Data Processing Agreement
Parties and roles
The Customer (you, the holder of an SEO Conquest account) is the controller of the personal data contained in the websites and content you manage through SEO Conquest. FLOWMATIC S.R.L., tax id (CUI) 52891900, trade registry J2025087179005, Str. Vasile Alecsandri, bl. 66A, sc. A, parter, ap. 1, Pitești, Argeș 110377, Romania ("Flowmatic") is the processor. For your own account data (email, billing identity, logs) Flowmatic is the controller, as described in the Privacy Policy.
Subject matter, duration, nature and purpose
Subject matter: the personal data that appears in the sites you connect, the content we import from them, the content we generate and publish for you, and the search and AI-visibility data we collect about your sites. Duration: the life of your SEO Conquest account, plus the deletion period in section 10. Nature and purpose: hosting, analysis, generation, publishing and reporting, only to provide the SEO Conquest service.
Categories of data and data subjects
Data: names, contact details, job titles, quotes and images that appear on your website or in the content you ask us to produce; identifiers of your platform accounts. Data subjects: your staff, your customers, the authors and people mentioned on your website, and the visitors of your site as far as their data reaches us through your platform.
Instructions
Flowmatic processes personal data only on your documented instructions. These Terms, the settings you choose in the app and the actions you take there are those instructions. If we believe an instruction breaks the law, we tell you. If the law of the EU or of a member state requires us to process the data otherwise, we inform you before we do, unless the law forbids it.
Confidentiality
Everyone at Flowmatic who can access your data is bound by a duty of confidentiality and gets access only as far as their role requires.
Security measures
- Encryption in transit (TLS) for every connection to and from the service.
- Encryption at rest (AES-256-GCM) for platform credentials; hashed passwords.
- Access control: named accounts, least privilege, tenant isolation at the database layer.
- Logging: an audit trail of sign-ins and administrative actions.
- Backups of the database, stored under the same access rules.
- Rate limiting and abuse detection on public endpoints.
Sub-processors
You authorise the recipients identified as processing on our behalf in the Privacy Policy, for the stated service and data scope. Activities where Google or Stripe acts as an independent controller are governed by that recipient’s applicable terms and are not described here as subprocessing. kie.ai receives fixed generic image scenes, not your personal content. Before adding a sub-processor for your personal data we notify you by email or in the app at least 15 days in advance. You may object on reasonable data protection grounds within that period; if we cannot address the objection, you may cancel the affected service. Flowmatic remains responsible to you for its sub-processors.
Assistance with data subject rights
Taking the nature of the processing into account, Flowmatic helps you answer requests from data subjects (access, rectification, erasure, restriction, portability, objection). If such a request reaches us directly, we forward it to you without answering on your behalf, unless the law requires otherwise.
Breach notification
If we become aware of a personal data breach affecting your data, we notify you without undue delay and no later than 72 hours after becoming aware of it, with the information we have at that time and updates as we learn more, so you can meet your own notification duties. We also assist you with data protection impact assessments and prior consultations where our processing is involved.
Deletion and return
At the end of the service, you may choose return or deletion of personal data processed on your behalf, unless EU or member state law requires retention. The in-app content export is not a complete personal-data return; contact office@flowmatic.ro for the complete request. Account deletion preserves justified accounting records and separately reviewed financial or abuse-prevention evidence. Local backups rotate after 14 days following a successful new copy; encrypted off-server and maintenance copies have a 35-day target reviewed monthly, with documented recovery or legal-hold exceptions. Historical copies are not erased immediately. We keep a minimal deletion record and replay deletions before restoring normal service from a backup. Your request includes assessment of these retained records and copies; account closure alone is not a promise of complete erasure within 30 days.
Audit
On request we provide the information needed to show that we meet our obligations under GDPR art. 28, including summaries of our security measures and of relevant provider reports. Where that is not enough, you may audit us, or mandate an independent auditor to do so, once a year, on 30 days' notice, during business hours and without disrupting the service. You bear the cost of the audit.
The notice, frequency and cost arrangements above do not restrict mandatory Article 28 audit and information rights, supervisory-authority powers, or an urgent investigation of a data-protection incident.
Transfers
The main database is hosted by Flowmatic in Romania. Provider-specific contractual arrangements and international-processing safeguards are described in the Privacy Policy. Anthropic, DataForSEO and Stripe publish processing terms incorporated into their service agreements; Google’s relevant API terms distinguish independent-controller processing. This DPA does not extend an agreement to a service, recipient or data category it does not cover. We do not send your personal content to kie.ai: image requests use fixed generic scenes and styles. Contact office@flowmatic.ro for applicable recipients, countries, available safeguards and copies of documentation.
Term and precedence
This agreement lasts as long as Flowmatic processes personal data for you. If it conflicts with the Terms, this agreement prevails for data protection matters. Questions go to office@flowmatic.ro.