Data Processing Agreement

Draft — not yet published

1. Controller / processor roles

The customer (a Studio or Solo account holder) is the data controller for the personal data of their own clients and team members that they enter into InkFlow. InkFlow acts as the data processor for that data.

2. Subject matter and duration of processing

TODO: the exact duration language, tied to the term of the underlying subscription, has not yet been finalized.

3. Nature and purpose of processing

InkFlow processes personal data to provide the InkFlow workspace functionality — storage, retrieval, display, and transmission of the data the customer enters, such as client records, forms, and messages.

4. Categories of data subjects

The customer's own clients, and the customer's team members (staff or employees invited to a Studio account).

5. Categories of personal data

Names, contact details, appointment records, form and consent responses (potentially including health-related answers), and staff account details.

Health-related data is handled with additional care. TODO: a specific "special category data" legal framework claim requires legal review before this document can state one.

6. Subprocessors

TODO: the list of subprocessors has not yet been finalized for publication (see the Privacy Policy's Processors section).

7. Security measures

TODO: as with the Privacy Policy, a general statement that technical and organizational measures are used applies here, with no specific certifications claimed.

8. Breach notification

InkFlow will notify the customer of a personal data breach without undue delay. TODO: an exact contractual notification timeline has not yet been decided.

9. Deletion / return of data

TODO: the exact process and timeline for returning or deleting customer data on termination have not yet been decided. This will define what happens to data on account termination, in coordination with the Terms of Service's Termination section.

10. Audit / cooperation

TODO: the exact audit rights and process have not yet been decided.

11. International transfers

TODO: as with the Privacy Policy, hosting region and any applicable transfer mechanism have not yet been decided or documented.