Data Processing Agreement
Version 1 · Draft
DRAFT — pending review by Singapore counsel. Not yet in force.
This Data Processing Agreement forms part of the Merchant Agreement. You (the merchant) are the organisation in control of your customers' personal data; FLOW FN PTE. LTD. processes it on your behalf as a data intermediary under the PDPA.
Processing
We process customer data only to provide the service on your documented instructions (orders, subscriptions, emails, downloads, account area).
Security
We implement reasonable security arrangements including encryption in transit, access controls, tenant isolation enforced in the application and the database, and staff two-factor authentication.
Subprocessors
We use the subprocessors on our Subprocessors page and will notify you of changes.
Breaches
We notify you without undue delay after becoming aware of a data breach affecting your customers' data, so you can meet your obligation to notify the PDPC within 3 calendar days where required.
Return and deletion
On termination we make your data available for export for 30 days and then delete it, except where retention is required by law.