support@usebatchflow.com.