LegalDocument version: dpa-2026-10-13
OnFlow Data Processing Agreement — Cover Page
Based on: Common Paper DPA Standard Terms Version 1.1 (CC BY 4.0)
Last updated: 13 October 2026.
This Cover Page and the Common Paper DPA Standard Terms Version 1.1 (incorporated by reference) form the DPA between Provider and Customer. It supplements the OnFlow Customer Agreement (CSA). This DPA describes Provider's Processing. It does not by itself make Customer compliant with Applicable Data Protection Laws.
Parties & contacts
| Field | Value |
|---|---|
| Provider (Processor / Subprocessor) | Aaptera Ltd (company number 16869753), a company registered in England and Wales, trading as OnFlow. Registered office: Aaptera Ltd, 7 Jossey Lane, Doncaster, England, DN5 9DB. |
| Provider notice address | [email protected] (monitored). This is the address for legal notices, privacy requests, and security contacts. |
| Privacy contact | Privacy contact: [email protected]. Provider has not appointed a data protection officer. |
| Provider Security Contact | [email protected] |
| EU representative (Article 27 GDPR) | [EU representative to be confirmed] |
| Customer | The Controller (or Processor) that is party to the OnFlow Customer Agreement |
| Underlying Agreement | OnFlow Customer Agreement (Cloud Service Agreement) including Key Terms accepted at signup/checkout |
| Governing Member State (EEA SCCs) | Ireland (default) |
| UK / primary supervisory focus | United Kingdom (UK GDPR / Data Protection Act 2018); ICO |
| Security Policy | Annex II of this Cover Page |
Modifications to the Standard Terms
| Topic | Modification |
|---|---|
| Security Reports | Provider does not currently hold third-party certifications (for example SOC 2 or ISO 27001) and does not currently hold a Report from an independent third-party auditor. The Security Reports paragraph of the Standard Terms applies only once Provider notifies Customer that a Report is available. Until then, Provider meets its information and audit obligations through the Security Policy (Annex II) and Security Due Diligence and, where Applicable Data Protection Laws require, by allowing an audit by Customer or its mandated auditor on at least 30 days' notice, during business hours, at Customer's cost, no more than once in any 12 months (except following a Security Incident or a request from a supervisory authority). |
| Personnel | Provider ensures that personnel authorised to Process Customer Personal Data are bound by written confidentiality obligations or an appropriate statutory duty of confidentiality. |
| Instructions and assistance | Provider will promptly inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Laws. Provider will assist Customer, taking into account the nature of the Processing and the information available to Provider, with Customer's obligations under Articles 32 to 36 of the UK GDPR and, where they apply, the EU GDPR (security, breach notification, data protection impact assessments, and prior consultation). |
Annex I — Processing details
A. List of parties
As in the Parties table above. Roles: Customer = Controller (or Processor when Customer processes for its own customers); Provider = Processor (or Subprocessor).
Provider acts as an independent Controller for account administration, authentication and security logging, billing, and service communications, as described in the OnFlow Privacy Policy (https://onflowapp.com/privacy). Those activities are not Processing under this DPA.
B. Description of Processing
| Item | Description |
|---|---|
| Subject matter | Provision of the OnFlow Cloud Service |
| Nature and purpose | Hosting, storage, retrieval, transmission, deletion, and other Processing needed to operate multi-tenant records, workflows, automations/agents, plugins, reports, MCP access, and support relating to Customer Content. Billing, account administration, authentication and security logging, and service communications are Provider's own controller activities and are described in the Privacy Policy, not in this row. |
| MCP / AI agents | When Customer connects MCP clients or enables agents, Provider Processes Customer Personal Data contained in prompts, tool calls, and write-back to create, update, or delete records solely on Customer's instructions via Customer's configuration and authenticated Users/integrations. In-app AI features use Google Vertex AI (Gemini) under Provider's Google Cloud project (see Subprocessors). Neither Provider nor Google uses Customer Personal Data, including prompts and tool inputs and outputs, to train or fine-tune models. |
| AI and embedding location (Vertex AI) | Core Customer Content (records and files) is hosted in the United Kingdom (europe-west2, Google Cloud). Generative AI (chat, agent and MCP actions, and daily briefings) and the generation of search embeddings are processed using Google Vertex AI in the global location. That processing may take place outside the United Kingdom and the European Union. Embedding vectors are stored with the Cloud Service in the United Kingdom after generation. Processing of AI and embeddings in the UK or the EU is available on Enterprise plans by agreement, and is not a self-serve option. Contact [email protected]. |
| Model training | Neither Provider nor Google Vertex trains or fine-tunes models on Customer Content. |
| Duration | For the term of the Agreement. On termination, Customer may export Customer Content for 30 days. Provider will then delete Customer Personal Data from production systems within 30 days, and from backups as those backups expire. Backups are retained for 7 days. Longer backup retention is available on Enterprise plans by agreement. Provider may retain data for longer where Applicable Law requires it. Invoices and billing records, which Provider holds as controller, are kept for 6 years. |
| Categories of Data Subjects | Customer's Users (employees and contractors); Customer's own customers, contacts, and end users whose data Customer stores in records; other individuals whose Personal Data Customer elects to submit |
| Categories of Personal Data | Content Customer stores in custom fields and records (which may include contact, commercial, or other business data); prompts, tool inputs and outputs; and support correspondence to the extent it relates to Customer Content. Special Category Data: not intended. Customer must not submit Special Category Data unless authorised in writing. Account identifiers, authentication and security logs, billing data, and service communications are Processed by Provider as controller, as described in the Privacy Policy. |
| Frequency of transfer | Continuous, as initiated by Customer's use of the Service |
C. Competent supervisory authority
United Kingdom Information Commissioner's Office (ICO) for UK GDPR Processing; as required under the EEA SCCs for EEA transfers.
