Data Processing Addendum

The customer is the controller for customer personal data unless the order states another role allocation.

SkepticFlow acts as processor when processing customer personal data only on documented customer instructions.

SkepticFlow processes personal data for the agreed service scope, keeps confidentiality commitments, applies appropriate technical and organizational measures, and assists with data-subject requests where feasible.

SkepticFlow notifies the customer without undue delay after becoming aware of a personal-data breach affecting customer data.

SkepticFlow may use listed sub-processors for hosting, communication, AI model access, payments, monitoring, and analytics.

Customers can subscribe to sub-processor change notices and object under the signed agreement when a material change affects their data.

At termination, SkepticFlow deletes or returns customer personal data according to the order, unless law requires retention.

Backup copies are removed on the normal backup lifecycle and remain protected while retained.