Data Processing Agreement

1. Parties and roles

The Customer (you, the holder of an SEO Conquest account) is the controller of the personal data contained in the websites and content you manage through SEO Conquest. FLOWMATIC S.R.L., tax id (CUI) 52891900, trade registry J2025087179005, Str. Vasile Alecsandri, bl. 66A, sc. A, parter, ap. 1, Pitești, Argeș 110377, Romania("Flowmatic") is the processor. For your own account data (email, billing identity, logs) Flowmatic is the controller, as described in the Privacy Policy.

2. Subject matter, duration, nature and purpose

Subject matter: the personal data that appears in the sites you connect, the content we import from them, the content we generate and publish for you, and the search and AI-visibility data we collect about your sites. Duration: the life of your SEO Conquest account, plus the deletion period in section 10. Nature and purpose: hosting, analysis, generation, publishing and reporting, only to provide the SEO Conquest service.

3. Categories of data and data subjects

Data: names, contact details, job titles, quotes and images that appear on your website or in the content you ask us to produce; identifiers of your platform accounts. Data subjects: your staff, your customers, the authors and people mentioned on your website, and the visitors of your site as far as their data reaches us through your platform.

4. Instructions

Flowmatic processes personal data only on your documented instructions. These Terms, the settings you choose in the app and the actions you take there are those instructions. If we believe an instruction breaks the law, we tell you. If the law of the EU or of a member state requires us to process the data otherwise, we inform you before we do, unless the law forbids it.

5. Confidentiality

Everyone at Flowmatic who can access your data is bound by a duty of confidentiality and gets access only as far as their role requires.

6. Security measures

• Encryption in transit (TLS) for every connection to and from the service.
• Encryption at rest (AES-256-GCM) for platform credentials; hashed passwords.
• Access control: named accounts, least privilege, tenant isolation at the database layer.
• Logging: an audit trail of sign-ins and administrative actions.
• Backups of the database, stored under the same access rules.
• Rate limiting and abuse detection on public endpoints.

7. Sub-processors

You authorise the sub-processors listed in section 4 of the Privacy Policy. Before adding a new sub-processor we notify you by email or in the app at least 15 days in advance. You may object on reasonable data protection grounds within that period; if we cannot address the objection, you may cancel the affected service. Flowmatic remains responsible to you for the work of its sub-processors.

8. Assistance with data subject rights

Taking the nature of the processing into account, Flowmatic helps you answer requests from data subjects (access, rectification, erasure, restriction, portability, objection). If such a request reaches us directly, we forward it to you without answering on your behalf, unless the law requires otherwise.

9. Breach notification

If we become aware of a personal data breach affecting your data, we notify you without undue delay and no later than 72 hours after becoming aware of it, with the information we have at that time and updates as we learn more, so you can meet your own notification duties. We also assist you with data protection impact assessments and prior consultations where our processing is involved.

10. Deletion and return

When the service ends, you can export your content from the app. Within 30 days after the account is closed we delete the personal data we hold for you, unless EU or member state law requires us to keep it (for example invoices). Backups are overwritten on their normal rotation.

11. Audit

On request we provide the information needed to show that we meet our obligations under GDPR art. 28, including summaries of our security measures and of relevant provider reports. Where that is not enough, you may audit us, or mandate an independent auditor to do so, once a year, on 30 days' notice, during business hours and without disrupting the service. You bear the cost of the audit.

12. Transfers

Personal data is stored in the EU. Some sub-processors are outside the European Economic Area; those transfers rely on an EU adequacy decision or on the Standard Contractual Clauses, as set out in each provider's data processing terms (see section 5 of the Privacy Policy).

13. Term and precedence

This agreement lasts as long as Flowmatic processes personal data for you. If it conflicts with the Terms, this agreement prevails for data protection matters. Questions go to seorbit@flowmatic.ro.