Annex II — Technical and organisational measures (Security Policy)
This Annex II is the Security Policy.
Provider maintains measures consistent with industry practice for multi-tenant SaaS, including: access control and authentication; tenant isolation controls; encryption in transit (TLS); encryption at rest where provided by infrastructure; logging and monitoring; least-privilege access for staff; backup and recovery; vulnerability management; and Security Incident response as in the DPA Standard Terms.
Primary hosting region for records, files, and databases: GCP europe-west2 (United Kingdom). Generative AI and embedding generation use Google Vertex AI in the global location and may be processed outside the United Kingdom and the European Union. See Annex I, "AI and embedding location (Vertex AI)".
Backups of production systems are retained for 7 days. Longer backup retention is available on Enterprise plans by agreement.
Provider does not currently hold third-party certifications (for example SOC 2 or ISO 27001). A description of these measures is available on request via [email protected].
Annex III — Approved Subprocessors
Customer approves the following Subprocessors as of the Effective Date of the Agreement. Provider will notify changes by email to the account owner and by updating this page, at least 10 business days before the change takes effect, as required by the DPA Standard Terms.
| Subprocessor | Location of processing | Anticipated Processing |
|---|---|---|
| Google Cloud EMEA Limited (Ireland) and Google LLC (United States), including Vertex AI / Gemini used for in-app AI, embeddings, and agent reasoning when Customer enables those features | europe-west2 (United Kingdom) for core hosting, storage, and databases. Vertex AI in the global location for generative AI and embedding generation, which may be outside the United Kingdom and the European Union. UK or EU Vertex processing is available on Enterprise plans by agreement. | Application hosting, storage, databases, backups, and networking; Provider-operated generative AI and embeddings. Covered by Google's Cloud Data Processing Addendum. |
| Cloudflare, Inc. (United States) | Global edge network (United States headquarters) | Content delivery, DDoS protection, and TLS termination for onflowapp.com and app.onflowapp.com, including transient processing of traffic that may include Customer Content in transit |
| Stripe Payments Europe, Limited (Ireland) and Stripe, Inc. (United States) | United States and the EEA, as applicable under Stripe's terms | Payment processing, invoicing, and tax calculation |
| Resend, Inc. (United States) | As per Resend's then-current infrastructure disclosures | Transactional email (signup, verification, and notifications) |
Google Analytics, where used on the public website, is a processor for website analytics under the Google Analytics data processing terms, which Provider has accepted. It does not process Customer Content stored in the Cloud Service. It is described in the Privacy Policy.
International transfers
Restricted Transfers use the mechanisms in DPA Standard Terms sections 3.2 to 3.4 (EEA SCCs Modules 2 and 3, the UK Addendum, and Swiss adaptations) completed by this Cover Page, together with the data processing terms Provider has accepted with each Subprocessor.
Attribution
Incorporates Common Paper DPA Standard Terms v1.1 under CC BY 4.0. OnFlow-specific content is limited to this Cover Page and annex tables.
The same Customer Agreement and DPA apply to the product on onflowapp.com. Website browsing on those hosts is covered separately by their terms and privacy policy (onflowapp.com terms, onflowapp.com privacy).