Data Processing Agreement

Concluded pursuant to Article 28 of Regulation (EU) 2016/679 (GDPR) Version 1.1 | Effective from 1 November 2026

This is a translation of the Czech original. In the event of any discrepancy between language versions, the Czech version prevails.

Recitals

This data processing agreement (the „Agreement") forms an integral part of the contract for the provision of the flowlogis service concluded under the Terms of Service (the „Main Contract").

The parties:

• Controller — the organisation that has created an account on the flowlogis platform and whose identification details are stated in its profile on the platform.
• Processor — Jan Prokop, company ID 01680188, registered address Lomená 668, 294 04 Dolní Bousov, Czech Republic, operator of the flowlogis platform.

This Agreement is deemed concluded at the moment the Main Contract is concluded, that is, upon confirmation of the order by the Processor. At the Controller's request, the Processor will issue a separately signed counterpart of this Agreement.

The Controller declares that, in relation to personal data entered on the platform, it is the controller within the meaning of Article 4(7) GDPR and that the processing is carried out on a legal basis determined by it.

1. Subject matter and scope of processing

1.1 The Processor processes personal data solely for the purpose of providing the flowlogis platform to the Controller within the scope agreed in the Main Contract.

1.2 A detailed description of the processing is set out in Annex A.

1.3 This Agreement does not apply to processing in which the Processor acts as an independent controller, in particular registration and billing data. That is governed by the Privacy Policy.

2. Duration

2.1 This Agreement is effective for the duration of the Main Contract, including any period during which the Controller's account is kept in read-only mode under the Terms of Service.

2.2 Provisions that by their nature are intended to survive, in particular those on confidentiality, deletion of data and liability, remain in force after its termination.

3. Controller's instructions

3.1 The Processor processes personal data only on documented instructions from the Controller, including with regard to transfers to a third country, unless required to do so by Union or Member State law; in such a case the Processor informs the Controller in advance, unless that law prohibits it on important grounds of public interest.

3.2 The following are deemed documented instructions of the Controller:

a) this Agreement and the Main Contract; b) configuration and settings made by the Controller on the platform; c) ordinary use of the platform by the Controller's users, that is, entering, editing, deleting and sharing data; d) separate written instructions sent to info@flowlogis.com.

3.3 The Processor immediately informs the Controller if, in its opinion, an instruction infringes the GDPR or other data protection legislation, and may refuse to carry out such an instruction.

3.4 The Processor does not use the Controller's personal data for its own purposes. In particular, it does not sell or rent it, use it for its own marketing or use it to train machine learning models.

4. Confidentiality

4.1 The Processor ensures that persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. This obligation continues after the end of their activity for the Processor.

4.2 Only persons who require it in order to perform the Main Contract have access to the Controller's personal data.

5. Security of processing

5.1 The Processor has implemented the technical and organisational measures under Article 32 GDPR described in Annex C.

5.2 The Processor may update these measures but must not reduce the overall level of security.

5.3 The Controller confirms that it considers the measures under Annex C appropriate having regard to the nature of the processing. The Controller expressly acknowledges point C.3 of Annex C concerning the scope of backups.

6. Sub-processors

6.1 The Controller gives the Processor general authorisation to engage sub-processors on the conditions set out in this Article.

6.2 The current list of sub-processors is set out in Annex B.

6.3 The Processor informs the Controller of any intended addition or replacement of a sub-processor at least 30 days in advance by e-mail to the Controller's contact address.

6.4 The Controller may raise a reasoned objection to the change within 15 days of the notification. If no agreement is reached, the Controller may terminate the Main Contract as of the date the new sub-processor is deployed and is entitled to a refund of the proportionate part of the price paid.

6.5 The Processor imposes on every sub-processor, by contract, the same data protection obligations as are set out in this Agreement, and remains fully liable to the Controller for the performance of their obligations, in accordance with Article 28(4) GDPR.

