1Flow Data Processing Agreement (DPA)
Thank you for using 1Flow!
1Flow is a US company and our data infrastructure is based in Germany covered by the EU’s strong data privacy laws. Processing and storing data in a secure, fair, and transparent way is extremely important to us.
This Data Processing Agreement (“DPA”) is an addendum to the Terms of Service between 1Flow and the customer.
If you are accepting this DPA on behalf of your customer, you warrant that: (a) you have full legal authority to bind your customer to this DPA; (b) you have read and understand this DPA; and (c) you agree, on behalf of your customer, to this DPA.
These service terms incorporate the 1Flow Data Processing Agreement” (“DPA”), when the General Data Protection regulation (“GDPR”) applies to your use of 1Flow services to process visitor data as defined in the DPA. We protect and secure your visitor data to the high standards set out in the agreement.
Definitions
“You” or “customer” refers to the company or organization that signs up to use the 1Flow to analyze website and mobile app users.
In the course of providing the 1Flow service to customer pursuant to the agreement, 1Flow may process visitor data on behalf of customer.
In this Data Processing Agreement (“DPA”), “Data Protection Legislation” means the General Data Protection Regulation (Regulation (EU) 2016/279), and all other applicable laws relating to processing of visitor data and privacy that may exist in any relevant jurisdiction.
“data controller”, “data processor”, “data subject”, “personal data” and “processing” shall be interpreted in accordance with applicable Data Protection Legislation.
The parties agree that the customer is the data controller and that 1Flow is its data processor in relation to visitor data that is processed in the course of providing the service.
Privacy and security of your visitor data
We take many measures to protect and secure your data through backups, redundancies, and encryption. When you use our service to measure your website stats, 1Flow will collect information about your visitors.
You entrust us with your site data and we take that trust to heart. You agree that 1Flow may process your data as described in our data policy and for no other purpose. We do our best to deserve that trust by being open about who we are, how we work, and keeping an open door to your feedback.
You own all right, title, and interest to your user data. We obtain no rights from you to your website data. We do not collect and analyze personal information from web users and use these behavioral insights to sell advertisements. When using 1Flow, you 100% own and control all of your website data. We don’t sell or share your site data to any third-parties, and we don’t abuse your visitor’s privacy.
Even though the purpose of 1Flow is to track the usage of a website, this can still be done without tracking, collecting or storing any personal data or personally identifiable information (PII), without using cookies and while respecting the privacy of your website visitors.
By using 1Flow, all the site measurement is carried out absolutely anonymously. Cookies are not set and no personal data is collected. We do not generate any persistent device identifiers. We never store IP addresses in our database or logs. The data we process cannot be used to identify any single individual.
We minimize data collection in general. We measure only the most essential data points and nothing else. All the metrics we do collect fit on one single page.
All of the data that we do track is kept fully secured, encrypted and hosted on renewable energy powered server in Germany. This ensures that all of the website data is being covered by the European Union’s strict laws on data privacy. Your visitor data never leaves the EU.
1Flow is fully open source software which means that our source code is available and accessible on GitHub so anyone can check it out and audit it. You can read it, inspect it and review it to understand how it works and to ensure it keeps the data private and secure. This gives you and everyone else full transparency on how we handle the website traffic data. It is this transparency and openness that means that open source products can be more trustworthy than proprietary and closed source products.
The group of data subjects affected by the processing of their data under this agreement includes end-users of the controller’s websites which make use of the service provided by the processor.
Processor’s obligations with respect to the controller
1Flow will process visitor data only in accordance with instructions from customer through the settings of the service, i.e. (a) to operate, maintain and support the infrastructure used to provide the service; (b) to comply with customer’s instructions and processing instructions in their use, management and administration of the service; (c) as otherwise instructed through settings of the service. 1Flow will only process visitor data in accordance with the agreement.
1Flow shall notify customer without undue delay if, in 1Flow’s opinion, an instruction for the processing of visitor data given by customer infringes applicable Data Protection Legislation.
