Data Processing Agreement (DPA)
This Data Processing Agreement (the “DPA”) governs the processing of personal data that International Flower Technology LLC (“Evoflor”, the “Processor”) carries out on behalf of the customer purchasing the Service (the flower shop, the “Controller”) when using Evoflor. It is entered into in accordance with Article 28 GDPR and forms part of the Terms and Conditions. In the event of a conflict regarding the processing of End Customer Data, this DPA prevails.
1. Subject matter and duration
The Processor will process personal data on behalf of the Controller to provide the Service throughout the term of the contractual relationship and until the data is returned or deleted in accordance with clause 9.
2. Nature and purpose of the processing
Storage, organisation, consultation and other operations needed to provide the flower shop management features: customers, orders, deliveries and routes, invoicing, events and communications with end customers.
3. Types of data and categories of data subjects
- Categories of data subjects: customers, senders and recipients of the Controller’s orders.
- Types of data: identification data (name), contact data (phone, email, delivery address), order data (products, amounts, card messages or notes) and purchase history. The Controller undertakes not to enter special categories of data unless essential and with a legal basis for doing so.
4. Obligations of the Processor
Evoflor, as Processor, undertakes to:
- process the data only on the Controller’s documented instructions (including use of the Service), unless required by law;
- ensure the confidentiality of authorised personnel;
- apply the security measures in clause 6 (Art. 32 GDPR);
- assist the Controller in responding to data subjects’ rights and in meeting its obligations (clauses 7 and 8);
- not engage sub-processors without the authorisation in clause 5;
- return or delete the data at the end of the service (clause 9);
- make available to the Controller the information needed to demonstrate compliance and allow reasonable audits.
5. Sub-processors
The Controller gives general authorisation for the Processor to engage the following sub-processors, with whom it has signed processing agreements with appropriate safeguards:
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase, Inc. | Database, authentication and file storage | European Union (Ireland) |
| Vercel, Inc. | Hosting and delivery of the web application | USA (standard contractual clauses / Data Privacy Framework) |
| Google Ireland Ltd. (Maps Platform) | Geocoding and autocompletion of delivery addresses | USA (standard contractual clauses / Data Privacy Framework) |
| Resend, Inc. (planned) | Sending transactional emails (alerts and notifications) | USA (standard contractual clauses / Data Privacy Framework) |
| Functional Software, Inc. (Sentry) | Technical error logging for diagnostics | European Union (Germany) |
| Google Ireland Ltd. (Google Analytics) | Aggregated analytics for the public website (only with consent) | USA (standard contractual clauses / Data Privacy Framework) |
| PostHog, Inc. (planned) | Product usage analytics (aggregated data) | European Union |
The Processor will inform the Controller of any intended change to the list of sub-processors, giving the Controller the opportunity to object on reasonable grounds related to data protection.
6. Security measures
The Processor applies, among others, the following measures:
- encryption of data in transit (TLS) and at rest;
- strict isolation of each customer’s data (row-level security in the database);
- role-based access control (owner, florist, driver) with least privilege;
- audit logging of sensitive operations;
- regular backups and recovery procedures;
- hosting of the Service’s data in the European Union.
7. Assistance to the Controller
Taking into account the nature of the processing, the Processor will assist the Controller, through the features of the Service or through support, in responding to requests from data subjects exercising their rights and in complying with its obligations regarding security, breach notification and impact assessments where applicable.
8. Notification of security breaches
The Processor will notify the Controller without undue delay after becoming aware of any personal data breach affecting the data processed on its behalf, with the information available so that the Controller can meet, where applicable, its obligations to notify the supervisory authority and the data subjects.
9. Termination: return or deletion
At the end of the service, the Processor will, at the Controller’s choice, return or delete the personal data and delete existing copies, unless it must retain them under a legal obligation. A reasonable period will be provided for the Controller to export its data before deletion.
10. International transfers
Where a sub-processor processes data outside the European Economic Area, such transfers will be covered by appropriate safeguards (the European Commission’s standard contractual clauses and/or the Data Privacy Framework).
11. Liability and governing law
The parties’ liability is governed by the GDPR and the Terms and Conditions. This DPA is governed by Spanish law.
12. Contact
For any question regarding this DPA: privacidad@evoflor.com.