Requests360 Data Processing Agreement

1. Roles and scope

The customer is the controller, or a processor acting for its own controller, for Customer Personal Data placed in a Requests360 workspace. Flevanta Origins Ltd is the processor for that Customer Personal Data. Flevanta remains an independent controller for its own business administration, billing, service-security and support records.

This DPA applies for the duration of the customer agreement and to the extent Flevanta processes Customer Personal Data to provide, secure, maintain, support or terminate Requests360.

2. Processing details

Subject matter: hosting and operating request, workflow, approval, user-access, audit and External case-management functionality.

Nature and purpose: storing, organising, retrieving, displaying, routing, securing, backing up and otherwise processing Customer Personal Data so authorised customer users can use Requests360.

Duration: for the customer agreement plus the limited deletion/backup period described below.

Data subjects: customer personnel, contractors, authorised users, suppliers, customers and other external contacts whose information the customer chooses to place in Requests360.

Personal data: names, business contact details, user/account identifiers, organisation/team membership, roles, request and approval content, comments, audit events, case correspondence, timestamps and similar operational information. Special-category, criminal-offence, biometric, health and payment-card information are outside the intended scope unless separately agreed in writing.

3. Documented instructions

Flevanta will process Customer Personal Data only on the customer's documented instructions, including the customer agreement, configuration choices and written support instructions, unless UK law requires otherwise. If legally permitted, Flevanta will tell the customer before processing required by law. Flevanta will promptly tell the customer if it believes an instruction infringes applicable data protection law.

4. Confidentiality

Flevanta will ensure that people authorised to process Customer Personal Data are subject to appropriate confidentiality obligations and receive access only where needed for their role.

5. Security

Taking account of the nature of processing, risks, costs and available technology, Flevanta will maintain appropriate technical and organisational measures. Current measures include authenticated access, role and tenant controls, database row-level security, least-privilege application functions, encrypted transport, private production secrets, controlled provider access, logging, backup/recovery procedures and security testing appropriate to the service.

Customers remain responsible for their own user administration, endpoint security, lawful data collection and deciding what information their users may place in the service.

6. Subprocessors

The customer gives Flevanta general written authorisation to use the subprocessors on the current Requests360 subprocessor list. Flevanta will require each subprocessor that processes Customer Personal Data to be bound by the same data protection obligations as set out in this DPA, as required by Article 28(4). Flevanta remains liable for the performance of those subprocessors.

Flevanta will give the customer at least 14 days' prior notice by email, service notice or another durable written channel before a material new or replacement subprocessor begins processing Customer Personal Data, except where an urgent security or legal need makes advance notice impracticable, in which case notice will be given as soon as reasonably possible. A customer with a reasonable data-protection objection should contact us during the notice period. We will work in good faith on a reasonable alternative; if none is reasonably available, either party may terminate the affected service without penalty for the unused prepaid period.

7. International transfers

The database and sign-in service run on Flevanta Origins Ltd's own server in the United Kingdom. Supabase Pte. Ltd. is not a subprocessor and does not receive Customer Personal Data. That processing is not a restricted transfer.

The customer authorises the transfers of Customer Personal Data outside the UK that are necessary for the subprocessors on the current subprocessor list to perform their services, including Cloudflare, Inc.'s network, which is used by design. Flevanta will ensure each such transfer is covered by a lawful UK GDPR mechanism: UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the recipient is certified), the ICO's International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses. Flevanta will not make any other restricted transfer except on the customer's documented instructions.

8. Individual rights

Taking account of the nature of processing, Flevanta will provide reasonable technical and organisational assistance to help the customer respond to requests from individuals exercising data-protection rights. If Flevanta receives a request concerning Customer Personal Data directly, it will normally refer the person to the customer unless law requires a different response.

9. Security incidents and compliance assistance

Flevanta will notify the customer without undue delay, and in any event aim to notify within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data, and will provide information reasonably available to help the customer meet its notification and communication obligations. Flevanta will also provide reasonable assistance, taking account of the nature of processing and information available, with security obligations, DPIAs and regulator consultation where required.

10. Return and deletion

During the subscription, the customer may request a reasonable export of Customer Personal Data in a commonly usable format where technically available. At the end of the service, and at the customer's choice where feasible, Flevanta will return or delete Customer Personal Data and delete remaining operational copies unless UK law requires retention.

Unless a different period is agreed, operational workspace data will be scheduled for deletion within 30 days after termination once any requested return/export is complete. Residual copies may remain in our own encrypted backups on Flevanta's server for 30 days and are then deleted automatically. They stay protected and are not restored for ordinary business use.

11. Information and audits

Flevanta will make available information reasonably necessary to demonstrate compliance with Article 28. On reasonable written notice, the customer may request relevant security/compliance information and, where that information is insufficient, a proportionate audit by the customer or an independent auditor. Audits must protect other customers, confidential information and system security, avoid unnecessary disruption and normally occur no more than once annually unless a material incident or regulator requires otherwise.

12. Priority and changes

If this DPA conflicts with the customer agreement on protection of Customer Personal Data, this DPA prevails to the extent of the conflict. We may update this DPA to reflect changes in law or service providers, but will not materially reduce the protection of Customer Personal Data during a current paid subscription without a lawful basis and appropriate notice.