Data processing agreement (B2B DPA)

Last updated: 25 September 2026

This Data Processing Agreement ("DPA") supplements the Terms of Service between the business customer who activates DayInFlow ("Customer") and AMZSTRATEGY LLC, Company ID / Registration Number 2026-002043679, 30 N Gould St, Ste R, Sheridan, WY 82801, USA ("DayInFlow"). It applies to personal data that DayInFlow processes on behalf of the Customer through the service. The definitions of "controller", "processor", "data subject", "personal data breach" and "processing" follow the GDPR where applicable. If the Customer acts as a controller for a third party, it warrants that it can give the instructions set out here and has obtained the necessary authorizations.

1. Subject matter, duration and instructions

DayInFlow processes the data to provide, protect, maintain and support the functions purchased and configured by the Customer: organizations, users, calendars, availability, events, bookings, call payments if enabled, notifications, integrations and support. Documented instructions include the contract, the choices made in the product and written requests compatible with the service. Processing lasts for the duration of the contract and the subsequent period necessary for export and deletion, except where legal obligations require otherwise. DayInFlow will inform the Customer if it considers an instruction to contravene applicable law, unless legally prohibited.

The Customer determines the purposes of bookings, the questions asked of invitees, the legal basis, the lawfulness of communications, the recipients and any additional notices. The Customer must not enter special category or highly sensitive data without first assessing the necessity, lawfulness and suitability of the service. DayInFlow does not use invitees' data for its own sale of data or for its own campaigns.

2. Authorized persons and confidentiality

DayInFlow limits access to personnel and collaborators who need it for provision, support, security or compliance. It binds them to confidentiality and appropriate instructions. Administrative accesses are limited, tracked and reviewed according to risk. The Customer remains responsible for configuring its own roles, hosts, team managers and recipients.

3. Technical and organizational measures

DayInFlow adopts measures appropriate to the risk, including separation of organizations' data, access control, protection of credentials and secrets, encryption of data in transit and of confidential information where appropriate, backups, logging, monitoring, mitigations against abuse and periodic verification. System availability also depends on external providers and the connections configured by the Customer. Measures may evolve provided they do not materially reduce the overall level of protection.

The Customer must use strong authentication where available, update roles, disconnect those no longer authorized, review permissions granted to integrations and protect devices and exports under its control.

4. Subprocessors

The Customer generally authorizes the use of categories of subprocessors necessary for hosting, database, authentication, email and SMS delivery, payments, AI processing, monitoring and support, according to the updated list on the page «Subprocessors and transfers». DayInFlow imposes on subprocessors obligations of protection substantially equivalent to those applicable to the entrusted processing and remains liable for their performance to the extent provided by law. It will inform the Customer of relevant additions or replacements with reasonable notice, except for security urgencies. The Customer may raise a reasoned objection for data protection reasons; the parties will seek a practicable solution and, if impossible, will consider termination of the affected service.

Integrations that the Customer chooses to connect to its account may act as independent providers or as subprocessors depending on the data flow. The Customer must review the supplier's terms before authorizing it.

5. Assistance to the Customer

Taking into account the nature of the processing and the information available, DayInFlow assists the Customer in responding to data subjects' requests for access, rectification, erasure, restriction, portability and objection. If a request arrives directly at DayInFlow and concerns data processed for the Customer, DayInFlow will forward it or request instructions, without responding on the merits unless legally obliged. DayInFlow provides reasonable assistance for impact assessments, consultations with authorities, security measures and notification obligations, within the limits of the information available; any extraordinary activities may require an agreement on costs.

6. Personal data breaches

When it detects a personal data breach affecting data processed for the Customer, DayInFlow will inform the Customer without undue delay after becoming aware of it, through the administrative contact or an appropriate channel. The notification will describe, to the extent known, the nature of the incident, categories of data and data subjects involved, likely consequences, measures taken or planned and a point of contact. Information may be provided progressively. The Customer decides and manages notifications to authorities and data subjects when acting as controller, with DayInFlow's reasonable assistance.

7. International transfers

If the processing involves a transfer subject to the rules of the European Economic Area or the United Kingdom to a non-adequate country, the parties will adopt the applicable legal mechanism, including, where necessary, the standard contractual clauses of the European Commission in the relevant template and supplementary measures. This DPA does not automatically substitute for valid execution or incorporation of the standard contractual clauses nor for the transfer assessments required. The Customer may request from support@dayinflow.com the information available on safeguards and flows.

8. Checks and demonstration

DayInFlow makes available information reasonably necessary to demonstrate compliance with the obligations applicable to the processor. The Customer may request clarifications or a proportionate verification, with notice, agreed timing, confidentiality, protection of other customers and without compromising security. An on-site audit requires reasonable justification where documents and remote controls are not sufficient. The parties agree on costs and procedures before any extraordinary activities.

9. Return, deletion and precedence

At the end of the service the Customer may export data during applicable access periods. DayInFlow deletes or renders non-identifiable the data processed on behalf of the Customer in accordance with the Terms and the Privacy Policy, except for legal obligations, disputes or backups on limited rotation. Invoices and other records that DayInFlow must retain as controller remain separate. If this DPA and the Terms are incompatible regarding processing on behalf of the Customer, the DPA prevails; non-derogable rights provided by law remain unaffected.

Annex A — Description of processing

Data subjects: members and collaborators of the Customer, hosts, invitees and their indicated companions, support contacts. Categories of data: identity and contact details, role, availability, calendar metadata, date/time/zone and status of the appointment, answers to questions, event notes, communications, any call payment data in limited form, technical logs. Purposes: to deliver and manage the functions configured by the Customer. Nature: collection, recording, consultation, organization, storage, transmission to authorized recipients, deletion. Duration: contract plus export, deletion windows and legal obligations described in related documents. Categories of recipients: persons authorized by the Customer, invitees within the limits of the booking and necessary suppliers.

Annex B — Security measures

Authentication and role-based authorization; logical separation of workspaces; input validation and request rate limiting; encryption of traffic; protection of secrets; backup and restore; tracking of sensitive actions; updates and vulnerability management; permission review; incident response procedures; protection of support channels. The description indicates categories of contractual controls, not certifications or results of independent audits.