7. Transfers to third countries

7.1 Personal data is stored exclusively on servers within the European Union, in Ireland.

7.2 The sub-processors listed in Annex B are established in the United States. Even where data is stored in the European Union, access by their support staff from a third country cannot be excluded. For such cases, transfers are covered by:

a) certification under the EU–U.S. Data Privacy Framework pursuant to the European Commission's adequacy decision of 10 July 2023, or b) the standard contractual clauses under Commission Implementing Decision (EU) 2021/914, together with a transfer impact assessment and supplementary technical measures, in particular encryption in transit and at rest.

7.3 The Processor will provide the Controller with a copy of the safeguards applied on request.

8. Assistance with data subject rights

8.1 The Processor assists the Controller by appropriate technical and organisational measures in fulfilling its obligation to respond to requests from data subjects under Articles 12 to 23 GDPR.

8.2 The platform enables the Controller to locate, rectify, export and delete data by its own means. Where handling a request requires the Processor's intervention, it will be provided without undue delay and no later than five business days after receipt of the Controller's request.

8.3 If a data subject addresses a request directly to the Processor, the Processor does not handle it itself and forwards it to the Controller without undue delay.

8.4 Assistance beyond the ordinary scope — in particular repeated or extensive requests, completion of lengthy security questionnaires, participation in an on-site audit or forensic analysis — may be charged by the Processor at a rate of CZK 1,500 per hour, subject to the Controller's prior approval.

9. Assistance with the Controller's other obligations

9.1 The Processor assists the Controller in fulfilling its obligations under Articles 32 to 36 GDPR, in particular in ensuring the security of processing, in notifying personal data breaches and in carrying out data protection impact assessments.

9.2 Assistance is provided taking into account the nature of the processing and the information available to the Processor.

10. Personal data breaches

10.1 If the Processor becomes aware of a breach of the security of the Controller's personal data, it notifies the Controller without undue delay and no later than 48 hours after becoming aware of it.

10.2 The notification contains, to the extent available, a description of the nature of the breach including the categories and approximate number of data subjects and records concerned, contact details for obtaining further information, a description of the likely consequences, and a description of the measures taken or proposed.

10.3 Where not all information is available at once, the Processor provides it in phases without further undue delay.

10.4 Notification to the supervisory authority and to data subjects is made by the Controller. The Processor provides the necessary assistance and documentation.

10.5 The Processor maintains records of security breaches.

11. Audits and inspections

11.1 The Processor makes available to the Controller the information necessary to demonstrate compliance with Article 28 GDPR.

11.2 The Processor allows for and contributes to audits, including inspections, conducted by the Controller or an auditor mandated by it, subject to the following conditions:

a) an audit may be carried out no more than once every twelve months, save in the case of a security breach or a request by a supervisory authority; b) an audit must be announced in writing at least 30 days in advance; c) an audit takes place during business hours in the manner least disruptive to operations and must not interfere with other customers' data; d) the auditor must not be a competitor of the Processor and must be bound by confidentiality; e) the costs of the audit are borne by the Controller unless the audit reveals a material breach of the Processor's obligations.

11.3 The Processor may satisfy an audit request in the first instance by submitting current security documentation, a completed security questionnaire, or certificates and independent auditor's reports of its infrastructure providers.

12. Deletion and return of data

12.1 After the end of the provision of the service, the Processor, at the Controller's choice, returns the personal data in the form of an export or deletes it, including existing copies, unless Union or Member State law requires storage.

12.2 Unless the Controller chooses otherwise, Article 7 of the Terms of Service applies: the account is switched to read-only mode for twelve months; upon expiry the Controller is notified and has a further 30 days to export its data; after that period elapses without action the data is permanently deleted. Throughout that time, export is available in JSON and XLSX formats.

12.3 The Controller may request export or deletion of the data at any earlier time; the Processor will comply without undue delay.

12.4 On request, the Processor will issue the Controller with written confirmation of the deletion performed.

13. Liability

13.1 The liability of the parties is governed by Article 82 GDPR and by the relevant provisions of the Main Contract.

13.2 The limitation of liability agreed in the Main Contract also applies to this Agreement; it does not, however, apply to the extent that it would conflict with mandatory provisions of the GDPR.

13.3 The Controller is responsible for the lawfulness of the processing, for the existence of a legal basis, for fulfilling the information obligation towards data subjects and for the accuracy and adequacy of the data entered.