1Flow shall guarantee the confidentiality of visitor data processed hereunder.
We as humans can access your data to help you with support requests you make and to maintain and safeguard 1Flow to ensure the security of your data and the service as a whole. 1Flow shall ensure that all 1Flow personnel required to access the visitor data are informed of the confidential nature of the data and comply with the obligations sets out in this agreement.
1Flow shall implement and maintain appropriate technical and organisational security measures designed to protect the visitor data against unauthorised or unlawful processing and against accidental loss, destruction, damage, theft, alteration or disclosure. These measures shall be appropriate to the harm which might result from any unauthorised or unlawful processing, accidental loss, destruction, damage or theft of the visitor data and having regard to the nature of the visitor data which is to be protected.
We do work with sub-processors. We’ve listed links to our current sub-processors in our privacy policy. With each vendor, we assess their commitment to privacy and we sign a data processing agreement with them that include the controller-processor Standard Contractual Clauses. Any such subcontractors will be permitted to process data only to deliver the services 1Flow has retained them to provide, and they shall be prohibited from using data for any other purpose.
If 1Flow becomes aware of any accidental, unauthorised or unlawful security breach, destruction, loss, alteration, or disclosure of the personal data that is processed by 1Flow in the course of providing the service, it shall without undue delay (not later than 48 hours after having become aware of it), notify customer by email and provide customer with a description of the incident as well as periodic updates to information about the incident, including its impact on customer content. 1Flow shall additionally take action to investigate the incident and reasonably prevent or mitigate the effects of the incident.
1Flow shall not on its own authority rectify, erase or restrict the processing of visitor data that is being processed on behalf of the controller (unless this is required by law or the Processor Terms of Service), but shall only do so on documented instructions from the controller and in accordance to the data retention rules associated to the controller subscription plan.
How we handle delete instructions
You can choose to delete your account and delete your user data at any time. We will process your delete task upon receiving your written request.
All your data will be permanently deleted immediately when you delete your 1Flow account or when you delete your site stats. We cannot recover this information once it has been permanently deleted.
Customer undertakings and 1Flow assistance
Customer warrants that it has all necessary rights to provide to 1Flow the visitor data for processing in connection with the provision of the 1Flow Services.
Customer shall comply at all times with Data Protection Legislations in respect of all visitor data it provided to 1Flow pursuant to the Agreement.
Customer understands, as a controller, that it is responsible (as between customer and 1Flow) for:
determining the lawfulness of any processing, performing any required data protection impact assessments, and accounting to regulators and individuals, as may be needed;
providing relevant privacy notices to data subjects as may be required in your jurisdiction;
implementing your own appropriate technical and organizational measures to ensure and demonstrate processing in accord with this DPA;
notifying any relevant regulators or authorities of any incident as may be required by law in your jurisdiction.
Liability and Indemnity
Each party indemnifies the other and holds them harmless against all claims, actions, third party claims, losses, damages and expenses incurred by the indemnified party and arising directly or indirectly out of or in connection with a breach of this DPA.
Duration and Termination
The DPA is effective as of April 06, 2021 and replaces and supersedes any previously agreed data processing agreement between you and 1Flow relating to the GDPR.
Termination or expiration of this DPA shall not discharge the parties from the confidentiality obligations herein.
Are customers required to sign the 1Flow DPA?
In order to use our products and services, you need to accept our DPA. By using our product you are agreeing to our terms of service, and you are automatically accepting our DPA and do not need to sign a separate document. We provide the same privacy rights and protection to all customers.
Can a customer share the 1Flow DPA with its customers?
Yes. The DPA is a publicly available document and customers who wish to share it with their customers to confirm our security measures and other terms may feel free to do so.
Do customers need to notify anyone upon accepting our DPA?
No. You are not required to notify us or any third party upon accepting our DPA though, as mentioned above, you are free to do so.
Contact Us
If you have a question about the Data Processing Agreement (DPA), please contact us.