When we work for an organization

1. Roles and scope

2. Subject matter, duration, nature, and purpose

3. Categories of data subjects and personal data

4. Processing instructions

Pilotflows processes personal data only on documented instructions from the Controller, including the main services agreement, product configuration, support requests the Organization initiates, and this DPA, unless required to do otherwise by applicable law. In that case, we will inform the Controller before processing, unless the law prohibits such notice. Use of the Services constitutes instructions to process personal data as needed to deliver the configured features.

5. Confidentiality

Pilotflows ensures that persons authorized to process personal data are bound by appropriate confidentiality obligations — by contract, professional duty, or statute — and that access is limited to personnel who need it to perform their roles.

6. Security measures

Taking into account the state of the art, implementation costs, and the nature, scope, context, and purposes of processing, Pilotflows implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk. Those measures are described in our Security Policy, which is incorporated by reference for the purposes of this DPA.

7. Sub-processors

8. Assistance with data subject requests

Taking into account the nature of the processing, Pilotflows assists the Controller by appropriate technical and organizational measures, insofar as possible, for fulfilling the Controller’s obligation to respond to data subject requests. The Organization remains responsible for verifying and responding to requests about organization-managed personal data; Pilotflows will not respond as controller for that data except where required by law or expressly instructed by the Organization.

9. Personal data breaches

If Pilotflows becomes aware of a personal data breach affecting organization-managed personal data we process on behalf of the Controller, we will notify the Controller without undue delay and provide information reasonably available to help the Controller meet its own notification obligations. Investigation, mitigation, and notifications when we act as an independent controller are further described in section 9 (Data breach) of our Privacy Policy.

10. Deletion or return on termination

At the end of processing services, Pilotflows will, at the Controller’s choice and subject to available product features, delete or return organization-managed personal data and delete existing copies, unless applicable law requires storage. Backup and archival copies may persist for a limited period consistent with our retention practices, then be deleted in the ordinary course. Deletion options are described in product documentation and the Privacy Policy.

11. Audit rights

Pilotflows makes available information necessary to demonstrate compliance with this DPA, and allows for and contributes to audits, including inspections by the Controller or an auditor it mandates, subject to reasonable notice, confidentiality, security, and operational constraints. Where possible, audits rely on documentation, certifications, or reports we already maintain. On-site audits require mutual agreement on scope, timing, and cost allocation where not mandated otherwise by law.

12. International transfers

Where personal data is transferred outside the EU/EEA in connection with the Services, Pilotflows uses appropriate safeguards such as the European Commission’s Standard Contractual Clauses (SCCs) or other mechanisms recognized under applicable data protection law — consistent with section 6 of our Privacy Policy. Sub-processor locations are indicated in Annex A.

13. Contact

Questions about this DPA or processing under it: [email protected]
Tegi S.à r.l.-S., Luxembourg

Annex A — Authorized subprocessors

The following subprocessors may process personal data on behalf of Pilotflows in connection with the Services. Current as of 17 October 2026. Operational vendors that do not process customer personal data as subprocessors (for example internal issue tracking) are omitted here and may appear on our What Powers Us page.