14. Final provisions

14.1 In the event of a conflict between this Agreement and the Main Contract, this Agreement prevails in matters of personal data protection.

14.2 The Processor may update this Agreement in accordance with Article 14 of the Terms of Service, in particular in response to changes in legislation or decisions of supervisory authorities. An update must not reduce the level of protection of personal data.

14.3 This Agreement is governed by the law of the Czech Republic. The Czech language version is authoritative.

Annex A — Description of the processing

A.1 Subject matter Provision of the flowlogis cloud platform for production planning, logistics, purchasing and ordering of transport (Transport module), project management and related activities.

A.2 Nature and purpose of the processing Storage, structuring, display, modification, retrieval, sharing within the organisation, export, dispatch of related e-mail notifications and deletion of personal data entered by the Controller, solely for the purpose of making the platform's functions available to the Controller.

In the Transport module, additionally: sending inquiries, tender invitations, orders and reminders to carriers contacted by the Controller, on the Controller's behalf; making the relevant document available to the contacted carrier; and receiving the carrier's bids, responses, messages and attachments for the Controller.

A.3 Duration of the processing For the duration of the Main Contract and thereafter in accordance with Article 12 of this Agreement.

A.4 Categories of data subjects

• employees and collaborators of the Controller who are users of the platform;
• contact persons of the Controller's customers, suppliers and business partners;
• persons named by the Controller in projects, tables, tasks, reports and attachments;
• carriers and their contact persons whom the Controller keeps in its carrier directory or contacts in the Transport module, including persons who respond to inquiries, tenders and orders on behalf of a carrier.

A.5 Categories of personal data

A.6 Special categories of data Processing of special categories of personal data under Article 9 GDPR and of data under Article 10 GDPR is neither envisaged nor permitted, unless the parties agree otherwise in writing.

A.7 Contact points For the Processor: info@flowlogis.com. For the Controller: the administrator's contact e-mail stated on the platform.

Annex B — List of sub-processors

The scope of data transferred to Upstash, Inc. is limited to an IP address or user identifier and a request counter. No names, e-mail addresses or content data are transferred.

The source code version control tool contains no production data of the Controller and is therefore not a sub-processor.

Last updated: 1 November 2026

Annex C — Technical and organisational measures

C.1 Access control

• Authentication by e-mail and password; passwords are stored solely as cryptographic hashes.
• Minimum password length of twelve characters. Two-factor authentication is not currently available.
• Separation of individual organisations' data at database level using Row Level Security. A user has no technical means of accessing another organisation's data.
• Administrator and user roles, with access to modules governed by explicit assignment.
• Sharing of projects only upon an explicit action by an authorised user.
• Request rate limiting at application and server function level.
• Carriers contacted in the Transport module access only the document to which they have been invited, through a link with a random access token of which only a cryptographic hash is stored in the database. The link is bound to a single invitation, has limited validity and, once opened, is exchanged for a session in a secure cookie. A carrier does not see other carriers' bids or their number.

C.2 Encryption

• All communication is encrypted using TLS 1.2 or higher.
• Data at rest is encrypted on the database platform provider's side.

C.3 Availability and resilience

• Data is stored on the redundant storage of the database platform provider in Ireland.
• Automated backups with point-in-time recovery are not currently part of the scope of the service. The Controller is therefore advised to export its data regularly using the platform's own tools. Any extension of the scope of the service will be notified to the Controller in accordance with Article 14.2.

C.4 Integrity and records

• Owner and time of creation and of the last change are recorded for every project.
• Access and error logs are maintained by the platform providers to the extent provided by their plans.
• In the Transport module, an audit trail of changes to inquiries, tenders, prices and orders is maintained (who made which change and when). In the other modules, a separate application-level audit trail is not currently maintained.

C.5 Organisational measures

• Access to production data is limited to the necessary group of persons, who are bound by confidentiality.
• Development and production environments are separated.
• Source code is kept in a private repository with automated scanning for credential leaks and automated dependency update checks.
• A procedure for handling security incidents is in place, including the notification deadlines under Article 10.

C.6 Data minimisation

• Only data necessary for the provision of the service is collected.
• The platform supports export and deletion of data at project and organisation level.