Regulations on the commissioned processing of personal data

FlowLyne processes personal data of the customer in the context of the use of the services offered in accordance with Article 28 of the General Data Protection Regulation (GDPR). These regulations apply to all activities in which FlowLyne processes the customer's personal data on behalf of the customer.

Purpose: FlowLyne provides AI-supported telephone assistants that process personal data as part of the contractually agreed services.
Duration: The processing takes place for the duration of the use of FlowLyne's services. After the end of use, the regulations on data deletion apply (see point 9).

Type of processing: Storage, retrieval, organization, adaptation, transmission and deletion of personal data.
Purpose of processing: Provision of a telephone assistant to support the client's communication processes.
Categories of data concerned:

Affected persons: Customers, interested parties, suppliers and employees of the client as well as callers who interact with the AI telephone assistant.

FlowLyne undertakes to process personal data exclusively within the scope of the contractually agreed services.
FlowLyne ensures that all persons involved in processing are bound to confidentiality.
FlowLyne may only provide information to third parties or the data subject with the customer's prior consent. FlowLyne will forward any requests sent directly to FlowLyne to the customer without delay.
Technical and organizational measures (TOMs) are implemented in accordance with Art. 32 GDPR to ensure an adequate level of protection.
Support obligations of FlowLyne, in particular for:

the fulfillment of data subject rights (e.g. information, correction, deletion).
the implementation of data protection impact assessments.
the reporting of data breaches.

FlowLyne is entitled to use or change subcontractors for the processing of personal data without the prior consent of the customer being required.
However, FlowLyne undertakes to inform the customer of any changes or new subcontractors in text form at least 30 days before the subcontractor starts processing the data.
The customer has the right to object to the commissioning of a subcontractor if there is a legitimate interest (e.g. inadequate data protection measures). Such an objection must be declared in writing within 14 days of notification.
If no objection is raised, the commissioning of the subcontractor shall be deemed approved.
FlowLyne ensures that subcontractors are subject to the same data protection obligations.

FlowLyne is committed to ensuring an adequate level of protection for the processing of personal data. To this end, FlowLyne implements the following measures:
Encryption: All data transmissions are TLS-encrypted to ensure the confidentiality and integrity of the data during transmission.
Authentication: API accesses are authenticated by cryptographic keys to ensure that only authorized systems or persons have access to the data.
Securing sensitive data: Sensitive configuration data (e.g. access data, tokens) is securely stored in the Google Secret Manager to prevent unauthorized access. access data, tokens) are securely stored in the Google Secret Manager to prevent unauthorized access.
Access control: Access to systems and data is restricted by role-based permissions so that only authorized persons have access to the required information.
Logging: Access to personal data is logged to make potential incidents traceable and to detect unauthorized access.
Changes that do not impair the level of protection can be made as part of technical development. The customer will be notified of any significant changes.

The customer is responsible for the lawfulness of the processing.
The customer shall issue all orders, partial orders or instructions in documented form. In urgent cases, instructions may be issued verbally. The customer shall confirm such instructions in writing without delay.
The customer is entitled to exercise control rights, e.g. through audits or reports.

FlowLyne reports data breaches immediately, at the latest within 24 hours of becoming aware of them.
FlowLyne immediately forwards inquiries from affected parties to the customer.

Upon termination of the use of FlowLyne's services, all personal data of the customer will be either deleted or returned at the customer's discretion.
FlowLyne documents the proper deletion or return of the data.

FlowLyne is only liable for damages caused by a breach of these regulations or applicable data protection laws.
Liability is limited to the amount of the remuneration paid in the respective contract year. This limitation shall not apply in cases of intent or gross negligence.

These regulations are an integral part of FlowLyne's General Terms and Conditions. Amendments shall be made in accordance with the provisions set out in the General Terms and Conditions.
German law shall apply. The place of jurisdiction is Berlin.

Status: 30.10.2024