Data Processing Agreement

The Processor: Ashley Edwards, trading as Flows With (“we”). Our trading address is given on request at privacy@flowswith.com.

The Controller: the teacher or business named on the Flows With account (“you”), as recorded when the account was created.

You accept this Agreement by ticking the box when you create your account, or when you are asked to after it changes. It takes effect on that date, we keep a record of which version you accepted and when, and it forms part of our terms.

You are the controller, and we are the processor, of personal data about your own customers which is processed through Flows With (“the Service”).

Where we handle your own account details — your name, your sign-in email, your billing — we are a controller in our own right and this Agreement does not cover it. Our privacy notice does.

We process the personal data only:

• to provide the Service as described in its documentation;
• on your documented instructions, of which this Agreement and your use of the Service are the standing set; and
• as required by law, in which case we tell you first unless the law forbids it.

We do not process it for any purpose of our own. We do not use it to market anything, we do not sell or share it, and we do not use it to train machine learning models. If we believe an instruction breaches data protection law we will say so, and may decline to act on it.

• Subject matter: class booking, payment collection, class passes, waiting lists and transactional email for your classes.
• Duration: for as long as you use the Service, plus the deletion period in section 10.
• Nature and purpose: storing, organising, transmitting and deleting personal data so that customers can book and pay for classes and be told about them.
• Data subjects: your customers and prospective customers.

• Identity and contact: first name; last name, email address and phone number where given.
• Booking records: classes booked, when, attendance and no-shows, cancellations, and places held.
• Payment records: amounts, currency, method, status, Stripe's fee and the net, and Stripe's own reference. No card details: they are entered on Stripe's own pages and never reach the Service.
• Class pass records: which pass, what it cost, and the ledger of credits added and spent.
• Correspondence: a record of each transactional email sent, its recipient and its content.
• A free-text note you may keep against a customer.

The Service does not collect date of birth, postal address or emergency contacts.

Moving data in from another booking system

If you use the migration feature, you upload the exports your previous system produced. On your instruction we store the files in the Service’s database (never at an address anyone can open), read them to prepare a preview only you and our platform administrator see (every view and decision of whom is logged), and, once you have confirmed the preview and the administrator has approved it, write in only what the move needs: first and last name, email address, remaining class credits and their expiry, upcoming bookings, and a note of any money owed. The move sends no email to anybody.

An export may hold more than the Service collects, such as a postal address or notes. Those columns are never written into the Service; they exist only in the uploaded file until it is deleted.

Retention: the uploaded files, and the preview’s lists of named customers, are deleted automatically 14 days after the migration is finished, or 30 days after anyone last acted on one that was never finished. A record remains: which kind of file and its size, the counts moved, and the log of who did what, with no customer details. Immediately before data is written we take a point-in-time copy of the database so a mistake can be reversed; it deletes itself after 14 days.

You confirm you are entitled to transfer the data in your exports to the Service for this purpose. A customer who asks to be erased before the move is removed from the uploaded files before anything is written.

Health and other special category data

The Service is not designed to hold health data and must not be used for it. No health question is asked anywhere, and the customer note says on screen that it is not for medical details. If you enter information about injuries, pregnancy, medical conditions or other special category data, you do so as controller and outside our instructions.

You authorise the following sub-processors. Each is engaged under a written contract with data protection obligations no less protective than this Agreement.

• Neon: the database. London (UK).
• Vercel: running the application (London, UK) and storing images for booking pages (EU).
• Stripe: card payments and payouts. UK/EU, with group companies elsewhere.
• Postmark: sending transactional email. United States.
• Sentry: error reporting, with personal data removed before sending. EU.

Where a sub-processor handles data outside the UK, the transfer relies on the safeguards in that sub-processor’s own data processing terms under UK GDPR Article 46, such as the UK Addendum to the EU standard contractual clauses.

We will give you at least 30 days’ notice before adding or replacing a sub-processor. If you object on reasonable data protection grounds within that time, you may end the affected part of the Service without penalty.

We keep appropriate technical and organisational measures. As built, these are:

• Encryption in transit (HTTPS everywhere), and at rest as provided by the database and storage platforms.
• Tenant isolation: every query for customer data requires an account, so one teacher's data cannot be read from another's session, and a dedicated automated test suite for this must pass before any release. The database itself also refuses records that link two teachers' data.
• Passwords hashed with Argon2id, which we cannot read.
• Teacher sign-in with signed, HTTP-only session cookies, a verified email address and rate limiting. Customers have no password: they act through single-use signed links.
• No card data transmitted to or stored by the Service.
• A Content Security Policy with a per-request nonce, so a script we did not put there cannot run.
• Uploaded images re-encoded on the server, which strips embedded location data.
• Least privilege and multi-factor authentication on the administrative accounts of the platforms above.
• Backups with point-in-time recovery, in the same region as the database.

Measures may change as the Service develops, but not in a way that materially reduces security.

Anyone we allow to access the personal data is bound by a duty of confidence and given access only so far as their work requires.

Within the Service, at no extra charge:

• Access and portability: a complete per-customer export, as JSON and as a spreadsheet, and a whole-account export.
• Erasure: one step removes name, email, phone number and your note, cancels any email still scheduled to that person, and removes their address from records of email already sent, keeping booking and payment rows without identifying data because records of money taken must be kept.
• Rectification: you can edit customer details at any time.

So you can answer a data subject request straight away. Where you need more, we will help, and we will assist with data protection impact assessments and with consulting the Information Commissioner where those are required.

We will tell you without undue delay, and within 24 hours of becoming aware, of a personal data breach affecting your data, with what you need for your own 72-hour duty to the Information Commissioner: what happened, which categories and roughly how many people are affected, the likely consequences, and what is being done. Telling the people affected is your decision as controller, and we will help.

When you stop using the Service you can export everything with the tools in section 8. We will delete the personal data within 30 days, except where law requires it to be kept, and confirm in writing when we have. Backups expire on their own retention cycle and are not accessed for any other purpose.

We will make available the information needed to show we comply with this Agreement, and allow audits, including inspections, by you or an auditor you mandate: on reasonable notice, no more than once a year unless a breach or a regulator requires it, and in a way that does not compromise other customers’ confidentiality.

This Agreement prevails over anything inconsistent in our other terms as regards the processing of your customers’ data. It is governed by the law of England and Wales. Questions: privacy@flowswith.com.