DPA — Data Processing Agreement

ClikFlow commits to:

• Processing personal data only in accordance with documented instructions from the Controller and within the scope of this DPA;
• Ensuring that persons authorised to process the data are subject to confidentiality obligations;
• Implementing appropriate technical and organisational measures to protect the data (see Security Policy);
• Assisting the Controller in fulfilling its obligations to data subjects (access, correction, deletion, portability);
• Deleting or returning all personal data at the end of the contract, as chosen by the Controller;
• Making all information necessary to demonstrate compliance available and supporting audits;
• Notifying the Controller within 72 hours of becoming aware of any data breach affecting data under this DPA.

The Controller represents and warrants that:

• It holds an adequate legal basis (LGPD art. 7) for processing the personal data in the uploaded logs;
• Data subjects have been duly informed about the processing, as required by LGPD art. 9;
• It will not upload sensitive personal data (LGPD art. 11) without first notifying ClikFlow and obtaining approval;
• It will inform ClikFlow of any data subject request that requires Processor support;
• It will maintain a record of processing activities pursuant to LGPD art. 37.

ClikFlow may engage sub-processors to deliver the service. All sub-processors are bound to data protection obligations equivalent to this DPA. The Controller grants general authorisation to the following sub-processors:

ClikFlow will notify the Controller 30 days in advance of any addition or replacement of sub-processors. The Controller may object within that period; if no agreement is reached, either party may terminate the contract without penalty.

ClikFlow implements the technical and organisational measures described in the Information Security Policy, including without limitation:

• Encryption in transit (TLS 1.2+) and at rest (AES-256);
• Access control with MFA and least-privilege principle;
• Continuous monitoring and incident management;
• Annual penetration tests by an independent specialist firm;
• Geo-redundant backups with a 4-hour RTO.

Where personal data is transferred outside Brazil (e.g. sub-processors in other countries), ClikFlow will ensure the transfer takes place on the basis of:

• A country with an adequate level of protection recognised by the ANPD; or
• Standard contractual clauses; or
• The data subject's specific consent, where applicable (LGPD art. 33, VIII).

When a data subject exercises their rights (LGPD art. 18) directly with ClikFlow:

• ClikFlow will forward the request to the Controller within 5 business days;
• ClikFlow will support the Controller with the technical tools needed to fulfil the request (access, export, deletion);
• The Controller remains responsible for the final response to the data subject.

The Controller may, upon 30 days' written notice and at most once per year, request:

• Audit reports and compliance certifications (ISO 27001, SOC 2);
• Security questionnaires (CAIQ, SIG, or equivalent);
• On-site or remote audit at the Controller's expense, conducted by an independent auditor agreed by both parties.

Upon termination of the contract, for any reason:

• The Controller may export all data and saved investigations for up to 30 days after termination;
• After 30 days, ClikFlow will permanently delete all Controller data;
• ClikFlow will issue, upon request, a data deletion certificate.

Each party is responsible for complying with its obligations under this DPA and the LGPD. In the event of a breach:

• The breaching party shall be liable for damages directly caused by the breach;
• ClikFlow's liability as Processor is limited to damages resulting from its failure to follow the Controller's instructions or this DPA;
• The Controller shall indemnify ClikFlow against any third-party claims arising from the Controller's breach of its obligations as Controller.